Company: BWNB
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001630805-25-000007
Chunk: 175

Company: Babcock & Wilcox Enterprises, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1C
Chunk 175
---
 such incidents, should they occur;•maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks;•monitor emerging data protection and cybersecurity laws, and implement changes to our processes and systems designed to comply, and through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care;•conduct several cyber-specific penetration tests per year; and•engage consultants and other third parties, as appropriate, in connection with our cybersecurity practices.

Governance of cybersecurity risk managementOur Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. Management is responsible for day-to-day assessment and management of cybersecurity risks. The IT Executive Steering Committee, comprised of a cross-functional group of our executive management, leads management's oversight of the IT function, including IT risk management. The IT Steering Committee, comprised of operational management, provides tactical oversight of the IT function, including IT risk managementOur Director of IT has primary oversight of material risks from cybersecurity threats. Our Director of IT has 20 years of experience across various software engineering, IT security and compliance, business and management roles, including 

31

serving as the Director of Engineering Applications and Data Management, leading the development and implementation of information technology strategies and roadmaps for Digital and Engineering applications group. The Director of IT is supported by our Director of IT Security and Compliance, who has more than 10 years of experience in information technology and IT security.Our Director of IT and Manager of IT Cybersecurity, Compliance and Data Privacy assess our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. We have governance and compliance structures that are designed to elevate potential threats or vulnerabilities relating to cybersecurity to our Director of IT, IT Steering Committee and IT Executive Steering Committee. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.Our Director of IT meets with the IT Steering Committee monthly to review our information technology systems and discuss key cybersecurity risks. In addition, quarterly the Director of IT reviews our entire risk management program, which includes cybersecurity risks, with the IT Executive Steering Committee and the Board of Directors.

Material cybersecurity risks, threats & incidents

To date, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial position. However, there can be no