Company: CZR
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001590895-25-000068
Chunk: 335

Company: Caesars Entertainment, Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1
Chunk 335
---
 Operations Center (SOC) to respond to cybersecurity incidents;•attack and response simulations at the technical level and execute tabletop response exercises at the management level;•a third-party risk management process for service providers; and•cybersecurity insurance to cover certain expenses in the event of a cybersecurity incident.The cybersecurity team reports to the Chief Information Officer (“CIO”) and in January 2024, we hired a Chief Information Security Officer (“CISO”) with significant experience in leading cybersecurity teams to assume the leadership of management’s responsibilities and governance discussed below.

Table of Contents29

We evaluate our cybersecurity risk management processes and continue to integrate our procedures into our overall enterprise risk management program, which shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.Incidents are investigated by the cybersecurity team as they are identified and may be resolved or escalated based upon the specific details and severity of each incident. Incidents are evaluated throughout the investigation and remediation processes and incidents determined to be insignificant may be resolved by the cybersecurity team without further escalation at that time. Incidents determined to be more severe, such as those that may have compromised the confidentiality, integrity and availability of our critical systems and information, are escalated by the cybersecurity team to notify legal counsel, our Cybersecurity & Privacy Executive Steering Committee, our Board of Directors, or various regulators, as required. Our cybersecurity team evaluates the risk profile of new third-party service providers and maintains communication channels with key third-party service providers to evaluate and respond to possible effects of incidents within a service provider’s organization. We rely on, and in certain cases require, our third parties to communicate such incidents timely.As previously disclosed, on September 14, 2023, we announced that an unauthorized actor had gained access to our information technology network as a result of a social engineering attack on an outsourced IT support vendor used by the Company, and acquired a copy of, among other data, our loyalty program database, which includes driver’s license numbers and/or social security numbers for a significant number of members in the database (“Data Incident”). After detecting suspicious activity in our information technology network, we activated our IRP, which included containment measures, and commenced an investigation of the incident. We also notified law enforcement and state gaming regulators, engaged legal counsel and other third-party incident response and cybersecurity professionals, as well as forensic professionals.We have received, and continue to pursue, reimbursements from insurance carriers for costs incurred as a result of the Data Incident