Company: KODK
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0000950170-25-040256
Chunk: 57

Company: EASTMAN KODAK CO
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1B
Chunk 57
---
 business. Generally, when a breach or suspected breach is identified, the IT Security Team would escalate the issue to the Council for initial analysis and guidance. In the event of a serious IT incident, the crisis management team would be notified and the incident response team would typically be tasked with preparing an initial response. The incident response team, in consultation with others regarding impact and materiality, would be responsible for determining whether a particular incident (alone or in combination with other factors) triggers any reporting or notification responsibilities.•Regular Evaluation of Initiatives, Results and Priorities. The IT Security Team, in consultation with the Council and other members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments, and further developments in the cybersecurity threat landscape. In addition, we periodically engage a third-party provider to conduct an external assessment of our security program. The results of this assessment, which are reported to the Audit and Finance Committee (and the Board, as appropriate), assist us in determining whether any further changes to our existing policies and practices are warranted.We expect that our cybersecurity risk management processes and strategy will continue to evolve as the cybersecurity threat landscape evolves.We engage third-party providers to assist us with our cybersecurity risk management and strategy. Examples of services provided by these third-party providers include threat monitoring, incident response support, testing, mitigation strategies, updates on emerging trends and developments and policy guidance. Prior to exchanging any sensitive data or integrating with key third-party providers, we assess their security fitness against our risk posture and request changes as we deem necessary.  Security controls are imposed through comprehensive standard terms and conditions that include privacy and incident reporting requirements, and third parties are periodically re-evaluated for security risk.Since the beginning of the last fiscal year, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, “Risks Related to Kodak’s Business and Operations—Cyber-attacks or other data security incidents that disrupt Kodak’s operations or result in the breach or other compromise of proprietary of confidential information about our workforce, our customers, or other third parties could disrupt our business, harm our reputation, cause us to lose customers, and expose us to costly regulatory enforcement and litigation, any of which could lead to material adverse effects on Kodak’s results of operations