Company: PAYX
Filing Date: 2025-07-11
Form Type: 10-K
Source: 0000950170-25-095300
Chunk: 3

Company: PAYCHEX INC
Filing Date: 2025-07-11
Form: 10-K
Item: Item 1C
Chunk 3
---
Risk Management and Strategy

We are committed to protecting the confidentiality, integrity, and availability of our systems and information. Our security program is intended to assess, identify, and manage risks from cybersecurity threats, and is aligned with the National Institute of Standards and Technology Version 2.0 Cybersecurity Framework (“NIST CSF”). The NIST CSF provides a flexible model for identifying and managing cybersecurity risks. Our security infrastructure uses a layered controls approach, incorporating various capabilities guided by the NIST CSF and other industry standards and best practices. We routinely invest in our security processes and capabilities, including those related to our risk management and assessment programs, vulnerability and intrusion detection, incident response plans, and other advanced detection, prevention, and protection capabilities. 

We conduct regular assessments of cybersecurity risks to identify threats to us and potential vulnerabilities that could negatively affect our business operations if exploited. We track cybersecurity risks within our enterprise risk management system with cybersecurity threats considered to be among the top-priority risks to us. In addition, our Enterprise Security Organization (the “ESO”) conducts technical risk assessments, and, in some instances, we engage with third-party experts to assist with or perform technical risk assessments. The results of these risk assessments are reported to management. Our processes require escalation of significant cybersecurity risks to management and Paychex’s Audit Committee derived from the Board of Directors (the “Board”). 

The ESO is led by our Chief Information Security Officer (“CISO”) and seeks to maintain a consistent, resilient, and secure infrastructure by partnering with resources across the Company. The ESO implements numerous cybersecurity processes and capabilities, which include but are not limited to: assessing risk associated with significant infrastructure or operational changes and the introduction of new technologies; administering our third-party service provider risk management program; managing secure software development and change management; managing access management and logical access controls, identifying security vulnerabilities through automated scanning technologies; performing penetration testing and due diligence assessments; and protecting the confidentiality, integrity, and availability of the Company’s data in transit. The ESO includes the activities of the Paychex Cyber Fusion Center, which provides 24x7x365 cybersecurity monitoring and incident response. We maintain incident response plans which outline the escalation, investigation, reporting, and overall response procedures depending on the type and severity of incidents. 

As part of our security program, we require all employees to take information security awareness training upon hire and annually thereafter. We provide additional ongoing training to our employees about security best practices and awareness, including internal phishing simulations.

We maintain a program designed