Company: KHC
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001637459-25-000011
Chunk: 78

Company: Kraft Heinz Co
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 78
---
 the Enterprise Risk Management Committee, and the Audit Committee regarding our cybersecurity risk priorities and progress, and solicits support from senior and executive leaders to further reduce risks through resources, prioritization, or other means. The CISO receives reports on cybersecurity threats from our Security Operations Center, external threat intel, trusted third-party security suppliers, and a peer network of CISOs at other global companies on an ongoing basis. Our Security Operations Center verifies and validates the threat information and modifies our detection and preventative controls as appropriate. Our CISO works closely with our Chief Global Ethics and Compliance Officer and Global General Counsel and Corporate Affairs Officer to oversee compliance with legal, regulatory, 

22

and contractual security requirements. The CISO’s team evaluates third-party service providers to a degree commensurate with the risk their services pose to us. As part of that program, we also provide feedback to service providers about risks they can reduce using commercially available safeguards. Additionally, the information security team works in partnership with the Company’s internal audit team to review information technology-related internal controls as part of our overall internal controls process.The Audit Committee is responsible for oversight of the Company’s information technology and cybersecurity risks. To fulfill its oversight responsibilities, the Audit Committee reviews the measures implemented by the Company to identify and mitigate cybersecurity risks and the Audit Committee receives updates from our Global Chief Information Officer and CISO at least twice a year, which cover topics related to information security, privacy, and cybersecurity risks, and the risk management processes, including the status of significant cybersecurity incidences, the emerging threat landscape, and the status of projects to strengthen the Company’s information security posture. The Audit Committee regularly reports to the Board on information technology, cybersecurity, and privacy matters. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Audit Committee or Board, with ongoing updates regarding any such incident until it has been addressed.We also rely on information technology, third-party service providers, and strategic joint venture partners to support our business and operations, including our secure processing of personal, confidential, financial, sensitive, proprietary, and other types of information, and to enable our service offerings. Despite ongoing efforts to improve our and third parties’ ability to protect against cybersecurity threats, we may not be able to protect all information systems, products, and service technologies. While we have not experienced any material cybersecurity threats or incidents as of the date of this Annual Report on Form 10-K, there can be no guarantee that we will not be the subject of