Company: IPGP
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001111928-25-000023
Chunk: 98

Company: IPG PHOTONICS CORP
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 98
---
ITEM 1C.    CYBERSECURITY

The Company understands the importance of preventing, assessing, identifying and managing material risks associated with cybersecurity threats. 

Cyber Risk Management and Strategy

We have implemented a number of technical and organizational safeguards designed to manage our risks from cybersecurity threats and to protect against, detect and prepare to respond to cybersecurity incidents.  These include employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms.  Additionally, we engage a third-party cybersecurity firm to assist with security features such as network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures.Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare, to respond and to recover from cybersecurity incidents.  We have processes designed to triage, assess severity, investigate, escalate, contain and remediate an incident.  We also have processes to comply with potentially applicable legal obligations and mitigate brand and reputational damage. As part of the above processes, we engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.We have adopted cybersecurity control principles based on the National Institute of Standards and Technology Cybersecurity Framework (NIST), the Center for Internet Security (CIS) and ISO 27001. Further, our cybersecurity controls are designed to comply with applicable laws concerning protection of private information, including the EU General Data Protection Regulation (GDPR), Brazil’s Lei General de Proteção de Dados Pessoais (LGPD) and the California Consumer Privacy Act of 2018 (CCPA).Our processes include assessing cybersecurity risks associated with our use of third-party service providers in the normal course of business, including those in our supply chain or who have access to our customer and employee data or our systems. Additionally, we assess cybersecurity considerations in the selection and oversight of our third-party service providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.

Governance Related to Cybersecurity Risks

The Company’s Global Director, Information Security (Security Director) directs the Company’s cybersecurity team. He reports to the Company’s Global Director of Information Technologies (IT Director), who reports to the Chief Executive Officer of the Company.  The Security Director is responsible for assessing and managing the Company’s cyber risk management program, informing senior management, as appropriate, regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervising such efforts generally by the cybersecurity team. Our Security Director is a Certified Information Systems