Company: SABR
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001597033-25-000027
Chunk: 706

Company: Sabre Corp
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 706
---
 standards and industry benchmarks, including NIST Cybersecurity Framework 2.0. We also annually engage a Qualified Security Assessor to conduct payment card industry certification on all applicable products and solutions.Our cybersecurity incident response plan describes the activities we take to identify, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to provide appropriate reporting and escalation. The program includes appropriate activities to escalate potentially material security incidents to our disclosure committee for review.  

Based on the information we have as of the date of this Annual Report with respect to the periods beginning with those covered by this Annual Report, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. We, like most technology companies, are the target of cybercriminals who attempt to compromise our systems. We describe risks relating to cybersecurity threats, including as a result of previous cybersecurity incidents in “Item 1A. Risk Factors” in this Annual Report on Form 10-K, under the headings “Our success depends on maintaining the integrity of our systems and infrastructure, which may suffer from failures, capacity constraints, business interruptions and forces outside our control.” and “Security incidents expose us to liability and could damage our reputation and our business.” 

Cybersecurity Governance

The Audit Committee of our Board of Directors has oversight authority to review our plans to mitigate cybersecurity risk. At least quarterly, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards risk-management-related goals, our incident response plan, and potentially material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to these risks. In such sessions, the Audit Committee generally receives materials including a cybersecurity risk profile scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing the company’s ability to mitigate those risks, and discusses such matters with our Chief Information Officer, our CISO, and our Data Privacy Officer. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Cybersecurity risks are also considered during separate Audit Committee, Technology Committee and Board of Directors meeting discussions of matters such as enterprise risk management,