Company: LAWIL
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000750004-25-000016
Chunk: 57

Company: Light & Wonder, Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 57
---
ITEM 1C.    CYBERSECURITY

Risk Management and Strategy

We have developed, implemented and maintained robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. These measures are included within our overall risk management process. As part of this process, all detected cybersecurity threats and incidents are logged and escalated to the Chief Information Security Officer (“CISO”) and Chief Compliance Officer, who report to our Chief Legal Officer. Annually or more frequently if needed, the CISO meets with the other stakeholders to assemble the company’s Risk Register. Cyber risks are an integral part of this process and the CISO and their team regularly assess the current cyber risk landscape, assess L&W’s susceptibility to those cyber risks, and use that analysis as feedback to the overall Risk Register.

46

We follow a formal cybersecurity incident response policy, which provides for use of third-party service providers where circumstances dictate it is necessary. Our cybersecurity incident response policy incorporates recommendations from the International Organization for Standardization (“ISO”) and the NIST, and it includes proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents, we undertake the below activities:•closely monitor emerging data protection laws and implement changes to our processes designed to comply;•undertake an annual risk assessment and review of our consumer facing policies, business changes and statements related to cybersecurity, or more frequently as needed;•proactively inform our customers of substantive changes related to customer data handling;•conduct annual customer data handling and use requirements training for all our employees and contingent workers;•conduct annual cybersecurity management and incident training for employees and contingent workers involved in our systems and processes that handle sensitive data;•conduct regular phishing email simulations for all employees and all contingent workers with access to corporate email systems to enhance awareness and responsiveness to such possible threats;•through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data in accordance with local laws and regulations;•run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; and•use an internal well-tested incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident.Where circumstances dictate the use of third-party service providers, such