Company: WCC
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000929008-25-000005
Chunk: 58

Company: WESCO INTERNATIONAL INC
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 58
---
Table of Contents

Item 1C. Cybersecurity. 

Risk Management and Strategy

Information security and protection of our data is important to Wesco, our customers and suppliers. As a global company, we face various cybersecurity threats, ranging from phishing, ransomware and denial-of-service attacks to more recent threats incorporating the use of artificial intelligence. Our suppliers, third-party vendors, service providers, customers, and other business partners are also vulnerable to similar cybersecurity risks. In response to this evolving cybersecurity threat landscape, we have implemented a cybersecurity risk management program that follows a comprehensive, multi-layered approach to securing our data and business systems from attack, compromise or loss, guided by the National Institute of Standards and Technology (NIST) Cybersecurity Framework. This includes the combination of leading technologies, physical and organizational safeguards, including a robust suite of security policies and procedures. We have a dedicated 24 hours per day/seven days per week Cybersecurity Operations team, with a third-party service provider, monitoring our environment for signs of attack and responding in real-time. Our implementation of a multi-layer and multi-provider portfolio of technologies is designed to deliver overlapping coverage against continually evolving cybersecurity threats with a strong defensive and response driven security posture. We evaluate risks, threats, intelligence feeds and vulnerabilities to adapt, mitigate or respond as appropriate to preserve a secure state. Additionally, we identify, assess and manage risks associated with our use of third-party service providers and other business partners and we maintain a comprehensive third-party risk management program to evaluate partners prior to onboarding, throughout the life of the relationship, and through the conclusion of the relationship. This program is designed to ensure our third-party partners adhere to Wesco’s security policies and expectations as the threat landscape and the relationship evolve.

We engage third-party experts, including auditors, consultants and advisors, to evaluate and enhance our cybersecurity program through security certifications, assessments and testing. Wesco’s cybersecurity programs are reviewed as part of our information security management system (“ISMS”) by external, independent third-party auditors. We have received ISO 27001 certification for our ISMS and we undergo annual audits by an independent accreditation body to maintain this certification. We also engage third-party consultants to perform penetration and vulnerability tests at least once per quarter, as well as annual “red team” engagements that simulate cyber threats. The results of these tests and assessments are used to establish priorities, allocate resources, and improve controls. We conduct mandatory information security awareness training for all new hires and employees at least annually as well as specialized training for certain functions