Company: AVNT
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0001122976-25-000008
Chunk: 10

Company: AVIENT CORP
Filing Date: 2025-02-18
Form: 10-K
Item: Item 7
Chunk 10
---
Management’s Discussion and Analysis of Financial Condition and Results of Operations

.”

ITEM 1B. UNRESOLVED STAFF COMMENTS

None.

ITEM 1C. CYBERSECURITY

Risk Management and Strategy

We have a global cybersecurity program designed to identify, protect, detect, respond to and recover from cybersecurity risks and threats.

Cybersecurity education is a priority for our employees and business partners. Employees complete cybersecurity training to help identify and respond to potential cybersecurity risks and reinforce safe behaviors. We also impose security requirements upon our third-party services and software providers, including: maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident; however, we rely on such third parties to implement security programs commensurate with their risk, and their efforts may not be successful.

We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past and we could in the future experience similar attacks. To date, no cybersecurity incident or attack, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition.

Governance

TheChief Information Security Officer (CISO), who reports to the Chief Information Officer (CIO), is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems.

The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO and cybersecurity teams hold relevant certifications, including, but not limited to, Security+ Certification, Factor Analysis for Information Risk Analyst, Certified Information Systems Auditor, Security Systems Certified Practitioner or Certified Federal Information Security Management Act Compliance Practitioner.

The Board oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Audit Committee of the Boardhas been delegated specific risk oversight responsibilities related to cybersecurity and data protection. The Audit Committee receives regular updates from the CIO or CISO regarding the Company's material risks from cybersecurity threats, cybersecurity defense and detection capabilities, incident response plans and employee training activities.

12 AVIENT CORPORATION

Further, Avient has a Cyber and Data Incident Response Team (CDIRT), which is a cross-functional group established to provide a quick, effective and orderly response to cyber and data related events. The CDIRT's mission is