Company: FCFS
Filing Date: 2025-02-03
Form Type: 10-K
Source: 0000840489-25-000032
Chunk: 0

Company: FirstCash Holdings, Inc.
Filing Date: 2025-02-03
Form: 10-K
Item: Item 1C
Chunk 0
---
Item 1C. Cybersecurity

Risk Management and StrategyThe Company recognizes the importance of being able to effectively respond to and manage cybersecurity threats and incidents that may compromise the confidentiality, integrity or availability of its information systems, data or network resources. As part of its overall enterprise risk management framework, the Company maintains both an Information Security Program (“ISP”) and an Incident Response Plan (“IRP”). The Company’s ISP is managed by its Chief Information Officer (the “CIO”) whose team (the Security Incident Response Team, or “SIRT”) is responsible for leading company-wide cybersecurity strategy, policy, standards, architecture, and processes. The Company’s IRP is based on applicable federal and state laws as well as cybersecurity incident response best practices. The purpose of the IRP is to define procedures for reporting and responding to cybersecurity incidents. It creates objectives for actionable procedures that can be measured, evaluated, scaled and revised as necessary for each specific incident. These objectives include maximizing the effectiveness of the Company’s operations through an established plan of action and assigning responsibilities to appropriate personnel and/or third-party contractors.The Company has engaged a third-party managed detection and response company to monitor the security of its information systems around-the-clock, including intrusion detection, and to provide instantaneous alerting should a cybersecurity event occur. If a cybersecurity threat or cybersecurity incident is identified through the Company’s information systems, the SIRT will communicate the cybersecurity threat or cybersecurity incident and any damages to the CIO and other members of senior management of the Company. The Company will assess the materiality of the cybersecurity threat or cybersecurity incident to determine if any public disclosures are required under the SEC’s cybersecurity disclosure rule. If deemed necessary, third-party consultants, legal counsel, and assessors will be engaged to evaluate the materiality assessment.The Company has training and awareness programs designed to educate its employees about cybersecurity risks and how to protect the Company, its customers and themselves from cyberattacks and to keep its employees informed about cybersecurity threats and how to stay safe online, including secure access practice, phishing schemes, remote work and response to suspicious activities.

37

 Table of Contents

The cybersecurity program of the Company interfaces with other functional areas within the Company, including but not limited to the Company’s business segments and information technology, legal, risk, human resources and internal audit departments, as well as external third-party partners, to identify and understand potential cybersecurity threats. The Company regularly assesses and updates its processes, procedures and management techniques in light of ongoing cybersecurity developments.Recognizing the complexity and evolving nature of cybersecurity threats, the