Company: VRT
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0001628280-25-005905
Chunk: 290

Company: Vertiv Holdings Co
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1C
Chunk 290
---
 Institute of Standards and Technology’s special publication 800-53 and ISO 27001 and is comprised of the following four main pillars:Risk Governance: The Company’s cybersecurity program utilizes a cross-functional approach to addressing cybersecurity risks and engages in discussions with the Board (or a committee thereof) and our executive officers accordingly on an as-needed basis. The Company’s cybersecurity processes are implemented to help ensure that the Company’s cybersecurity practices are aligned with the Company’s overall ERM standards and practices. The Company has formed a Cyber Risk Oversight Committee ("CROC") to oversee the Company’s cybersecurity program. Our CROC, in turn, communicates any unresolved risks to the Company’s Enterprise Risk Committee ("ERC") and the ERC interacts with the Board, the Audit Committee and executive management on a regular interval, or more frequently (if necessary) in regard to such risks. Currently, the CROC is comprised of representatives of our IT department as well as senior leadership, including a majority of the direct reports to our Chief Executive Officer ("CEO"). The ERC is comprised of our Chief Legal Counsel, Senior Director of Global Risk Oversight and various heads of regional or global business units and corporate functions, including but not limited to, IT, finance, accounting, legal, and human resources.Risk Identification: We have developed risk identification and vulnerability management procedures that address the identification, prioritization, and remediation of cybersecurity vulnerabilities. To facilitate this program, the Company has created cyber risk and incident management procedures and a related risk register to document and monitor potential risks. As discussed below, the Company uses certain third-party tools to identify and manage cybersecurity vulnerabilities. Each risk in the risk register is monitored by one of our cybersecurity members and updates are reported to the CROC as needed.Risk Assessment: The Company generally evaluates risks, including cybersecurity risks, based on probability, impact and proximity. As part of its program, the Company conducts formal cybersecurity risk assessment exercises on an annual basis. The Company has documented processes and protocols in order to delineate unacceptable levels of risk and assess such risks based on a number of factors. Risk Response: We have developed various playbooks that comprise a comprehensive written incident response plan (collectively, our IRP). This IRP describes the procedures for handling a variety of cybersecurity incidents; categorizes the 

32

Table of contents                                         

types of potential cybersecurity incidents and the timeframe for reporting each; establishes cybersecurity incident response levels; provides for the conducting of legally privileged investigations to enable us to meet applicable legal obligations, including possible notification requirements; and