Company: PAYX
Filing Date: 2025-07-11
Form Type: 10-K
Source: 0000950170-25-095300
Chunk: 4

Company: PAYCHEX INC
Filing Date: 2025-07-11
Form: 10-K
Item: Item 1C
Chunk 4
---
 to assess and manage the cybersecurity-related risk associated with third-party service providers that we rely on as part of providing solutions to our clients. This program incorporates a risk-based approach based on service criticality and type of information. Vendor risk assessments are performed and documented within our vendor management system. As part of the vendor risk assessment, we conduct an information security program evaluation of critical third-party providers before engagement and, based on our assessment of the vendor’s risk, contractually require certain third parties we engage to implement security programs commensurate with their risk profile.

As of May 31, 2025, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, and financial condition. We continue to invest in cyber-resilience and cyber-threat response preparedness as we anticipate ongoing risks from cybersecurity threats. Refer to the “Risk Factors” section contained in Item 1A of this Form 10-K for more information on our cybersecurity-related risks.

Governance

Cybersecurity risks are overseen by the Audit Committee of our Board. Annually, the Audit Committee reviews an assessment of our risk management processes with the Board. The Audit Committee is responsible for reviewing significant cybersecurity risk exposures and the steps management has taken to monitor, control, and report such exposures. The Audit Committee receives quarterly updates from our CISO regarding our cybersecurity risk management program. These updates include a status of current capabilities, ongoing initiatives, and the evolving cybersecurity threat landscape.

Our management is responsible for implementing our security program, which is overseen by our Security Governance Council (the “SGC”) that regularly reports to our Chief Executive Officer and Audit Committee. The SGC is chaired by our CISO and is comprised of senior leaders and key personnel throughout the Company to support cross-functional representation. The