Company: CVGI
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0001628280-25-012913
Chunk: 51

Company: Commercial Vehicle Group, Inc.
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1C
Chunk 51
---
Item 1C.      Cybersecurity

Cybersecurity Risk Management and StrategyWe recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service provider risks when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of 

18

Table of Contents

operations, or financial condition, under the heading “Security breaches and other disruptions could compromise our information systems and expose us to liability, which could cause our business and reputation to suffer” included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

Cybersecurity GovernanceCybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates periodically from senior management regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information