Company: CELH
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0001341766-25-000024
Chunk: 66

Company: Celsius Holdings, Inc.
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1C
Chunk 66
---
Item 1C. Cybersecurity.

Cybersecurity Risk Management and StrategyThe Company has established a cybersecurity risk management program, designed to identify, assess, mitigate, and manage cybersecurity risks, incidents and threats that could potentially impact our business operations. Our internal cybersecurity committee (the "Cybersecurity Committee"), which includes our Chief Financial Officer and key representatives from the Finance, Information Technology ("IT"), and Legal departments, direct our cybersecurity efforts. The Cybersecurity Committee is primarily responsible for monitoring our cybersecurity risk management program, establishing and updating materiality thresholds for reporting cybersecurity incidents and determining whether specific incidents meet established disclosure criteria. The Cybersecurity Committee's role is focused on evaluating incidents against these thresholds to ensure that significant cyber risks are appropriately managed, addressed and if required, disclosed in line with our overarching cybersecurity strategy and policies. The Cybersecurity Committee members rely on the cybersecurity experience of the Company’s head of IT, which includes more than twenty years of experience in cybersecurity and information technology, with focused expertise on cybersecurity strategy, architecture, policy, and processes. Remaining team members have a general familiarity with cybersecurity matters and an understanding of the potential financial impacts, disclosure obligations, and enterprise risks to the Company as they relate to cybersecurity. The Company has also established a Cybersecurity Incident Assessment and Reporting Policy (the "Cyber Incident Policy").Our Vice President of IT is tasked with continuously monitoring our systems and networks for potential cybersecurity threats. The IT department monitors for incidents that meet our established materiality thresholds, which encompass items such as cost, potential impact on operations, and reputational risks, and escalates incidents within our organization for further assessment and responsive action by the Cybersecurity Committee.The Cyber Incident Policy sets forth a process to report cybersecurity incidents that is intended to enable a rapid organizational response to mitigate risks and also to ensure compliance with our public reporting obligations. This process includes incident identification, reporting channels to report any cybersecurity incidents, reporting procedures with respect to information to be included in any incident report, provision for confidentiality of information reported, the initiation of a response process to any reported incident, communication of a reported incident to the Cybersecurity Committee.In addition to our internal reviews we may from time to time engage external cybersecurity firms to assist with investigations and external cybersecurity experts to evaluate our processes, including conducting penetration tests, to report on our cybersecurity infrastructure and processes to our senior management and to the Enterprise Risk and Audit Committee (the "Audit Committee") of our Board. Our Cyber Incident Policy also establishes procedures for engaging law enforcement should the need arise and defines certain parameters with respect to drafting initial