Company: CRL
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001100682-25-000011
Chunk: 87

Company: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 87
---
Item 1C.   Cybersecurity 

Cybersecurity Risk Management and StrategyCharles River places high importance on identifying and mitigating potential cybersecurity threats to its employees, customers, IT infrastructure, proprietary technologies and confidential information. Our cybersecurity risk management is based on recognized industry governance frameworks, including the International Organization for Standardization (ISO), the National Institute of Standards and Technology (NIST), the Center for Internet Security Controls (CIS), and the Cloud Security Alliance (CSA). We use these frameworks together with information collected from internal and 3rd party assessments to develop policies such as our technology acceptable use policy for information assets, our access requirements for data, systems, or technologies, and policies for the protection and use of personal information of our employees and customers. We protect our IT assets through industry-standard techniques such as multifactor authentication, malware defenses, network and endpoint monitoring, and access review processes. We also work with our business units to leverage and implement foundational cybersecurity principles, such as security by design, defense-in-depth, least privilege, and resilience-focused backups, throughout our organization. We deliver cybersecurity awareness and confidential information protection training to our employees, and we send our employees ethical simulated phishing and spear-phishing emails to test their compliance with our policies.We engage third parties to conduct annual penetration testing, and we use external risk assessors to measure our program to industry standard frameworks. Our information security management system is certified to the ISO/IEC 27001:2013 and 27017:2018 standards by the British Standards Institution (BSI); certificates IS 780367 and CLOUD 806141,respectively. We also collaborate with experts and industry partners to exchange information about threats, best practices, and trends. Our cybersecurity risk management extends to risks associated with our use of third-party service and technology providers as well as partnerships with third parties we may enter into. For instance, we conduct risk and compliance assessments of third parties that request access to our IT resources and information or who provide technology products or services to Charles River.Our cybersecurity risk management is an important part of our comprehensive business continuity program and enterprise risk management. Our global information security team periodically engages with a cross-functional group of Charles River subject-matter experts and leaders to assess and refine Charles River’s cybersecurity risk posture and preparedness. For example, we regularly evaluate and update contingency strategies for our business in the event that a portion of our IT systems were to be unavailable due to a cybersecurity incident. We practice our response to potential cybersecurity incidents through regular tabletop exercises. We also perform