Company: BRSL
Filing Date: 2025-02-25
Form Type: 20-F
Source: 0001619762-25-000007
Chunk: 141

Company: Brightstar Lottery PLC
Filing Date: 2025-02-25
Form: 20-F
Item: Item 16K
Chunk 141
---
 President, CIO, and Vice President, CISO own the GIS Information and Cyber Security Program. The CISO operates the Company’s cyber and information security program under the direct supervision of the CIO, and the CIO reports directly into the Company’s CFO.

•Information and Security Governance Committee
(or the “ ISGC”): The ISGC

Table of Contents

•Cybersecurity Incident Response Committee(or the “ CIRC”): The Company has established a cross-functional CIRC charged with reviewing significant cybersecurity incidents escalated by the CISO to complete a materiality analysis to support the identification of appropriate steps, which may include disclosure in accordance with applicable SEC rules and regulation and other law.

•
Senior Management: Senior management is responsible for collaborating with GIS to implement information and cyber security processes into business operations or functional areas, as appropriate.

Cybersecurity and Our Products and Services

Customers entrust the Company to safeguard their data, and GIS ensures that trust with teams dedicated to maintaining that confidentiality, integrity, and availability of customer data. GIS identifies cybersecurity risks and tracks mitigation activities, testing and monitoring of the operational effectiveness of controls to ensure business commitments are achieved. In addition to internal management of data security controls, GIS undergoes third-party assessments each year to validate that controls are suitably designed and operating effectively. These independent assessments include: (i) internal risk assessments; (ii) System and Organizational Controls (“ SOC”) 1, SOC 2, and SOC 3 audits; (iii) Payment Card Industry assessments; (iv) World Lottery Association assessments; and (v) ISO 27001 certification audits.

GIS has incorporated secure practices into the software development lifecycle, which includes risk assessments of projects, rigorous testing of application and network changes, issue tracking to resolution prior to deployment of changes, governance over our environment and providing a structured, measurable process to ensure solutions are managed and sustainable with a security focus.

IGT’s Global Information Security Management System (“ ISMS”) addresses security concerns related to safeguarding customer data by guiding the management of the overall information security management framework and developing information security documentation, including security policies, security standards and protocols or procedures. The goals pursued by ISMS include:

• Complying with business, legal, and regulatory requirements to maintain the confidentiality, integrity and availability of IGT information assets and services;

• Implementing industry best practices at the program, process and system levels;

• Maintaining IGT’s ability to continue services in the face of events and major disruptions;

• Implementing controls to protect I