Company: CHD
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0000950170-25-019801
Chunk: 156

Company: CHURCH & DWIGHT CO INC /DE/
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 156
---
Cybersecurity Risk Management and Strategy

We collect, use and store personal information of our employees, consumers and other third parties in the ordinary course of business. In addition, we sell certain products directly to consumers online and through websites, mobile apps and connected devices, and we offer promotions, rebates, loyalty and other programs through which our data systems may receive personal information. We recognize the importance of data privacy and security and are committed to safeguarding and protecting our information and any other information entrusted to us. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information which is integrated with our overall risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan to respond to security breaches and cyberattacks. Our cybersecurity incident response plan is part of our overall Information Security Program, which is led by the Company’s Vice President, Global Chief Information Security Officer ("CISO") and overseen by the Company’s Executive Vice President, Global Chief Information Officer, and is designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, the Company, and the Company’s ability to operate. Our cybersecurity incident response plan includes controls and procedures for timely and accurate reporting of any material cybersecurity incident. We design and assess our program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).  

Our cybersecurity risk management program includes:

•risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our global enterprise IT environment;

•a security team responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to security breaches and cyberattacks;

•the use of external service providers, where appropriate, to assess, perform tabletop exercises or otherwise assist with aspects of our security controls and designed to anticipate cyberattacks and respond to breaches, including a biennial maturity assessment of our program by an external third-party;

•cybersecurity awareness training of our employees and contractors, incident response personnel, and senior management to help them better understand the issues and risks relative to cybersecurity, as well as data privacy (for our employees); 

•Periodically throughout the year, our IT department performs phishing and other exercises to both test our systems and reinforce training of our personnel;

•a cybersecurity incident response plan managed by our CISO that includes procedures for responding to cybersecurity incidents and is designed to protect and preserve the confidentiality, integrity