Company: OC
Filing Date: 2025-03-14
Form Type: DEF 14A
Source: 0001370946-25-000125
Chunk: 17

Company: Owens Corning
Filing Date: 2025-03-14
Form: DEF 14A
Chunk 17
---
 for the notification, escalation and communication of significant cybersecurity events to a crisis management team and appropriate levels of management, including

16

T a b l e o f C o n t e n t s

our CIO, as well as to the Audit Committee. Management also provides the Audit Committee with a cybersecurity dashboard, which the full Board can access as well. Additionally, the Audit Committee regularly provides updates to the Board on the status of the Company’s cybersecurity risk management process.

#### RISK MANAGEMENT PROCESS
The Company’s enterprise risk management process is designed to identify, assess and prioritize the Company’s risk exposures across various time frames, from the short-term to the long-term. The Company’s risk oversight processes and disclosure controls and procedures are designed to appropriately escalate key risks to the Board as well as to analyze potential risks for disclosure. The Company has a management risk committee (the “Risk Committee”) that is responsible for overseeing and monitoring the Company’s risk assessment and mitigation-related actions. The Risk Committee is not a Board committee; instead, it is a cross-functional committee that includes members across many areas of expertise, including corporate audit, finance, legal, information technology, treasury, and business functions. This internal group identifies risks and mitigation strategies, and it provides key updates to executive officers and the Audit Committee.

We currently have an enterprise risk register and sub-registers for each of our four businesses, as well as compliance and finance. The Risk Committee uses these individual risk registers to create an enterprise risk register, which enables business units and the Risk Committee to facilitate strategic and operational planning processes while mitigating sustainability and other risks. Risks are prioritized primarily based on their potential financial impact and the probability of occurrence. The enterprise risk register is reviewed quarterly by executive management and the Audit Committee.

### OVERSIGHT OF STRATEGY
The Board oversees the Company’s strategy. The Board performs an annual review of the strategic plans for each reportable segment and for the Company as a whole. Furthermore, in evaluating major investments or other significant decisions, the Board generally considers the Company’s long-term strategic plans and the potential impact on long-term stockholder value.

### OVERSIGHT OF SUSTAINABILITY
Oversight, guidance, and direction on sustainability topics — including our 2030 sustainability goals — are provided by the Board, who oversee management’s execution of our sustainability strategy. Our Directors’ Code of Conduct and Corporate Governance Guidelines provide that directors are expected to provide oversight, guidance and direction on sustainability issues and opportunities that have potential impact on the reputation and