Company: SSUP
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0000950170-25-034599
Chunk: 121

Company: SUPERIOR INDUSTRIES INTERNATIONAL INC
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1C
Chunk 121
---
 prevention is a top focus in our risk-based cyber-resiliency strategy. In addition to BEC, potential vulnerabilities could exist in business systems and associated infrastructure and are mitigated via protocol for managing update “patches”; this protocol is sometimes limited based on the era of legacy systems.

Superior engages cybersecurity partners and consultants to help strengthen its cyber-resiliency program. These engagements include but are not limited to incident response (“IR”) planning and IR retainers, penetration testing, vulnerability assessments, IR plan testing, and advisement and awareness of latest threat vectors. 

All of the Company’s global suppliers must comply with its Supplier Code of Conduct (“SCOC”). The SCOC contains certain data security and notification requirements, and the Company explicitly maintains the right to monitor and audit compliance with the SCOC.

Cybersecurity GovernanceThe Board of Directors maintains overall oversight of cybersecurity risk, and the Audit Committee provides direct oversight of the Company’s activities to prevent, detect and respond to cybersecurity threats. The Chief Information Officer (“CIO”) and a designated system security engineer are the primary responsible management parties to monitor, assess, and manage cybersecurity risk. Our CIO has led global IT organizations for over ten years with direct oversight responsibility for cybersecurity, the global IT landscape and its data integrity. Our security engineer is solely focused on monitoring, assessing, and managing Superior’s cybersecurity breach prevention, detection and management, including the ongoing cybersecurity risk education of our employee base. Our security engineer’s experience includes the design and implementation of IT security systems, tools, and processes, comprehensive security assessments, and the implementation of remediating action plans for detected weaknesses. Risk is monitored and managed through a combination of vulnerability assessments, continuous monitoring, endpoint protection, incident response planning, security awareness training, regulatory compliance monitoring, and threat intelligence. Utilizing the NIST cybersecurity framework, the CIO provides quarterly updates to the Audit Committee on cybersecurity risk management, including the Company’s latest risk assessment, action plan status and metrics. The Audit Committee regularly briefs the full Board on these matters. In addition, the CIO provides an annual report to the Board on the Company’s cybersecurity plan and key activities. Management roles and responsibilities of Superior’s cybersecurity incident management are defined within the Company’s IR plan. The plan includes the formation of the Security Incident Response Team responsible for leading incident response. In the event of