Company: SYY
Filing Date: 2025-08-22
Form Type: 10-K
Source: 0000096021-25-000099
Chunk: 114

Company: SYSCO CORP
Filing Date: 2025-08-22
Form: 10-K
Item: Item 1C
Chunk 114
---
Item 1C.  Cybersecurity

Cybersecurity Risk Management and Strategy

We use technology in substantially all aspects of our business operations, and our ability to serve customers effectively depends on the reliability of our technology systems. Greater use of technology and digitization in operations has delivered benefits to our business, while also exposing us and others in our industry to new vulnerabilities in corporate and operational systems. Additionally, our business operations leverage third-party vendors and systems, which makes us susceptible to various cyber threats.The scale, scope, and complexity of our business raises a multitude of interdependent risks, which can vary over time. A primary responsibility of our leadership team, subject to oversight by our Board of Directors and specifically, our Board’s Technology Committee, is to design and implement processes to identify, prioritize, assess, monitor and manage enterprise-level risks associated with cybersecurity threats. We have a dedicated cybersecurity team that collaborates with compliance, privacy, legal, and other teams across the global organization to assess the cybersecurity risk landscape. 

Our cybersecurity oversight function, which is led by our Chief Information Security Officer (CISO) and also includes our Chief Information Officer (CIO), Chief Executive Officer, Chief Financial Officer and General Counsel, directly oversees the cybersecurity and risk management process, which incorporates input from personnel from different functions, levels, and operating regions to support a high level of visibility and accountability throughout the company and to incorporate multiple vantage points on risks and potential mitigations. The cybersecurity oversight function meets at least quarterly to discuss key risks and to discuss mitigation strategies. The results of our cybersecurity team process are communicated to the leadership team and its risk & reputation committee (the RRC) at least quarterly. 

21

The Technology Committee of the Board of Directors oversees cybersecurity risks and receives cybersecurity reports from our CISO and regularly conducts in-depth cybersecurity discussions. Our CIO and CISO have extensive experience in the areas of cybersecurity and risk management. Our CISO has more than 20 years of experience in Information Technology, including cybersecurity leadership roles. Our CIO, who oversees the cybersecurity team and reports directly to our Chief Executive Officer, has over 20 years of experience in information technology strategy, services, operations, risk and cybersecurity for large global enterprises. 

Cybersecurity risks are included in the risk universe that the RRC evaluates, with input from information security subject matter experts at the company, to assess top risks to the enterprise. The RRC process provides input into our strategic planning process, such as development of action plans to address and mitigate identified risks. Integrating