Company: CL
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0000021665-25-000008
Chunk: 94

Company: COLGATE PALMOLIVE CO
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 94
---
ii) develop and implement appropriate safeguards to ensure delivery of critical services; (iii) develop and implement appropriate activities to identify the occurrence of a cybersecurity event; (iv) develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident; and (v) develop appropriate activities to action an incident.We have a comprehensive third party cybersecurity risk review process, which prioritizes, monitors and assesses the risks associated with our third party service provider interactions. The third party service provider assessment framework follows industry standard practices and allows us to properly understand the risk associated with the services provided which are key to our company’s daily operations. For additional information regarding risks faced by the Company from cybersecurity threats, see Item 1A, “Risk Factors - A cybersecurity incident, data breach or a failure of key technology systems could adversely impact our business.”

Board’s Oversight of Cybersecurity Risks

Our Board of Directors is focused on cybersecurity. Specific responsibility for cybersecurity oversight is delegated to the Audit Committee. The Board oversees our risk management process to ensure it is properly designed, well-functioning and consistent with our overall corporate strategy. Our Audit Committee oversees the ERM process and the implementation of appropriate risk monitoring and management systems, though all Board members attend Audit Committee meetings and participate in risk management discussions. Our Board of Directors has adopted a written statement, known as the Independent Board Candidate Qualifications and made available on our website, outlining the qualities sought in our directors. This statement, which is refreshed periodically, is used by the Nominating, Governance and Corporate Responsibility Committee (“NGCR Committee”) to evaluate individual director candidates. The NGCR Committee has identified experience with overseeing and managing risk management processes, including with respect to cybersecurity, as being important to creating an effective, well-rounded and diverse Board. Directors with experience overseeing and managing risk management processes play a critical role in the Board’s oversight of our enterprise risk management process.Our CISO reports to the Audit Committee on cybersecurity quarterly, or more frequently if circumstances warrant, including relevant cybersecurity incidents impacting the Company and on topics related to information security, data privacy and cyber risks and mitigation strategies. In addition, outside experts periodically present to the Board on cybersecurity.

22