Company: GHC
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000104889-25-000022
Chunk: 219

Company: Graham Holdings Co
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 219
---
1A Risk Factors.

Governance.

The Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee which reports on its risk management activities, including risks arising from cybersecurity threats, to the full Board of Directors. The Company’s Vice President of Information Security and Privacy reports to the Audit Committee on an annual basis. In addition, the Audit Committee receives quarterly updates as part of the disclosure control process and other updates, as needed, for significant issues.The annual report to the Audit Committee includes an overview of multiple topics, such as current cybersecurity threats; other cybersecurity risks, including operational, legal/regulatory, and reputational risks; a status summary of company-wide metrics relating to information security controls (e.g., controls addressing vulnerability and patch management, web and mobile application security, administrative access, incident response capability, compliance activities, disaster recovery, sensitive data inventory, and phishing prevention); and planned information security initiatives.At the Company’s corporate level, the Information Security and Privacy team monitors the prevention, detection and remediation of cybersecurity incidents and coordinates with the Company’s business units to assess information security posture and risk. This coordination includes, for example, performing business impact assessments, conducting risk assessments, and testing and evaluating key aspects of business units’ information security programs, the results of which are reported to the Company’s senior management and the Audit Committee as appropriate.The Company’s Information Security and Privacy team is led by the VP of Information Security and Privacy who reports to the Company’s Chief Financial Officer. She joined the Company in 2003 and has more than 30 years of relevant experience. Before joining the Company, she served as the federal government and southeast region leader of Guardent (now part of Verisign), a security and privacy consulting and managed security services company. Prior to Guardent, she worked at PricewaterhouseCoopers LLP in the Technology Risk Services consulting practice. She is a strategic advisor to several organizations in the information security and privacy field and is a Certified Information Systems Security Professional (CISSP), and a Certified Information Privacy Professional (CIPP).Members of the Company’s Information Security and Privacy team have an average of more than 20 years of information security and compliance experience, spanning diverse environments and industries, government agencies, and public and private companies. All members of the core team maintain cybersecurity certifications and attend regular training programs relating to information security, privacy and compliance.The Company views information security as a shared responsibility. It requires employees to complete information security and privacy awareness training and sends out regular communications on information security and privacy topics.