Company: OSIS
Filing Date: 2025-08-25
Form Type: 10-K
Source: 0001410578-25-001887
Chunk: 13

Company: OSI SYSTEMS INC
Filing Date: 2025-08-25
Form: 10-K
Item: Item 1C
Chunk 13
---
ITEM 1C. CYBERSECURITY

​

Risk Management and StrategyWe maintain high standards with respect to cybersecurity and our cybersecurity risk management program is integrated into our enterprise risk management framework, overseen by our Information Security Officer (“ISO”), meaning that cyber-risks are identified, evaluated, and managed with the same rigor as other strategic, operational, and financial risks. We have adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework principles as a guide for our security controls and processes, helping us structure our activities around identifying potential threats, protecting systems, detecting incidents, responding to events, and recovering operations. We engage independent third-party cybersecurity auditors and testers annually to review our Information Security Management (ISMS) and renew our ISO/IEC 27001 certification. Key elements of our program include:●Preventive Controls and Monitoring: We employ multiple layers of technical controls (firewalls, intrusion detection systems, encryption, and multi-factor authentication) to proactively monitor IT controls to ensure compliance with security policies, legal regulations, contractual obligations and industry best practices. Our Global Security Operations Center operates 24/7 with real-time monitoring capabilities to rapidly investigate alerts and trigger containment measures, which helps us minimize exposure or damage if a cybersecurity incident occurs. ●Vulnerability Management and Testing: We conduct regular vulnerability assessments and annual external penetration testing of our systems and applications to probe for weaknesses. We also perform periodic exercises simulating cybersecurity incidents to test our defenses and response procedures. Findings from these tests are used to strengthen our security posture on an ongoing basis. ●Incident Response Planning: We maintain a cybersecurity incident response plan that defines procedures for addressing security events. This plan is updated and tested regularly (including through tabletop drills and simulated breach exercises) so that our teams remain practiced in incident handling. In the event of an incident, our aim is to respond swiftly to contain the issue, notify appropriate stakeholders, investigate the root cause, and recover normal operations as soon as practicable. ●Third-Party Risk Management: We carefully manage cybersecurity risks arising from our use of third-party software, cloud services, and suppliers. We perform due diligence and security risk assessments on critical third-party service providers, both at onboarding and periodically during the relationship. Our procurement and legal teams work together to incorporate robust cybersecurity requirements into contracts with vendors (for example, data protection standards and incident notification obligations). Where appropriate, we require suppliers to adhere to our security policies or industry standards, and we conduct