Company: APTV
Filing Date: 2025-02-07
Form Type: 10-K
Source: 0001521332-25-000010
Chunk: 63

Company: Aptiv PLC
Filing Date: 2025-02-07
Form: 10-K
Item: Item 1C
Chunk 63
---
 PSIRT team regularly analyzes vulnerabilities reported by threat intelligence and public vulnerability reporting databases and determines whether any of those vulnerabilities are present in the Company’s products. Vulnerabilities identified are reviewed by the Vice President of Product Security on a weekly basis with involvement from the CTO and the Company’s legal staff as necessary. For all vulnerabilities identified, the PSIRT reviews whether adequate mitigations are already in place. In situations where adequate mitigations are not present, the PSIRT works with the customer to address the concern which may involve adding additional mitigations to the product.

Board of Directors Oversight

The Company’s Board of Directors (the “Board”) takes an active role in risk oversight related to cybersecurity matters, primarily through the Audit Committee (the “AC”), which covers enterprise cybersecurity risk, and the Innovation and Technology Committee (the “ITC”), which covers product cybersecurity risk. The Board, individually and through the AC and ITC, regularly reviews relevant information technology and cybersecurity matters and receives periodic updates from information technology and cybersecurity subject matter experts as part of its risk assessment procedures, including analysis of existing and emerging risks, as well as plans and strategies to address those risks. In connection with the Board’s risk management oversight responsibility, the entire Board receives a full briefing from management annually on cybersecurity matters, as well as periodic briefings based on specific requests or current events. On a regular basis, the Board also reviews the Company’s enterprise risk management program, within which the Company’s cybersecurity processes have been integrated, as described above.

30

Table of Contents

The Board and AC regularly review the identification and management of enterprise cybersecurity risks and review regular reports from management on system vulnerabilities and security measures in effect to deter or mitigate breaches or hacking activities. The AC also reviews our guidelines and policies with respect to risk assessment and management of our major financial and information technology risk exposures, including enterprise cybersecurity, along with the monitoring and mitigation of identified exposures. 

The Board and ITC regularly review the identification and management of product cybersecurity risks and review regular reports from management on risks and mitigation strategies in effect to reduce product cybersecurity risk. The ITC also reviews our guidelines and policies with respect to risk assessment and management of product security risks, including both our approach toward a secure systems development lifecycle and product security incident response.

In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we