Company: ACA
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001739445-25-000026
Chunk: 72

Company: Arcosa, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 72
---
 or financial standing.

30

Table of Contents

Governance

Risk Management Personnel

Arcosa's cybersecurity risk management program is overseen by management at multiple levels. The CISO and Senior Director of Information Security play key roles in assessing, monitoring, and managing the Company's cybersecurity risks with support of dedicated information technology and security personnel. Both the CISO and Senior Director of Information Security have been in their respective roles at Arcosa for over 6 years. The CISO has over 40 years of leadership positions in the high tech and IT industries. He is experienced in detailed product and solution development as well as business process operations providing an understanding of how cybersecurity considerations intersect the business. The Senior Director of Information Security and Compliance at Arcosa has more than 20 years of experience architecting, designing, and deploying security solutions based on industrial frameworks. 

Monitor Cybersecurity Incidents

The CISO and Senior Director of Information Security are continually informed and updated about the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. They implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

Board of Director Oversight

The Board's Audit Committee is responsible for overseeing the Company's cyber risk. The CISO and other experts, as necessary provide the Audit Committee quarterly updates that encompass a broad range of topics, including but not limited to:•Current and emerging cybersecurity threat landscape;•Status of ongoing cybersecurity initiatives and strategies;•Incident reports and learnings from unique cybersecurity events, including those of other companies;•Compliance status and efforts with regulatory requirements and industry standards; and•Benchmarked data on the performance of certain aspects of our cybersecurity program relative to our peers.

In addition, the CISO provides updates to the full Board upon request and updates the Board on unique developments, such as regulatory updates or unique vulnerability developments. Our Board is composed of members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.