Company: PAYC
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0000950170-25-024136
Chunk: 68

Company: Paycom Software, Inc.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1B
Chunk 68
---
 threats. Our collaboration with these third parties includes independent audits, threat assessments, and consultation on security enhancements.Infrastructure; Network and Physical SecurityOur IT infrastructure is secured and monitored using a number of leading practices and tools across physical and logical security. This security is also continually monitored by our information security department. We strictly regulate and limit all access to servers and networks at each of our facilities. Local network access is restricted by domain authentication, using stringent access control lists. Remote network access is restricted by a defense-in-depth approach that includes redundant firewalls, preventing unauthorized access from external networks to systems within our local network. We also employ (i) network and endpoint intrusion detection, intrusion prevention, and data loss prevention sensors throughout our infrastructure, (ii) systems that monitor our infrastructure and alert our continuously staffed security operations center of potential cybersecurity issues, and (iii) a seasoned process for managing and installing patches for third-party applications.Incident ResponseWe maintain plans to address any cybersecurity incidents, including but not limited to a Crisis Management Plan, an Incident Response Plan, an Information Security Incident Management Policy and a Business Resiliency Policy. Information security continuity is embedded in our business continuity management system to minimize the risk that continuity operations could result in a compromise to our security standards. We conduct business continuity, crisis communications and disaster recovery exercises at least annually to test and modify the plan, as needed. The activities related to the business continuity management system are routinely reported to executive management as part of our IT security team’s ongoing metrics reporting. In addition, reports related to activities and outcomes are provided to the audit committee of the Board of Directors on a quarterly basis.

33

Certifications and AuditsWe maintain the following ISO certifications related to our information systems:•ISO 22301:2019 (standard for implementing and managing an effective business continuity management system);•ISO/IEC 27001:2013 (security standard for information security management systems, covering our production, quality assurance and implementation environments);•ISO/IEC 27701:2019 (standard for establishing, implementing, maintaining and continually improving a privacy information management system); and•ISO 9001:2015 (standard for the implementation of quality management processes).We voluntarily obtain third-party security examinations relating to our internal controls over financial reporting in accordance with SOC 1. Our SOC 1 examination is conducted every six months by one of the four largest independent international auditing firms, and addresses, among other areas, our physical and environmental safeguards for production data centers, data availability and integrity procedures,