Company: MATV
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001000623-25-000009
Chunk: 64

Company: Mativ Holdings, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 64
---
Item 1C. Cybersecurity

Risk management and strategy

We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. Our enterprise risk management system incorporates risks from cybersecurity threats alongside other risks to the company. We employ a range of tools and services to inform our assessment, identification and management of material risks from cybersecurity threats, which include from time to time:•monitoring emerging data protection laws and implementing responsive changes to our processes;•undertaking periodic reviews of our policies with customers, partners, and suppliers and statements related to cybersecurity;•conducting cybersecurity management and incident training for employees involved in our systems andprocesses that handle sensitive data;•conducting phishing email simulations for employees and contractors with access to corporate emailsystems;•requiring employees, as well as third-parties who provide services on our behalf, to treat information and

29

data with care; and•educating our teams on incident response, conducting tabletop exercises and using the findings to improve our processes and technologies.We maintain a cybersecurity incident response plan designed to secure the enterprise, mitigate the impact of an incident, restore normal business operations, prevent similar future incidents and comply with applicable regulatory obligations arising from an incident.  As part of the above process, we periodically engage with consultants and other third-parties, including annually having a third-party perform penetration testing and review our cybersecurity program to help identify areas for improvement and/or compliance.  The Company’s cybersecurity procedures have been developed based on the National Institute of Standards and Technology ("NIST") cybersecurity framework. We also engage with a third-party security operation center to assist in monitoring our cybersecurity risk environment. Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers.  For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, see “Part I, Item 1A. Risk Factors -- A failure of, or a security breach in a key information technology system or process or other unusual events could compromise our information and expose us to liability, which could adversely affect our business; IT project delays and overruns are possible” which is incorporated by reference into this Item 1C.As previously disclosed, during the three-month period ending September 30, 2022, the Company became aware of a cyberattack that had been recently made against certain systems within the Company’s network environment. The attack temporarily affected operations