Company: SYY
Filing Date: 2025-08-22
Form Type: 10-K
Source: 0000096021-25-000099
Chunk: 115

Company: SYSCO CORP
Filing Date: 2025-08-22
Form: 10-K
Item: Item 1C
Chunk 115
---
 cybersecurity risk into the overall RRC process in this manner assists the company in identifying, assessing, and managing material cybersecurity risks.Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed regularly by internal and external cybersecurity experts. The multifaceted nature of our cybersecurity measures includes aspects of prevention, detection, and response capabilities, employee training programs, threat intelligence monitoring, and the implementation of an array of technologies. We have established processes to oversee and identify cybersecurity risks associated with the use of third-party service providers, which includes (i) the completion of due diligence before engaging with any third party, (ii) controls for response to mitigate any significant risks, and (iii) assessments and reviews during the course of the relationship. Additionally, we have ongoing partnerships with government and commercial cybersecurity experts to understand emerging cybersecurity threats.We seek to detect and investigate suspected attacks against our network, products, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools; however, we still remain potentially vulnerable to known or unknown threats. Our cyber incident response plan includes an escalation process if a cybersecurity incident meets specific rating criteria to trigger action designed to minimize potential disruptions and protect the integrity of our operations. The cyber incident response plan has been reviewed by external experts and is reviewed internally annually. We also conduct periodic cybersecurity tabletop exercises where we perform walkthroughs of cyber incident scenarios with senior management to test and enhance preparedness.During the year ended June 28, 2025, the company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably anticipated to materially affect the company, including its business strategy, results of operations, or financial condition. Nevertheless, the company recognizes cybersecurity threats are ongoing and evolving and has seen an increase in cyberattack volume, frequency and sophistication. We are committed to supporting the governance and oversight of cybersecurity risks and to implementing mechanisms, controls, technologies, and processes designed to help the company assess, identify, and manage these risks. For more information on the company's cybersecurity risks, refer to Item 1A, “Risk Factors.”

22