Company: CPS
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0001320461-25-000033
Chunk: 34

Company: Cooper-Standard Holdings Inc.
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 34
---
Item 1C.    CybersecurityRisk Management and StrategyOne of our top priorities is protecting Cooper Standard’s digital assets, and we increasingly rely on data and digital transactions to operate efficiently and effectively. We take action to prevent potential impacts related to system outages, data breaches, cyber-attacks and other threats to avoid disruption to our daily operations. Cooper Standard prioritizes increasing efficiency and efficacy as we design and refresh prescriptive incident response procedures to minimize impacts of potential cyber-attacks or outages. From time to time, the Company engages in table-top exercises, which involve cross-functional business leaders. Our information technology (“IT”) professionals focus on improving existing controls as outlined by ISO/IEC 27001:2022 (an internationally recognized information security framework), which is the foundation of our cybersecurity program. In recent years, we have made advancements in this space by conducting a risk assessment carried out by an independent third-party and continued engagement with cyber advisory services as described further below.We annually contract with a well-known third-party to conduct a comprehensive, enterprise-wide risk assessment. In addition to other mandates, this assessment evaluates Cooper Standard’s cybersecurity program from a risk perspective and assesses our IT controls for alignment with the ISO/IEC 27001:2022 information security framework. Based on the assessment 

21

results, we refresh the roadmap for our cybersecurity program, focusing on the highest-risk vulnerabilities first and monitoring for significant changes and emerging risks, continuously adjusting the roadmap as needed.Our cybersecurity program is built on a collection of fundamental security controls, focused on the overall protection of company and stakeholder data. Company leadership has defined the following objectives for information security:•Governance: Establish proper governance for the cybersecurity program.•Security Operations & Data Protection: Create a secure digital operating environment (apps, networks, systems, etc.) designed to protect critical data and to prevent business disruption.•Response and Recovery: Develop and practice incident response, business continuity and disaster recovery processes to minimize the impact of a major incident.•Compliance & Effectiveness: Meet all compliance requirements and develop program metrics to ensure effectiveness.To achieve these objectives, we emphasize fundamental security measures, such as access controls, cyber hygiene (e.g., patching and malware protection) and employee awareness training.Third-party risk management is an important focus of the Cooper Standard cybersecurity program. Cybersecurity is evaluated and considered throughout the lifecycle (onboarding, ongoing operations, offboarding) of third-party relationships as we conduct business with them. We review the security posture of each third-party prior to initiation of