Company: PRGO
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001585364-25-000014
Chunk: 402

Company: PERRIGO Co plc
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 402
---
Perrigo Company plc - Item 1CCybersecurity

ITEM 1C.    CYBERSECURITY 

RISK MANAGEMENT AND STRATEGY 

Cybersecurity is an important part of our risk management program and an area of increasing focus for our Board of Directors and management. We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats. While management is responsible for the day to day risk management, the Board of Directors, is responsible for the Company's overall risk oversight function, including cybersecurity risks. The Nominating & Governance Committee ("NGC") supports the Board of Directors by overseeing cybersecurity risks, policies and objectives. The Audit Committee supports the Board of Directors in overseeing the framework for risk assessments and enterprise risk management ("ERM") process. The Company’s cybersecurity policies, standards and processes are designed and implemented in light of the requirements of the National Institute of Standards and Technology ("NIST") frameworks for cybersecurity and privacy.Recognizing that no single technology, process or business control can effectively prevent or mitigate all risks, we employ multiple technologies, processes and controls, all working as part of a cohesive strategy to minimize risk including the following:•We emphasize security and resiliency through business assurance capabilities and incident response plans designed to identify, evaluate, and remediate incidents when they occur. We regularly review and update our plans, policies and technologies and conduct regular training exercises and crisis management preparedness activities to test their effectiveness.•Perrigo leverages the NIST cybersecurity framework to measure the capability of its cybersecurity program and we conduct third party assessments to measure the NIST ratings. •We maintain a cybersecurity risk register which is reviewed periodically with relevant stakeholders. Risks that are higher in impact are included within our Enterprise Risk Register which is reviewed with Executive Leadership and the Board of Directors. •Our processes used to identify, assess, protect, detect, respond to and recover from cybersecurity threats is regularly tested by external parties through penetration testing, and other exercises designed to assess and test our cybersecurity health, resiliency and the effectiveness of our program. •Management invests in organization capability and technology to manage and identify cybersecurity and information security risks. Our Company has information security employees across the globe, enabling us to monitor and promptly respond to threats and incidents, identify and maintain oversight of cybersecurity risks associated with third parties, evaluate and deploy cybersecurity technologies, and educate associates on cybersecurity risks. •We maintain cyber insurance coverage to help mitigate possible costs associated with a potential incident. •We have implemented an information