Company: DLX
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000027996-25-000051
Chunk: 50

Company: DELUXE CORP
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 50
---
ITEM 1C. CYBERSECURITY

We are a trusted partner for businesses of all sizes, and we take this responsibility seriously. Ensuring the secure and continuous operation of our networks and systems, as well as the processing, maintenance, and confidentiality of the sensitive information they contain, is vital to our business operations and strategy. We process records containing confidential data related to individuals and businesses. Additionally, some of our products are hosted solutions, and the volume of data we store for our customers, including personal, critical business, and other potentially sensitive information, has been growing. Technology-based organizations like ours are susceptible to targeted attacks that aim to exploit network and system vulnerabilities. A successful cyberattack could lead to the disclosure or misuse of sensitive business and personal information, disrupt our operations, damage our reputation, and deter clients and consumers from using our products and services. It could also result in litigation, the termination of client contracts, government inquiries, and/or enforcement actions. Any of these events would have a material negative impact on our business, prospects, results of operations, and financial position.We have established a risk-based information/cybersecurity program dedicated to safeguarding our data and solutions. Our privacy policies, along with associated controls and procedures, provide a comprehensive framework to guide the handling of data. We employ a defense-in-depth strategy, utilizing multiple security layers and the CIA (confidential, integrity, and availability) triad model. Our information security program is led by our Chief Information Security Officer (CISO) and the Information Security department, which sets the policies, standards, and strategies to manage security risk. The CISO has over two decades of experience with global technology organizations across various industries. We allocate significant resources to addressing security vulnerabilities by enhancing security and reliability features in our products and services, providing employee security training, monitoring our operations 24/7, reviewing and auditing our systems against independent security control frameworks, and conducting security maturity assessments. We may also engage third-party consultants, legal advisors, or audit firms to evaluate and test our risk management systems and assess and remediate potential cybersecurity incidents. These assessments inform our annual and multi-year cybersecurity strategies and our product security plans. In addition, our operations rely on several third parties, including vendors, developers, and partners, who are critical to our business and may have access to our confidential data regarding consumers, employees, contractors, suppliers, and other business partners. We conduct due diligence on these third parties regarding their security and business controls and have established monitoring procedures to mitigate risks related to data