Company: WKC
Filing Date: 2025-04-25
Form Type: DEF 14A
Source: 0000950170-25-058752
Chunk: 20

Company: WORLD KINECT CORP
Filing Date: 2025-04-25
Form: DEF 14A
Chunk 20
---
 affect our internal control systems, information security, data protection and privacy, fraud and cybersecurity risks; and assist management in developing our risk management methodologies and the steps taken to identify, monitor and control such exposures. Our Chief Information Officer (“CIO”) and our Chief Information Security Officer (“CISO”) are responsible for our company’s overall information security activities and cyber risk programs. Our CISO reports to our CIO and leads our cyber and data-related incident response activities. Our current CIO and CISO have more than 40 years of combined experience in the digital and information technology field. We have a cross-functional approach to addressing cybersecurity risk, with our information technology, legal, and internal audit functions regularly presenting to the Audit Committee and Technology & Operations Committee on key cybersecurity topics. Our CISO, together with our CIO and other members of the senior leadership in our information technology organization also provides these committees with these updates on at least a quarterly basis, and more often as needed. These reports include topics such as analyses of recent cybersecurity threats and incidents across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status.We have strategically integrated cybersecurity risk management into our broader enterprise risk management program to ensure cybersecurity risks are identified, evaluated and addressed alongside our operational objectives. Overall, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of our data and information by identifying, preventing and mitigating cybersecurity threats and being prepared to effectively respond to cybersecurity incidents when they occur. As a global company, we are also committed to respecting individual privacy and complying with applicable data privacy laws throughout the world, such as the European Union’s General Data Protection Regulation, U.K. Data Protection Act and the California Consumer Privacy Act.Our cybersecurity policies, standards, processes and practices are designed to align with the National Institute of Standards and Technology Cybersecurity Framework. We have achieved ISO 27001 certification. Our cybersecurity program also includes a detailed control catalog that maps to several other frameworks, providing a broad approach to managing cyber risks. However, we use NIST and other cybersecurity frameworks solely as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.We conduct internal vulnerability scans, penetration tests and breach simulation exercises, reinforcing our controls and our readiness to respond to potential threats. Recognizing the complexity and evolving nature of cybersecurity threats, we regularly engage with a range of external experts, including cybersecurity consultants, auditors and advisers, in evaluating and testing our risk management systems