Company: GPI
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0001031203-25-000013
Chunk: 106

Company: GROUP 1 AUTOMOTIVE INC
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 106
---
 and/or devices. Segmented networks and user access controls are used to limit unauthorized access to sensitive information and systems. Employees are required to use multi-factor authentication and regularly update their passwords. Encryption and Data ProtectionEncryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information and other confidential data. We also have a program in place to monitor our retained data by identifying PII and ensuring it is not stored outside of approved locations and systems. We maintain policies that govern the deletion of PII to limit the information exposed to a potential cyberattack. We have endeavored to use strong, up-to-date encryption algorithms and to regularly update and patch systems in an effort to guard against vulnerabilities. Similarly, we have sought to manage encryption keys with use of a secure key management system and rotation of keys after use. We have implemented secure protocols, including, e.g., hypertext transfer protocol secure for web traffic and secure file transfer protocol for file transfers.Processes designed to monitor cybersecurity incidents are also intended to protect our data. Our cybersecurity safeguards, including those provided by third parties, are designed to monitor for unauthorized access. These services are designed to monitor both internal and external threats. We engage several third-party consultants in connection with our risk assessment and risk management, and we have established separate processes and procedures to oversee and identify cybersecurity risks associated with third parties. Finally, we have implemented encrypted virtual private networks for remote connections. The above cybersecurity risk management processes are integrated into the Company’s overall enterprise risk management program. Cybersecurity risks are understood to be significant business risks, and as such, are considered as an important component of our enterprise-wide risk management approach.

23

Impact of Risks from Cybersecurity Threats

As of the date of this Form 10-K, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Our processes designed to monitor cybersecurity incidents are also intended to protect our data. Our cybersecurity safeguards, including those provided by third parties, are designed to monitor for unauthorized access, extraction, and deletion of certain sensitive data, large quantities of data, and other anomalous network traffic. These services are designed to monitor both internal and external threats. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our