Company: VRT
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0001628280-25-005905
Chunk: 291

Company: Vertiv Holdings Co
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1C
Chunk 291
---
 outlines the roles and responsibilities for various personnel in the event of a cybersecurity incident, including but not limited to, the process to escalate risks to our Board, Audit Committee and our executive management, as necessary. Incidents with respect to third parties are managed internally using the same basic processes as managing internal cybersecurity incidents.Third-Party Risk Management: The Company’s comprehensive approach to cybersecurity and its associated risk management framework requires, when applicable, the engagement of certain third parties, which could include law enforcement, vendors, and other software or service providers. The Company leverages substantial technological tools and partners to augment and enable the efforts of its internal cybersecurity team. These third parties assist with various cybersecurity functions including monitoring, threat detection, vulnerability management, network segmentation, mobile device management, data protection, tabletop exercises, semi-annual penetration testing, multi-factor authentication, and threat intelligence.Education and Awareness: In consultation with our cybersecurity team, we mandate annual cybersecurity awareness training for Company personnel, and regularly conduct simulated phishing attacks as a means to equip them with effective tools to detect and address cybersecurity threats as well as to communicate our evolving cybersecurity policies, standards, processes, and practices in the context of its information systems.Impact of Cybersecurity Threats: To date, there have been no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or have been reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition.

Governance 

Board Oversight of Risks from Cybersecurity Threats: The Board is ultimately responsible for the oversight of risks from cybersecurity threats and collaborates with the Audit Committee of the Board and the ERC in these oversight responsibilities. The responsibilities of the ERC include participating and collaboration with the CROC to oversee policies and management systems for cybersecurity matters, overseeing the identification, assessment and response to cybersecurity risks, maintaining and implementing our IRP, and communicating on a regular interval, or more frequently (if necessary) with the Board, the Audit Committee and executive management in regard to such risks. The Company's processes call for prompt and timely notifications and updates to the Board and the Audit Committee, as applicable and as necessary depending on the nature and severity of the incident, in connection with any cybersecurity incidents that may occur. In addition, the Board, the Audit Committee, and the ERC receive regular presentations and reports on cybersecurity matters that address the full range of cybersecurity topics discussed herein. Further, on a periodic basis, the Board and/or Audit Committee and the ERC also discuss our cybersecurity programs and