Company: ASGN
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000890564-25-000008
Chunk: 42

Company: ASGN Inc
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1C
Chunk 42
---
Item 1C. Cybersecurity

A process for assessing, identifying, and managing cybersecurity related risks is integrated into our overall enterprise risk management (“ERM”) process. Cybersecurity related risks are included in the risk universe that the ERM process participants evaluate to assess top risks to the Company on an annual basis. The Audit Committee of the Board oversees the ERM annual risk assessment. Furthermore, as a digital innovation and transformation company, we are committed to our ever-evolving cyber protocols that safeguard our people, clients, and data. Every year, we assess our approach to information and physical security, risk management, incident response, business continuity management, and personal data privacy and protection. 

ASGN takes an enterprise approach to data protection and cybersecurity, focusing on continual process and technology improvements to enable safety, security, and information privacy. All ASGN brands align to the Department of Defense’s Cybersecurity Maturity Model Certification (“CMMC”) 2.0 framework and have implemented common technology and data protection and cybersecurity controls and processes, which provides a unified approach to our cybersecurity measures. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CMMC 2.0 framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We have invested in endpoint protection, cloud security, vulnerability management, and data loss prevention, featuring insider threat detection, we also conduct regular threat actor risk assessments and assess the risk posed by third-party vendors. Further, ASGN conducts penetration tests to detect potential security gaps in cloud and on-premise systems. These tests continuously simulate cyber-attacks on physical hardware, network endpoints, and critical applications such as Oracle, SQL and web services. 

ASGN maintains a vigilant approach to cybersecurity and operational readiness, with cybersecurity practices designed to reduce the impact of any incident. ASGN has business continuity and disaster recovery policies. Our plans are tested annually to confirm critical business functions can continue with minimal disruption in unforeseen circumstances. 

We conduct regular internal and external audits to adhere to our security policies and procedures and identify improvement areas. Our audits include: annual audits conducted by third-party service providers, internal audits, compliance audits, risk assessments, and incident response audits. In addition to these audits, ASGN collaborates with industry partners, law enforcement agencies, and government organizations to share intelligence and best practices related to cybersecurity. This collaboration helps us stay ahead of emerging threats and continuously improve our security posture. 

In 2024, ASGN has not identified