Company: MTCH
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000891103-25-000027
Chunk: 125

Company: Match Group, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 125
---
Item 1C. Cybersecurity

Risk Management and Strategy

Match Group maintains an enterprise-wide information security program designed to identify, protect against, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our information security teams, led by our Senior Vice President, Security Engineering, are responsible for assessing and managing our exposure to information security risks, including by:•Implementing and enforcing physical, operational and technical security policies, procedures and controls;•Conducting, and engaging independent third-party experts to conduct, regular internal and external security assessments and audits, including assessments of the security posture of third-party vendors and partners;•Collaborating with our development teams to engineer and integrate security throughout the product development lifecycle;•Implementing scalable and continuous data protection practices; and•Detecting, monitoring, investigating, and responding to potential security threats and incidents.With a focus on both product and enterprise security, the security program has been set up to protect our information systems from cybersecurity threats as part of our development lifecycles and our ongoing business operations. We implement various technical and operational processes to help prevent, identify, escalate, investigate, resolve, and recover from vulnerabilities and security incidents in a timely manner. These include, but are not limited to, monitoring and detection tools, internal and third-party penetration testing, continuous testing by a dedicated red team, a comprehensive bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our services before they are exploited, and annual and ongoing security awareness training for employees.We have implemented cybersecurity controls to detect and address threats arising from our use of third-party service providers. Security risk assessments are conducted during onboarding, contract renewal, and when an increased risk profile is identified. We also require specified security controls and other responsibilities from our service providers and we investigate security incidents affecting them as deemed necessary.

27

Table of Contents

Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the International Organization for Standardization (“ISO”) and other applicable industry standards. Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. Cybersecurity processes are adjusted based on the information provided from these assessments. We have also obtained industry certifications and attestations that demonstrate our dedication to protecting the data our users entrust to us, including Tinder