Company: UIS
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000746838-25-000008
Chunk: 65

Company: UNISYS CORP
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 65
---
 data privacy concerns, including a “Report Phish” button in the email application;•a vulnerability management program designed to protect our external and internal networks and critical assets;•bug bounty capability, enabling ethical hackers to simulate real-world attacks to identify and report vulnerabilities; •secure coding and development; and •security and operations framework and tools.We design and assess our cybersecurity policies, standards and practices following recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We have established written policies that are provided to all associates regarding identification, classification of severity and escalation of cybersecurity incidents and we provide annual and ongoing cybersecurity awareness training for our associates — including regular training on information security and data privacy policies. We also perform internal audits on our cybersecurity and data privacy practices.We regularly engage third-party cybersecurity experts to supplement our cybersecurity risk management efforts, including those we engage to conduct periodic cybersecurity risk assessments. During 2024, Unisys engaged an external security firm to 

25

conduct several cybersecurity tabletop exercises. Additionally, we worked with an audit firm and directed several audits related to cybersecurity.Unisys recognizes the importance of overseeing and identifying material risks from cybersecurity threats associated with our use of third-party service providers. We have a Third Party Risk Management (TPRM) program, which is integrated into our procurement process and involves cybersecurity risk oversight and identification components. Our TPRM program includes policies and standards requiring that we perform cybersecurity due diligence reviews on our vendors based on the risk profile of a particular supplier or service provider or the service they provide. We also monitor certain of our principal suppliers and service providers on an ongoing basis by using an outside-in, hacker perspective of a company’s cybersecurity posture through an external service provider.Whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect Unisys, including its business strategy, results of operations, or financial condition and if so, how.The information set forth under “Risk Factors” (Part I, Item 1A of this Form 10-K) — “We have been and could be vulnerable to disruption in our IT systems, cyber incidents, security breaches and loss of data (associate and client) that have occurred, and may continue to occur, and have resulted in and could continue to result in the incurrence of significant costs and harm to our business and reputation.” — on page 15 of this Annual Report on Form 10-K is hereby incorporated by reference. As of December