Company: OC
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0001370946-25-000077
Chunk: 37

Company: Owens Corning
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1
Chunk 37
---
 subject to Section 203 of the Delaware General Corporation Law, which generally prohibits a Delaware corporation from engaging in any of a broad range of business combinations with any “interested” stockholder for a period of three years following the date on which the stockholder became an “interested” stockholder and which may discourage, delay or prevent a change in control of our company.

Dividend payments on our common stock are not guaranteed and are declared at the discretion of our Board of Directors.

Since February 2014, our Board of Directors has declared a quarterly dividend on our common stock. The payment of any future cash dividends to our stockholders is not guaranteed and will depend on decisions that will be made by our Board of Directors and will depend on then-existing conditions, including our operating results, financial conditions, contractual restrictions, corporate law restrictions, capital agreements, applicable laws of the State of Delaware and business prospects.

18

Table of Contents

ITEM 1B.UNRESOLVED STAFF COMMENTS

None.

ITEM 1C.CYBERSECURITY

Risk Management and Strategy

We have a range of security measures that are designed to protect against the unauthorized access to and misappropriation of our information, corruption of data, intentional or unintentional disclosure of confidential information, or disruption of operations. These security measures include controls, security processes and monitoring of our manufacturing systems. We have cloud security and other tools and governance processes designed to assess, identify and manage material risks from cybersecurity threats. In addition, we maintain an information security training program designed to address phishing and email security, password security, data handling security, cloud security, operational technology security processes, and cybersecurity incident response and reporting processes.Our cybersecurity strategy includes defense in depth, zero trust, and standards-based controls intended to protect our information technology systems. We perform incident response tabletop exercises that include members of the Company’s senior management team to validate, test, and assess the effectiveness and adequacy of certain roles and decision-making processes in the event of a cybersecurity incident. We also assess, identify, and manage cybersecurity risk associated with divestiture and merger and acquisition activities.The oversight of our cybersecurity risk management process is integrated into our overall risk management process. The risk committee is responsible for overseeing and monitoring our risk assessment and mitigation-related actions, including with respect to cybersecurity risks. The risk committee is not a committee of our Board of Directors. It is a cross-functional committee that includes members across many areas of expertise and is structurally independent of our business lines. The risk committee’s membership is designed to provide diversity of thought