Company: PRSU
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0000950170-25-040127
Chunk: 22

Company: Pursuit Attractions & Hospitality, Inc.
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1B
Chunk 22
---
None.

Item 1C. CYBERSECURITYCybersecurity Risk Management and StrategyWe maintain a team, tools, policies, and processes for identifying, assessing, and managing material risks from cybersecurity threats. Threats like malware attacks, system vulnerabilities, and data breaches are actively identified, monitored, evaluated, and mitigated along with other Company risks. Our security team maintains centralized documentation regarding known security risks and mitigation. Consideration of material risks from cyber threats is integrated into our enterprise risk management processes and is a standing agenda item for discussion at our Audit Committee meetings. An Information Security Executive Committee representing multiple areas of the Company is responsible for assessing material risks from cybersecurity threats and represents multiple functions of the business 

13

including Finance, Human Resources, Legal, and the Information Technology (“IT”) departments. We have certain employee cybersecurity awareness campaigns and training designed to help promote a culture of cybersecurity awareness throughout the organization. Cybersecurity tools, processes, policies, and controls are periodically reviewed and updated in response to changes in the business environment and evolving threats, as well as to align with broader risk management objectives.Our information security function, led by our Chief Information Officer (“CIO”), implements and maintains the processes and controls to help identify, assess, and manage material risks from cybersecurity threats. These controls include, but are not limited to, the following Center for Internet Security (“CIS”) controls:•Account Management;•Access Control Management;•Continuous Vulnerability Management;•Network Infrastructure Management;•Incident Response Management;•Security Awareness and Skills Training; and•Data Protection - Encrypt Data on End-User Devices.Supporting these controls are specific security measures that include threat intelligence monitoring, vulnerability scanning, and policy enforcement.We use third-party service providers to assist us in identifying, assessing, and managing material risks from cybersecurity threats, including professional service firms, legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, and forensic investigators. We have a Cybersecurity Incident Response Plan (“IRP”) that includes procedures for responding to and, to the extent applicable, disclosing material cybersecurity incidents in a timely manner. We have third-party risk management processes designed to assess risks from key vendors and suppliers, including application providers and hosting companies. Key software service providers utilized by the Company undergo a review process for security, reliability, and effectiveness. We have processes in place to address access to our network by such third parties, to the extent applicable, including network access controls designed to provide access on a ‘least privilege’ basis. For a discussion of risks from cybersecurity threats