Company: CENX
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000949157-25-000024
Chunk: 57

Company: CENTURY ALUMINUM CO
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1C
Chunk 57
---
 address the incident, including engaging both internal resources and a team of third-party experts to investigate and respond to this intrusion. While the February 2022 cybersecurity intrusion did not materially and adversely affect our results of operations, such events have the potential to have a material adverse effect on our business strategy, results of operations and financial condition, including by damaging or interrupting access to our information systems or networks, compromising confidential or otherwise protected information, destroying or corrupting data, or otherwise disrupting our operations. Such events could also damage our reputation and our competitive position and could result in litigation with third parties, regulatory action, loss of business, potential liability and increased remediation costs, any of which could have a material adverse effect on our financial condition and results of operations. Such security breaches could also result in a violation of applicable U.S. and international privacy and other laws and could have a material adverse effect on our business, results of operations and financial position. See “Risk Factors - Risks Related to Cybersecurity - The failure of our information technology systems, network disruptions, cyber-attacks or other breaches in data security could have a material adverse effect on our business, results of operations and financial position.”

Governance

Board of Directors Oversight

The Board as a whole also oversees the Company’s cybersecurity risks. Our Chief Information Officer updates the Board periodically regarding the actions management is taking to mitigate the Company’s cybersecurity risks and enhance the Company’s cybersecurity protection. Management routinely evaluates the Company’s existing security processes, procedures and systems in order to determine whether additional enhancements are needed to further reduce the likelihood and impact of a future cybersecurity event. Some of the Company’s current safeguards include multi-factor authentication for remote access to systems; performing email phishing test campaigns; email spam filtering; restricted internet firewall rules; limiting memory stick and external hard drive use; requiring timely application of security and software patches on servers; antivirus endpoint protection; performing 24-hour/7-day a week network monitoring; and improving our backup and recovery strategy, among others.

24

Management’s Role Managing Risk

The Chief Information Officer, as well as other members of Management, plays a pivotal role in informing the Board on cybersecurity risks by providing comprehensive briefings to the Board on a regular basis. These briefings encompass a broad range of topics, including:•Current cybersecurity landscape and emerging threats;•Status of ongoing cybersecurity initiatives and strategies;•Overall security posture and layers of defense;•Incident reports and learnings from any cybersecurity events; and•Compliance with regulatory requirements and industry standards.In addition to regularly