Company: NPO
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0001164863-25-000009
Chunk: 192

Company: Enpro Inc.
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1A
Chunk 192
---
C.CYBERSECURITY

Risk Management Strategy

We recognize the critical importance of effectively managing cybersecurity risks to protect our businesses, intellectual property, employees, and customers.  We manage cybersecurity risks as part of our broader enterprise risk management framework, which allows us to leverage existing, robust processes for assessing the effectiveness and coverage of our controls.  In recent years, we have invested significant time and resources to develop, implement, and maintain a robust set of cybersecurity measures, which all support our efforts to mitigate potential risks to the confidentiality, integrity, and availability of our data and critical business systems.  Since the cybersecurity risk landscape is in a constant state of change, we employ a continuous, multi-layered approach to assess and measure the effectiveness of our cybersecurity defenses.  Our approach includes using select third-party resources, including external cybersecurity consultants, auditors, and technologies, along with our internal staff, to benchmark, measure, and improve our cybersecurity risk management systems and processes, and ensure alignment with industry best practices. Due to the increasing risk of third and fourth-party business relationships, we implemented a Third-Party Risk Management (“TPRM”) Program to evaluate and monitor our network of external partners, vendors, suppliers, and service providers.  Capabilities of our TPRM program include continuous monitoring of third parties, secure vendor remote access, and security architecture to protect against cyber threats introduced through other business-to-business (“B2B”) system integrations.  In addition to above, we have implemented and maintained the following cybersecurity measures as part of our efforts to assess, identify, and manage material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents (as defined in Item 106(a) of Regulation S-K):•Security Operations Program - a security operations program to bolster real-time cybersecurity incident detection and response capabilities;•Security Control Framework - a security control framework that aligns with industry accepted best practices and prioritizes implementation of critical cybersecurity controls;•Incident Response Plan - a cybersecurity Incident Response Plan, designed to effectively address cybersecurity incidents while promoting cross-functional coordination across the organization; •Tabletop Exercises - periodic internal and vendor-led tabletop exercises to assess the effectiveness, relevance, and completeness of the Incident Response Plan and Business Resilience Plans;•Assessments - annual cybersecurity assessments, which focus on identifying and remediating vulnerabilities that present the most significant organizational risks;•Training - security awareness training for all salaried personnel during onboarding and periodically throughout the year that highlights critical organizational risks through quarterly phishing simulation campaigns,