Company: ACCO
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000950170-25-024931
Chunk: 122

Company: ACCO BRANDS Corp
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1B
Chunk 122
---
 use a risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors and service providers, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We also obtain assurances from outsourced service providers regarding the sufficiency of their security procedures and, where appropriate, assess the protections employed by these third parties. 

20

Monitoring, Testing and Auditing We monitor the evolving cybersecurity landscape that could result in new or increased cybersecurity threats. We also engage in the periodic assessment and testing of our policies, standards, processes and practices. These efforts include audits, vulnerability and penetration testing, tabletop exercises, social engineering campaigns and other internal and external assessments. We evaluate the effectiveness of our information technology-related internal controls annually. Education and Awareness The Company regularly conducts mandatory cybersecurity training for its employees, and all new hires are required to take cybersecurity training when they receive their Company computer. Failure to complete the training in a timely fashion results in their system access being suspended until completion. Management also regularly conducts "phishing" exercises to test the effectiveness of our training programs. The results of these exercises are reported to the Audit Committee. Employees also receive monthly newsletters highlighting cybersecurity developments as well as targeted email messages, as appropriate. Insurance The Company maintains cybersecurity insurance coverage in an amount that management believes to be appropriate for the Company's risk profile.   Governance Audit Committee Oversight Our Audit Committee oversees the Company's cybersecurity risks. Ms. Dvorak has a certificate in Cybersecurity Oversight from the National Association of Corporate Directors and Mr. Burton is a technology expert with experience in online fraud and cybersecurity. Both Ms. Dvorak and Mr. Burton are members of our Audit Committee. Our Senior Vice President and Chief Information Officer and our Vice President, Global Cybersecurity, update the Audit Committee regularly regarding the status of ongoing cybersecurity initiatives and strategies and incident reports. They also present information to the Audit Committee regarding management's cybersecurity risk and maturity assessments, including changes to our cybersecurity roadmap as a result of these assessments. This briefing is also posted to the full Board, which also receives quarterly updates through the Audit Committee. In accordance with the Company's policies and incident response plans, based on the severity of the incident, the Audit Committee is notified and briefed. The Board and executive management participate in cybersecurity training and conduct tabletop exercises on a periodic basis. Management Oversight At a management level, our cybersecurity program is led by our Vice President, Global Cybersecurity who oversees a team with extensive knowledge