Company: SSUP
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0000950170-25-034599
Chunk: 41

Company: SUPERIOR INDUSTRIES INTERNATIONAL INC
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1B
Chunk 41
---
None. 

ITEM 1C. - CYBERSECURITYCybersecurity Risk Strategy and Management  Our cybersecurity strategy is focused on cyber-resilience, the ability to anticipate, withstand, recover from and adapt to adverse conditions, stresses, attacks or compromises on systems that use or are enabled by cyber resources. Continuous improvement actions are designed to drive to a zero-trust architecture and a cyber-resilient enterprise. While this cyber-resilience strategy is in place, our systems, and those of our customers, suppliers and other service providers, are subject to cybersecurity incidents. A system disruption could result in business disruption, theft of our intellectual property, trade secrets or customer information and unauthorized access to personnel information. The Company maintains safeguards, including training, incident response reviews, cybersecurity insurance and business continuity mechanisms to protect the Company’s assets. The Company also leverages a third-party cybersecurity program with the goal of minimizing disruption to the business and production operations, strengthening supply chain resilience in response to cyber-related events. To the extent that our business is interrupted, or data is lost, destroyed or inappropriately used or disclosed, such disruptions could significantly and adversely affect our competitive position, relationships with our customers and other stakeholders, financial condition, operating results and cash flows. In addition, we may be required to incur significant costs to protect against these disruptions or security breaches in the future.  Superior employs a risk-based vulnerability management process for assessing and managing cybersecurity risk. Utilizing the National Institute of Standards and Technology (“NIST”) cybersecurity framework, the IT team assesses the risk based on the Center for Internet Security Critical Security Controls. The assessment includes the ability to identify, protect, detect, respond and recover from cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. The risk-based vulnerability management prioritizes action under both an asset context and vulnerability context, considering factors such as asset exposure, potential business effect, threat context, and vulnerability severity. Business email compromise (“BEC”) continues to be a top threat for cybersecurity risk leading to potential financial loss, data breach or further information systems compromise. Variants and combinations of BEC, including phishing, spear phishing, “adversary in the middle” attacks (i.e., attacks that allow interception of network communications) and, in particular, “zero-day” attacks (i.e., attacks that exploit a previously unknown vulnerability), present a financial, data loss and business continuity risk. The risk of these attacks exists within the Company, within our customer partners and