Company: TTMI
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000950170-25-024839
Chunk: 85

Company: TTM TECHNOLOGIES INC
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1B
Chunk 85
---
 regulations governing the handling of personally identifiable information, corporate financial data, controlled unclassified information, or any other data owned or collected by the company.Our cybersecurity incident management plan includes the following, among other things:•The SVP-IT leads the team in the development, documentation, review and testing of security procedures, and incident response procedures. Beyond initial creation, procedures are continually re-assessed, augmented, updated, and tested on an ongoing basis;•The SVP-IT works with the Executive Team on the identification, assessment, verification, and classification of incidents to determine affected stakeholders and appropriate parties for contact;•The SVP-IT is responsible for launching the Cybersecurity Incident Response Team (CIRT) if necessary, and for notification to the Chief Executive Officer, who in turn will contact the Board of Directors and Government Security Committee in order to validate the response is being addressed appropriately.•The CIRT team, in consultation with outside experts if needed, is responsible for the following:oInitial containment;oAnalysis to establish root cause of incidents, identification and evidence collection;oIncident containment by further analyzing additional information and further identifying any additional compromised machines or resources not previously identified;oImplementing solutions designed to solve underlying problems and prevent re-occurrence;oRecovery and restoring normal business functionality;oReview after closure of each incident and conducting a post-mortem analysis to improve prevention and help to make incident response processes more efficient and effective. Also, the CIRT evaluates competency and any additional training requirements needed.While we have experienced cybersecurity incidents in the past, to date none have materially affected us or our business strategy, results of operations, financial condition and/or cash flows. Moreover, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, financial condition and/or cash flows. See Item 1A, Risk Factors above for more information. While we continually work to safeguard the information systems we use, and the proprietary, confidential, and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks, and data or those of our third-party providers.

35

GovernanceWe have invested in robust data security and privacy protections. We follow industry-standard recommendations for data security such as those outlined in the National Institute of Standards and Technology (NIST) Special Publication 800-171 and evolving Cybersecurity Maturity Model Certification (CMMC) frameworks. We have developed cybersecurity policies and