Company: ALIT
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001809104-25-000062
Chunk: 60

Company: Alight, Inc. / Delaware
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 60
---
 industry as a whole and may qualify or change their credit ratings for us based on their overall view of our industry, global economic conditions or other geopolitical factors. Failure to maintain credit ratings that provide access to debt markets at reasonable interest rates could increase our cost of borrowing, reduce our ability to obtain intra-day borrowing, which we may need to operate our business, and adversely impact our business, including our competitive position, results of operations, cash flows and financial condition.

Item 1B. Unresolved Staff Comments. 

Not applicable. 

Item 1C. Cybersecurity. 

Alight recognizes the importance of developing, implementing and maintaining robust cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity and availability of the data in our care. The Company utilizes a cross-functional group of colleagues representing various stakeholders including technology, security, finance, internal audit, legal and others to identify and manage risks across the organization, including risks relating to cybersecurity. The Company’s cybersecurity program is focused on continuous improvement and takes a layered approach to cybersecurity to include prevention, detection, and response-based controls. Our preventative measures include network-based controls, malware defenses, email security, encryption for data in motion and at rest, continuous vulnerability testing and mitigation, and multi-factor authentication. Our detection and response measures include comprehensive logging and continuous monitoring utilizing both in-house and Managed Security Services, forensics capability, and an enterprise crisis management function. Alight employees are assigned data privacy and security training upon on-boarding and annually thereafter. The training is designed in collaboration with a third-party service provider and is designed to raise awareness of security practices and to educate employees on how to protect information and infrastructure.To support the overall cybersecurity program, Alight maintains an incident management team that tracks and logs privacy and security incidents across Alight, our vendors, and partners to better manage remediation and resolution of any such incidents. Significant incidents are promptly reviewed by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is escalated for further review, and then reported to designated members of our executive leadership team where needed. We consult with outside counsel and forensics firms as appropriate, including on materiality analysis and disclosure matters, and members of our executive leadership team make the final materiality determinations and, if appropriate, disclosure to law enforcement, regulators or clients. Our executive leadership team apprises Alight’s Board of Directors and our independent public accounting firm of significant matters and any relevant developments.

Our cybersecurity frameworks are informed by third-party