Company: KHC
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001637459-25-000011
Chunk: 77

Company: Kraft Heinz Co
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 77
---
, respond to incidents, resolve incidents, and manage communications and responsibilities with authorities about those incidents. The plan applies to all Company personnel (including third-party contractors, vendors, and partners) that perform functions or services requiring access to secure Company information, and to all devices and network services that are owned or managed by the Company.We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third-party service provider. We maintain a third-party cyber risk management process to review and monitor potentially material third-party service providers’ security controls. Third-party service providers are required to provide independent attestation reports of their control environment, which are reviewed to validate that the controls meet Company security requirements. In the absence of such reports, third-party service providers are required to complete a detailed questionnaire describing their controls and provide relevant documentation. As part of the third-party risk management process, we request and review annual penetration test reports for the third-party service providers designed to assess whether all high and medium risk findings are addressed. The control environments for third-party service providers are reviewed annually based on risk. Our cybersecurity risk mitigation strategy includes the use of cybersecurity insurance that provides protection against certain potential losses arising from certain cybersecurity incidents.Risk management concerns, priorities, and progress are reported to the Company’s Enterprise Risk Committee quarterly as part of the Company’s overall enterprise risk management process. Risk management reports describe cybersecurity priorities, planned safeguards, and resource requirements necessary to achieve acceptable risk outcomes for foreseeably harmed parties.The Company governs cybersecurity risk through a risk management program designed to enable employees, members of the Audit Committee, Enterprise Risk Committee, executive officers, and other personnel to make informed decisions about cybersecurity risk management that are appropriate for their level of responsibility. Our Chief Information Security Officer (“CISO”) oversees the team responsible for leading enterprise-wide information security strategy, policy, standards, architecture, and processes. Our CISO has extensive cybersecurity knowledge and skills gained from more than 20 years of work experience in information security in the consumer goods, banking, legal, healthcare, and education sectors as well as the government. Our CISO holds a master’s degree in computer and information systems security/information assurance and designations as a Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM). The CISO evaluates cybersecurity risks, plans for reduction of risks, directs resources and priorities to improve cybersecurity safeguards, measures the results of those efforts, reports to our senior and executive leaders (including our Global Chief Information Officer and Global Chief Financial Officer),