Company: ADP
Filing Date: 2025-08-06
Form Type: 10-K
Source: 0000008670-25-000037
Chunk: 45

Company: AUTOMATIC DATA PROCESSING INC
Filing Date: 2025-08-06
Form: 10-K
Item: Item 1C
Chunk 45
---
Item 1C. Cybersecurity

Risk management and strategy

At ADP, security is integral to our products, our business processes and infrastructure. We have an enterprise-wide approach to security with the objectives of protecting client data and funds, and preventing security incidents that could adversely affect the confidentiality, integrity, or availability of our information systems and data that resides in those systems, while also improving our system resilience with the aim of minimizing the impact to our business when incidents do occur.In connection with our business, we collect, host, store, transfer, process, disclose, use, secure, retain and dispose of large amounts of personal and business information about our clients, employees of our clients, our vendors, our partners, and our employees, contractors and temporary staff. We also collect significant amounts of funds from the accounts of our clients and transmit them to their employees, tax authorities and other payees. As the global environment continues to grow increasingly hostile and attacks on information technology systems continue to grow in frequency, complexity and sophistication, we are regularly targeted by unauthorized parties using malicious tactics, code and viruses. Although this is a global problem, it may affect our businesses more than other businesses because unauthorized parties may focus on the amount and type of personal and business information that our businesses collect, host, store, transfer, process, disclose, use, secure, retain and dispose of, and the client funds that we collect and transmit.ADP has implemented a cybersecurity program designed to assess, identify, and manage risks from cybersecurity threats. Our cybersecurity policies, processes, and standards are informed by industry practices and by industry frameworks and standards such as the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework and the International Organization for Standardization information security standards, including those standards for which we do not have a certification, but we do exercise judgment in selecting applicable controls from such framework or standards. Our cybersecurity program includes: •Technical Safeguards. We have implemented a layered approach to defend against cybersecurity threats. We periodically evaluate technical controls through application security assessments, vulnerability management, penetration testing, and security audits.•Incident Management and Response. A global team monitors our key applications and systems 24/7/365 to detect, investigate and respond to anomalies and incidents. This team addresses reported or detected issues by following a defined incident lifecycle and uses an incident management system to record facts, impact and remedial actions taken. We have established a cybersecurity incident response plan and escalation process, outlining processes for responding to incidents from identification to mitigation and notifying members of senior leadership, the