Company: CRAI
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001053706-25-000007
Chunk: 63

Company: CRA INTERNATIONAL, INC.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 63
---
 Risks from Cybersecurity Threats

In the event of a cybersecurity incident which jeopardizes the confidentiality, integrity, or availability of our information and technology infrastructure and systems, we utilize a regularly tested incident response plan. The plan defines an organized approach to dealing with cybersecurity incidents, and identifies roles, responsibilities and escalation protocols. The plan is designed to provide an orderly response to incidents, minimize impact, initiate appropriate communications internally and externally, and identify recommendations to mitigate future incidents. Cybersecurity incidents may be detected through a variety of means, including employee notification to our IT personnel, notification from external parties (e.g., customers, vendors, or service providers), and automated event-detection notifications. Once a potential cybersecurity incident is identified, IT personnel assigned to the incident assess the severity of the event and sensitivity of any compromised data and follow the reporting and escalation procedures set forth in the incident response plan. Events that could have a high impact or that require additional judgment are escalated to the ISC. The ISC designates an incident response team to continue investigation of the incident to determine the extent of exposure and damage, and works to contain the damage and isolate the affected system, apply security measures and ultimately recover systems.

Should a cybersecurity incident be escalated to the ISC, the ISC notifies the Chief Legal Counsel in his capacity as chair of the ERC. In the event of a cybersecurity incident that meets certain characteristics as defined in the incident response plan, the Chief Legal Counsel, as chair of the ERC, would inform the Board of Directors or the executive committee thereof.   

Cybersecurity Risks

As of December 28, 2024, we have not had any material incidences involving cybersecurity attacks. However, we previously have faced, and anticipate we will continue to face risks associated with cybersecurity threats. Although we make efforts to maintain the security and integrity of our networks and systems, and the proprietary, confidential and personal information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a cybersecurity incident or disruption as described above, there can be no assurance that our security efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See “Risk Factors–Risks Related to Our Client Relationships–Information, technology systems or service failures, or a cybersecurity incident or other compromise of our or our client's confidential or proprietary information, as well as any violation of data protection laws, could have a material adverse effect on our reputation, business and results of operations.”