Company: APTV
Filing Date: 2025-02-07
Form Type: 10-K
Source: 0001521332-25-000010
Chunk: 61

Company: Aptiv PLC
Filing Date: 2025-02-07
Form: 10-K
Item: Item 1C
Chunk 61
---
ITEM 1C. CYBERSECURITY

Aptiv has a risk-based cybersecurity program, dedicated to protecting our data, products and information technology systems as well as data belonging to our customers, suppliers and employees. Our ability to keep our business operating effectively depends on the functional and efficient operation of information technology capabilities, both internally and externally. Our capabilities, as well as those of our customers, suppliers, partners and service providers, are crucial to our operations and may contain confidential personal information, sensitive business-related information or intellectual property. These capabilities are also susceptible to interruptions (including those caused by systems failures, cyber-attacks and other natural or man-made incidents or disasters), which may be prolonged or go undetected.

Risk Management and Strategy

Our cross-functional cybersecurity teams are responsible for addressing both enterprise and product cybersecurity risks. These teams, which are comprised of experts both within the organization and externally, utilize a defensive cybersecurity strategy with multiple layers of cybersecurity controls to protect our data (and data of others in our possession), systems and products.

Enterprise and product cybersecurity are incorporated into the Company’s overall risk management process. On a monthly basis, the Company’s cross-functional Enterprise Risk Management Committee meets to discuss short-term and long-term enterprise-wide risks and necessary action plans to mitigate those risks. The Chief Information Security Officer (the “CISO”) regularly presents to the Company’s Enterprise Risk Management Committee on key cybersecurity risks, threats and developments, as well as the Company’s strategies to mitigate those risks.

Enterprise Cybersecurity

The Company’s Enterprise Cybersecurity team, led by the Chief Information Officer (“CIO”), is responsible for identifying, assessing the severity of, managing and remediating cybersecurity risks to the Company’s information technology infrastructure. Risks are identified through vulnerability hunting, infrastructure penetration testing, threat intelligence activities and other processes defined by the infrastructure Governance, Risk and Compliance (“GRC”) assessment program utilized by the Company. Furthermore, this team seeks to reduce cybersecurity risks through a number of activities, including annual cybersecurity training for the majority of the Company’s employees, phishing tests, compliance assessments, vulnerability and noncompliance remediation and the implementation and maintenance of new cybersecurity technology.

 Third-party service providers are also utilized by the Enterprise Cybersecurity team to play a supporting role in incident response, threat intelligence, firewall management, vulnerability management and endpoint management and detection. 

29

Table of Contents

Aptiv is also exposed to cybersecurity risks at third-parties, such as suppliers, customers, service providers and consultants. Third-party risk to the Company is identified