Company: ST
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001477294-25-000022
Chunk: 67

Company: Sensata Technologies Holding plc
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 67
---
 frequent touch points for all employees to empower them to act responsibly and keep cybersecurity top of mind. We use monthly activities to keep employees engaged with cybersecurity, including newsletters, articles on the Sensata intranet, and mock phishing campaigns. We regularly update our comprehensive training program, which covers a wide variety of topics, from protecting work machines and personal information to social innovation and how employees can protect their digital lives at home.

28

Table of Contents 

•Supplier Engagement: We require our suppliers to comply with our standard information security terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us, and require them to complete information security questionnaires to review and assess any potential cyber-related risks depending on the nature of the services being provided.•Risk Assessment: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, our risk register, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee, and members of management.•Technical Safeguards: We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence, and incident response experience.

Governance

Our Board of Directors, in coordination with each of our Board Committees, is responsible for oversight of our enterprise risk management activities. The Nominating and Governance committee receives an update on the Company’s risk management process quarterly, including interaction of cybersecurity with our overall risks. The Board of Directors oversees risks from cybersecurity threats through report out from the Audit Committee, which monitors cybersecurity incidents and management's response to such incidents. Our Audit Committee directly oversees our cybersecurity program. Quarterly reports are delivered to the Audit Committee by the Chief Information & Digital Officer ("CIDO") and/or the Director of Cybersecurity at least four times per year. These reports include information about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. These reports also include updates on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.

Our CIDO has served in various roles in IT and information security for more than