Company: ACA
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001739445-25-000026
Chunk: 71

Company: Arcosa, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 71
---
Item 1C. Cybersecurity.

Risk Management and Strategy.

Arcosa continues to make cybersecurity a priority as the threat landscape evolves and becomes increasingly complex and sophisticated.

Managing Material Risks & Integrated Overall Risk Management

Arcosa has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Arcosa's Chief Information Security Officer ("CISO") and Senior Director of Information Security work closely with the IT department to continuously evaluate and address cybersecurity risks in alignment with business objectives, operational needs, and industry-accepted standards, such as the CIS Critical Security Controls and National Institute of Standards and Technology ("NIST") frameworks. 

The Company has processes and procedures in place to monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These include but are not limited to:•Maintaining a defined and practiced incident response plan;•Maintaining cyber insurance coverage;•Employing appropriate incident prevention and detection software, such as antivirus, anti-malware, firewall, endpoint detection, and identity and access management;•Maintaining a defined disaster recovery policy and employing backup/disaster recovery software, where appropriate;•Educating, training, and testing employees on information security practices and identification of potential cybersecurity risks and threats;•Ensuring familiarity and compliance with cybersecurity frameworks where appropriate; and•Reviewing and evaluating new developments in the cyber threat landscape.

Engaging Third Parties on Risk Management

Recognizing the complexity and evolving nature of cybersecurity risk, the Company engages with a range of external experts, including cybersecurity consultants, in evaluating, monitoring, and testing Arcosa's cyber management systems and related cyber risks. The Company's collaboration with these third parties includes audits, threat and vulnerability assessments, incident response plan testing, company-wide monitoring of cybersecurity risks, and consultation on security enhancements.

Managing Third Party Risk

Arcosa recognizes the risks associated with the use of vendors, service providers, and other third parties that provide information system services, process information on its behalf, or have access to its information systems, and Arcosa has processes in place to oversee and manage these risks. In addition to the minimum security and control standards, these processes include other quality control measures, such as utilizing a third-party security scoring system to evaluate the security posture of current and potential parties. Arcosa also maintains ongoing monitoring to support continuous compliance with its cybersecurity standards.

Risks from Cybersecurity Incidents

Arcosa has not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect the Company, its operations,