Company: MTZ
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000015615-25-000021
Chunk: 1197

Company: MASTEC INC
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 1197
---
 comprehensive enterprise-wide information security program that comprises policies and controls designed to identify, safeguard against, detect, respond to, mitigate and manage reasonably foreseeable cybersecurity risks and threats.  Our approach utilizes diverse security tools to prevent, identify,  investigate, resolve and recover from vulnerabilities and security incidents.  These include, but are not limited to, internal reporting, monitoring and detection tools.We use a collaborative, enterprise-wide strategy to address cybersecurity risks and allocate significant resources to our cybersecurity and risk management processes, which efforts are intended to adapt to the evolving cybersecurity landscape and promptly address emerging threats.  Our cybersecurity risk management program aligns with the National Institute of Standards and Technology framework and is organized into five key functions: identification, protection, detection, response and recovery.  We regularly assess the threat landscape and employ a layered cybersecurity strategy to prevent, detect and mitigate threats.We regularly collect data on cybersecurity threats and risk areas and conduct periodic external penetration and other tests to assess the effectiveness of our processes and procedures.  We assess risks associated with third-party providers as part of our overall cybersecurity risk management framework by reviewing system and organization controls reports, when available, and other independent reports.  We also generally require third parties to, among other things, maintain security controls to protect our confidential information and to promptly notify us of material breaches that may impact our data.We engage third-party industry cybersecurity experts to evaluate and review our cybersecurity programs.  Our cybersecurity risk management program encompasses such items as simulations, drills, assessments, and tabletop exercises with management's participation and incorporates third-party industry cybersecurity experts and advisors as appropriate.  These simulations, drills and assessments are conducted to test our defenses from both a technical and an operational perspective.  In addition, all employees undergo security awareness training, with regular testing through simulated phishing emails.  Certain employee positions require additional role-based, specialized security awareness or other cybersecurity training, as applicable.  We also maintain a security operations center, which is staffed 24/7, to strengthen our monitoring and alerting efforts.We face cybersecurity threats in the ordinary course of our business and have experienced cybersecurity threats and breach attempts in the past.  Such threats and breach attempts have not materially affected our business, strategy, results of operations or financial condition.  At any given time, however, we may face known or unknown cybersecurity risks and threats that cannot be fully prevented or mitigated, and we may discover vulnerabilities in our cybersecurity programs.  Therefore, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.