Company: ROK
Filing Date: 2025-11-12
Form Type: 10-K
Source: 0001024478-25-000116
Chunk: 29

Company: ROCKWELL AUTOMATION, INC
Filing Date: 2025-11-12
Form: 10-K
Item: Item 1C
Chunk 29
---
Item 1C. Cybersecurity

Risk Management and Strategy

The Company has a cybersecurity risk management program designed to assess, identify, manage, and govern risks from cybersecurity threats. Our cybersecurity risk management program is a key component of our overall enterprise risk management strategy. The Company’s cybersecurity risk management program focuses on risk and threat identification, protection, detection, response, and recovery, designed to protect the confidentiality, integrity, and availability of critical systems and data. The Company’s cybersecurity incident response and crisis management plans are components of the cybersecurity risk management program, focusing on effective response to cybersecurity incidents or attacks. We monitor our internal technology for cybersecurity threats, and we use various security capabilities to mitigate the risk of these threats. Additionally, the Company provides annual cybersecurity and information security awareness training for all employees and contractors. The Company maintains a robust, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company’s systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. 

Governance 

The Company’s cybersecurity program is led by the Chief Information Security Officer (CISO). Our CISO has more than 30 years of technology and cybersecurity leadership experience and is a Certified Information System Security Professional (CISSP), and a Certified Information Systems Auditor (CISA). The CISO reports to the Chief Information Officer (CIO). The CISO leads a team that is responsible for executing cybersecurity strategy, to support risk management, and protection of Company systems, products, and employee and customer information. As the foundation of the cybersecurity program, the Company maintains cybersecurity policies and procedures that are informed by recognized security frameworks and applicable regulations, laws, and standards. We use various frameworks, standards, guidelines, and best practices as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. The Company engages third parties to assess our cybersecurity posture and program maturity. 

We also consider cybersecurity, along with other top risks for the Company, within our ERM framework. The ERM framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends, and countermeasures for cybersecurity and other types of significant risks. During the year ended September 30, 2025, the Company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy