Company: CL
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0000021665-25-000008
Chunk: 93

Company: COLGATE PALMOLIVE CO
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 93
---
 information technology organization. He has led our information technology Operational Performance and Reliability Committee for the last nine years, which reviews and provides continuous improvement processes and technology across infrastructure, information security, architecture, application and end user performance. He has application development leadership experience across all functions, including the policies and controls that govern both application development and implementation of packaged software. He has a certification from Stanford University for Cybersecurity and Executive Strategy.The Company’s information security organization seeks to employ cybersecurity best practices, including implementing new technologies to proactively identify and monitor new vulnerabilities and reduce risk, conducting due diligence of third-party vendors’ information security programs, maintaining security policies and standards and regularly updating and testing our response planning and protocols. The information security organization also works in partnership with our Internal Audit function to identify cybersecurity risks and review cybersecurity-related internal controls with third parties as part of the overall internal controls process. The information security organization also gains valuable information to improve our threat and risk awareness capabilities as a member of an industry information sharing and analysis organization, which provides strategic and tactical information sharing channels. Additionally, employees are provided mandatory cybersecurity awareness training on an annual basis, which includes information about how to identify and report cybersecurity concerns and incidents. The information security organization also conducts phishing simulations and testing scenarios through tabletop exercises and assessment activities, to help ensure compliance with our cyber policies and procedures. We maintain a cybersecurity insurance policy and have retained relevant incident response services. Additionally, we maintain an offensive security team that 

21

works both independently and with third party cybersecurity professionals to conduct security assessments of our enterprise-wide cybersecurity practices, including penetration testing, and identify areas for continuous improvement within the information security program. The Company is a member of the Retail and Hospitality Information Sharing and Analysis Center, which provides additional intelligence associated with threats pertaining to our industry.We maintain a Data Security Incident Response Plan (the “Plan”), which outlines the processes and procedures that we should follow to respond to, remediate and resolve a security incident involving a potential or actual compromise of our proprietary information and/or personal information. It also describes the structure, roles and responsibilities of personnel involved in responding to such incidents and provides a process for alerting senior management of such incidents. The Plan is reviewed on an annual basis and revised as necessary. Our dedicated information security organization leverages various frameworks for managing cybersecurity risks, including the National Institute of Standards and Technology (“NIST”) framework. The key pillars of the NIST framework are to (i) develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data and capabilities; (