Company: CENX
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000949157-25-000024
Chunk: 56

Company: CENTURY ALUMINUM CO
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1C
Chunk 56
---
Item 1C. Cybersecurity

Risk Management and Strategy

Century recognizes the importance of developing, implementing, and maintaining appropriate cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Board is actively involved in oversight of Century’s risk management program, and cybersecurity represents an important component of Century’s overall approach to enterprise risk management (“ERM”). Century’s cybersecurity policies, standards, processes and practices are based on recognized security frameworks and applicable industry standards. In general, Century seeks to address cybersecurity risks through a comprehensive approach that is focused on preserving the confidentiality, security and availability of the information that Century generates, collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

23

As one of the critical elements of the Company’s overall ERM approach, the Company’s cybersecurity program is focused on the following key areas:•Governance: As discussed in more detail under the heading “Governance,” the Board’s oversight of cybersecurity risk management is supported by the Company’s Chief Information Officer, other members of Management and a dedicated Cybersecurity team.•Collaborative Approach: The Company has implemented a comprehensive approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.•Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company’s information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, logical access controls, and endpoint protection, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.•Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company’s response to a cybersecurity incident.•Third-Party Risk Management: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company’s systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.•Network Penetration Testing: The Company performs an internal and external network penetration test led by its Internal Audit team and addresses any findings in a timely manner.

Risks from Cybersecurity Threats

On February 16, 2022, we became aware of a cybersecurity intrusion that caused a network disruption and impacted certain of our systems. Upon detection, we took steps to