Company: CCO
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0001334978-25-000008
Chunk: 63

Company: Clear Channel Outdoor Holdings, Inc.
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1C
Chunk 63
---
ITEM 1C.  CYBERSECURITY

Risk Management and Strategy

The Company maintains a robust cybersecurity program that promotes confidentiality, integrity and availability of our corporate and customer resources throughout the life cycle of our out-of-home service offerings. Under the oversight of the Audit Committee of our Board of Directors, as more fully explained below, and with the support of the Company’s compliance function and the Company’s internal and external audit functions, the Company operates an enterprise-wide risk management governance framework that sets standards and provides guidance for the identification, assessment, monitoring and control of the most significant risks facing the Company, including cybersecurity. Our enterprise risk management process is guided by the COSO Enterprise Risk Management Framework, which incorporates the three lines of defense model. In addition, we leverage our global Compliance department, legal teams, cybersecurity teams and privacy teams as key components of our overall cybersecurity program.Our cybersecurity program includes comprehensive technology and risk oversight programs designed to ensure that our technology systems and cybersecurity education programs are effective and that we are prepared to report and manage information security risks. Developed using collaboration and transparency principles, we maintain a suite of information and cybersecurity policies, standards and guides based on commonly adopted cybersecurity standards, frameworks and regulatory requirements, including publications from the National Institute of Standards and Technology and the Center for Information Security. Furthermore, we perform periodic evaluations of our security programs, information technology infrastructure and information security management systems through internal self-assessments and external independent consultations. In addition, we conduct regular security monitoring for internal and external threats to the confidentiality and integrity of our information assets, and our cybersecurity programs undergo periodic testing with the purpose of achieving swift and orderly restoration of business operations in the event of a cybersecurity incident. Cyber hygiene is integrated into our culture from employee onboarding and lasts throughout the employee life cycle, using various tools, such as frequent information security awareness messages and annual cybersecurity awareness training. As part of testing our programs, we regularly conduct internal simulated phishing campaigns. The Company also maintains comprehensive cyber insurance. However, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.Communication of our cybersecurity values and expectations is extended to our third-party solutions through specific programs, which include monitoring and rating services and open-source intelligence risk assessments. In addition to conducting posture and intelligence reviews of our vendors, our cybersecurity teams conduct evaluations of critical vendors to assess security requirements, and we assess our service level agreements to monitor whether cyber controls and practices are integrated to the levels specified in our cybersecurity standards.We