Company: CLX
Filing Date: 2025-08-08
Form Type: 10-K
Source: 0000021076-25-000039
Chunk: 46

Company: CLOROX CO /DE/
Filing Date: 2025-08-08
Form: 10-K
Item: Item 1A
Chunk 46
---
 escalation based on the severity of the impact of an incident), mitigate brand and reputational damage, and comply with applicable legal obligations, which includes guidance to support the Company’s assessment of whether an incident is considered “material” for purposes of U.S. securities laws;•Executive and IT team tabletop exercises;•A cybersecurity insurance program to reimburse, up to policy limits, covered costs, losses and claims relating to a data or security breach; •Use of consultants, third-party service providers and information security firms to provide technology systems or support aspects of this program, conduct assessments of the Company's cybersecurity practices and penetration testing, and cybersecurity, risk management and legal experts;•A third-party vendor risk management process that utilizes a risk-based approach for vendors engaged through the Company’s procurement process; and•Cybersecurity awareness training for all employees who have access to Company email and connected devices, periodic phishing awareness simulations, and cybersecurity and phishing awareness content on the Company’s intranet site.The Company’s business strategy, results of operations, and financial condition have been materially affected by our previously disclosed August 2023 cyberattack, and the Company is  regularly subject to cyber threats, ransomware and other security breaches. See “Risk Factors” in Item 1A of this Annual Report on Form 10-K for more information on risks from cybersecurity threats that are reasonably likely to materially affect the Company’s business strategy, results of operations and financial condition.

Governance

ManagementThe Chief Information Security and Infrastructure Officer (CISIO) is responsible for the Company’s cybersecurity risk management program. The CISIO oversees the Company’s technology risk management team. This team works in partnership with the legal, financial reporting controls and internal audit functions to review information technology-related internal controls with the Company’s independent auditors as part of the overall internal controls process.The CISIO has IT and information security experience, including enterprise risk management leadership, and holds a Certified Information Security Manager certification from the Information Systems Audit and Control Association (ISACA). The CISIO reports to the Chief Information and Data Officer (CIDO), who is a member of the Clorox Executive Committee and reports directly to the CEO. The CIDO has experience overseeing and executing technology strategies and implementations in complex, global organizations. The CIDO has been in this role for the Company since June 2020 and has experience leading technology strategy in the consumer packaged goods, manufacturing and retail industries. The Company has established the Clorox Information Security Executive Committee (CISEC) which oversees the information security strategy, policies and