Company: EME
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000105634-25-000015
Chunk: 54

Company: EMCOR Group, Inc.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 54
---
 technologies to enhance security and compliance.We have also implemented cybersecurity training. For example, key information technology and security personnel meet biweekly for training, updates on new cybersecurity threats, and implementation of new policies and all employees are required to undergo annual cybersecurity training, including email and password safety and phishing detection.

19

Table of Contents

We engage third-party cybersecurity firms to support our in-house cybersecurity initiatives and provide additional expertise with respect to our cybersecurity programs. Such firms are overseen by our General Counsel and Chief Information Security Officer and provide the following services:•On an annual basis, conduct penetration testing to evaluate the susceptibility of our information systems to cybersecurity threats and the effectiveness of our cybersecurity program;•On a biennial basis, conduct a comprehensive “tabletop” exercise to evaluate our incident response policies and procedures and provide relevant experience for our employees tasked with executing such response; and•On a biennial basis, conduct a cybersecurity assessment based on the National Institute of Standards and Technology’s Cybersecurity Framework. We have also established a process to evaluate third-party vendors and suppliers for cybersecurity risk and compliance with our security standards. As applicable, on an annual basis we review System and Organization Controls (SOC) 1 reports for all significant third-party vendors.In addition to the efforts discussed above, we have developed and maintain an Incident Response Plan to establish a process for addressing cybersecurity incidents. The Incident Response Plan includes incident response teams in place at the corporate and operating company levels to respond to a potential cybersecurity incident, processes for internal and external reporting, and other procedures to facilitate response and coordination.

As of the date of this report, we have not experienced a cybersecurity incident that resulted in, or is reasonably likely to result in, a material effect on our business strategy, results of operations, or financial condition. Like other companies, we are the target of cyberattacks. In 2020, for example, we publicly announced that we were the target of a systems intrusion in which a third party infected certain of the Company’s systems with malware. Although we were able to resolve that matter without material impact, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see Item 1A. Risk Factors, including the risk factor titled “We are increasingly dependent on sophisticated information technology systems; our business and results of operations are subject to adverse impacts due to the disruption, failure, or breaches of these systems.”