Company: SABR
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001597033-25-000027
Chunk: 327

Company: Sabre Corp
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 327
---
UNRESOLVED STAFF COMMENTS

Not applicable.

ITEM 1C.    CYBERSECURITY

Cybersecurity Risk Management and Strategy

We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We maintain a dedicated cybersecurity risk management function, which is integrated as part of our overall enterprise risk management program. Our key cybersecurity risks include, among others, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; remote working environments; third-party risks; technology risks and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage these risks.  To identify and assess material risks from cybersecurity threats, members of our cybersecurity risk management function, which is led by our Chief Information Security Officer ("CISO"), consider cybersecurity threats within the context of our business environment. Cybersecurity risks are managed through technological, process, and administrative controls that are designed to target the mitigation of risk to levels acceptable to the business.  Risk assessment and management include processes for 

18

managing third-party cybersecurity risk. These processes provide that third-party cybersecurity risk assessments are to be performed prior to a vendor’s engagement, upon contract renewal, and as we may otherwise require. Our formal cybersecurity policy program, which includes a collection of security policies and procedures, is in place to establish requirements, standards, and security controls designed to protect Sabre's technology environment.  We employ information technology and cybersecurity technologies that are designed to protect Sabre's technology environment, detect threats, respond to threats and help support operational resilience. These technologies facilitate the identification of threats and vulnerabilities that may exist in the Sabre technology environment. Protective measures are employed to counter threats and mitigate risk, supporting operational resilience of our technology products. These tools include cloud security posture management, workload protection, endpoint detection and response, network firewalls and intrusion detection systems, identity and access management tools, data protection technologies and logging, monitoring, and alerting tools. Accompanying these tools are various processes such as annual security education and monthly awareness training, security maturity assessments, vulnerability assessments, threat intelligence and hunting, penetration testing, and tabletop exercises to inform our professionals’ risk identification and assessment. We practice data protection techniques and processes that are designed to treat our customer data with care.  We also utilize third-parties, consultants, and auditors to regularly assess our security program. These assessments include periodic security maturity assessments