Company: GHC
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000104889-25-000022
Chunk: 218

Company: Graham Holdings Co
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 218
---
Item 1C. Cybersecurity.

Cybersecurity Risk Management and Strategy.

The Company is a holding company and its business units are decentralized. Together with its business units, the Company maintains a risk-based information security program establishing administrative, technical, and physical safeguards that are designed for the size, scope and type of the Company’s businesses.The information security program is designed to protect the confidentiality, integrity, and availability of the Company’s information systems and data, and safeguard information systems and data in accordance with applicable local, state, federal or international laws, regulations, or standards.The Company’s information security program is risk-based; the Company and its business units perform business impact assessments and risk assessments on a regular basis to calibrate areas of focus. Cybersecurity risks are evaluated as a part of the broader risk management activities at the Company.The Company and its business units leverage several information security controls frameworks, standards and best practices with the International Organization for Standardizations (ISO) 27001 used as the overarching framework. ISO 27001 establishes a multi-pronged information security standard for organizations to manage information security risks, build cyber resilience, and improve operations.

41

Third-party service provider risk management is one of many components of the Company’s information security program. The Company and its business units use a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties that could adversely impact the Company. This approach may include, but is not limited to, reviewing and assessing providers’ cybersecurity maturity, conducting diligence on certain providers’ information security programs, and/or imposing contractual obligations on the provider depending on the type and quantity of data involved, the access provided to Company systems, the type of provider and the criticality of outsourced operations.The Company maintains an incident response plan that is distributed to its business units for customization according to their specific operations and internal reporting structures. The Company leverages third-party cybersecurity experts to review the response plan and facilitate incident response exercises for its business units. The Company licenses third-party software that provides incident response simulation capabilities and playbooks and makes that available to its business units and also retains a third-party cybersecurity firm to provide assistance if needed during a cybersecurity incident.The Company and its business units engage third parties to assess various aspects of the information security program, provide threat intelligence, perform external audits, perform penetration testing, and provide other services as needed.The Company and its business units have not been materially affected by risks from cybersecurity threats. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect the Company, see Item