Company: KODK
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0000950170-25-040256
Chunk: 56

Company: EASTMAN KODAK CO
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1B
Chunk 56
---
None.

ITEM 1C. CYBERSECURITYRisk Management and StrategyKodak has implemented various processes designed to help assess, identify and manage risk from cybersecurity threats. Kodak's cybersecurity program follows the structure and objectives of the U.S. National Institute of Standards and Technology (“NIST”) Cybersecurity Framework and is designed to satisfy multi-jurisdictional regulatory requirements. Key areas of Kodak's cybersecurity risk management processes and strategy currently include:•Cross-Functional Collaboration and Coordination. Our IT security operations and risk management team (“IT Security Team”), led by our Chief Information Security Officer (“CISO”), has first line responsibility for the implementation and operation of our cybersecurity risk management processes. However, this team works together with other internal teams to coordinate efforts, priorities and oversight. These include:

26

Table of Contents

oour IT Risk Council (the “Council”), which is comprised of key leaders from stakeholder groups throughout the Company and led by our CISO, and meets monthly to review metrics and discuss risks and recent events;oour Risk Management and Compliance Committee (the “Risk Committee”), which is responsible for evaluating and assessing overall enterprise risk, including cybersecurity risk;oour Internal Audit Department, which monitors certain IT systems controls that are integrated into our larger Sarbanes-Oxley control environment;oour Chief Privacy Officer; andoour crisis management team, a cross-functional team of senior management and subject matter experts from across the Company established to be ready to respond to crisis events, including those arising from cybersecurity incidents.•Routine Evaluation and Assessment of Systems and Processes. We routinely evaluate our IT systems and infrastructure, including with respect to system security, and regularly implement upgrades to improve system functionality and performance as well as to enhance security. Security controls are routinely assessed by our annual general controls audit and other audits and assessments as well as a thorough assessment performed during the annual cyber insurance application process. In addition to periodic in-depth evaluations of our systems and processes, we monitor our IT systems and processes on a regular basis with the goal of identifying and remediating real and potential threats as they arise.•Security Awareness Program to Train and Test Personnel. We operate a security awareness program that includes regular, mandatory trainings for relevant personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing.•Incident Response Process and Team. We maintain an incident response process with defined roles, responsibilities and reporting protocols. This process focuses on responding to and recovering from any significant breach as well as mitigating any impact to our