Company: CNDT
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001677703-25-000029
Chunk: 54

Company: CONDUENT Inc
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 54
---
 of the Company’s cybersecurity risk management, including the Company’s material programs, policies and safeguards for information security, cybersecurity and data security. At least quarterly (and more frequently as required), the Risk Committee and Audit Committee meet with management, including the Chief Information Security Officer (the “CISO”), to discuss, assess and determine the allocation of resources to risk matters, including cybersecurity risks, which enables effective integration of risk practices into strategic planning and enterprise decision-making. The Risk Committee works with the CISO and the Company’s senior executives in reviewing the cybersecurity risks and strategy, provides guidance on the Company’s cybersecurity goals and objectives, and monitors the information it receives from management regarding the assessment and management of cybersecurity risk. The Risk Committee also conducts an annual review that includes a survey of enhancements to the Company’s defenses and a cyber trend report, as well as management’s progress in implementing the Company’s cybersecurity strategic roadmap and compliance initiatives.The Company’s CISO, a Certified Information Systems Professional with over 15 years of technical and cybersecurity leadership in large multinational organizations, reports to our Executive Vice President, Chief Information Officer and is responsible for assessing, implementing, and managing the Company’s cybersecurity risk management program, informing senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents, as well as supervising such efforts. The CISO approves the cybersecurity policies and procedures, implementation of controls, monitoring and detection programs and employee training on cybersecurity risks. The CISO also reports cybersecurity risks and strategies directly to executive leadership. In addition, the Company has implemented an Incident Response Materiality Assessment Committee (“IRMAC”), which consists of members from the Senior Leadership Team and is responsible for assessing the materiality of a cybersecurity incident referred to it by the Cybersecurity Incident Response Team (“CSIRT”). Procedures exist to 

CNDT 2024 Annual Report28

Table of Contents 

ensure the Risk Committee of the Board of Directors, and if appropriate, the full Board of Directors are notified about cybersecurity incidents being assessed by the IRMAC.As noted above, we face a number of cybersecurity risks in connection with our business and, from time to time, experience or are subject to a variety of cybersecurity incidents that arise during the ordinary course of our business. As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any known cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company. New information concerning any known cybersecurity incidents that have occurred prior to the date of this report, however, could change