Company: APTV
Filing Date: 2025-02-07
Form Type: 10-K
Source: 0001521332-25-000010
Chunk: 62

Company: Aptiv PLC
Filing Date: 2025-02-07
Form: 10-K
Item: Item 1C
Chunk 62
---
 through an internal third-party risk management process, which involves analyzing third parties for cybersecurity risk at onboarding and throughout the duration of their relationship with the Company. For third-parties with a high cyber risk, we also utilize external firms to monitor such third-parties for threats and to provide remediation support as needed.

Product Cybersecurity

The Company’s Product Cybersecurity team, led by the Chief Technology Officer (the “CTO”), is responsible for assessing and managing the Company’s cybersecurity risk as it relates to Aptiv’s product portfolio. Risks are identified through threat intelligence, security testing, including penetration testing, audits and other processes defined by the Company’s product cybersecurity GRC program. The processes by which the Product Cybersecurity team manages automotive product security risks have been audited, assessed and certified as compliant with various applicable international regulatory standards by independent third-party auditors.

Governance

Enterprise Cybersecurity

The Company’s Enterprise Cybersecurity Security Operation’s Center (“SOC”), which is supervised by the CIO, is responsible for identifying, assessing and managing the Company’s risks from cybersecurity threats, as well as for responding to cybersecurity incidents. The SOC management team carries a diverse array of applicable cybersecurity and information technology credentials and generally has over twenty years of experience in cybersecurity. When an infrastructure cybersecurity incident occurs, the SOC initiates communications to the appropriate groups within the Company, which may include various members of the Company’s management, including the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer and Chief Operating Officer.

Depending on the severity and the nature of the incident, an investigation and impact mitigation protocols may be triggered. External experts or agencies may also be engaged in accordance with the Company’s policies and procedures. Upon conclusion of the active investigation of an incident, the SOC is required to identify the cause of the incident, formally report to Company leadership, and initiate changes to protect against a recurrence of the incident, among other procedures.

Table top exercises are also held annually and are designed to practice and validate existing incident response plans, as well as to identify the plans’ respective strengths and weaknesses. These exercises test the response capabilities of both technical and executive level resources, including key vice presidents, senior company leaders and cross-functional capabilities, such as with the Product Cybersecurity team as well as with the Legal, Privacy and Sales teams.

Product Cybersecurity

The Product Security Incident Response Team (the “PSIRT”), which is supervised by the CTO, is responsible for responding to product related cybersecurity incidents, which at times involve collaborating with the Enterprise Cybersecurity SOC. The