Company: WKC
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001628280-25-007620
Chunk: 162

Company: WORLD KINECT CORP
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 162
---
 and being prepared to effectively respond to cybersecurity incidents when they occur. As a global company, we are also committed to respecting individual privacy and complying with applicable data privacy laws throughout the world, such as the European Union’s General Data Protection Regulation ("GDPR"), U.K. Data Protection Act and the California Consumer Privacy Act ("CCPA").Our cybersecurity policies, standards, processes, and practices are designed to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We have achieved ISO 27001 certification. Our cybersecurity program also includes a detailed control catalog that maps to several other frameworks, providing a broad approach to managing cyber risks. However, we use NIST and other cybersecurity frameworks solely as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.We conduct internal vulnerability scans, penetration tests, and breach simulation exercises, reinforcing our controls and our readiness to respond to potential threats. Recognizing the complexity and evolving nature of cybersecurity threats, we regularly engage with a range of external experts, including cybersecurity consultants, auditors and advisers, in evaluating and testing our risk management systems. Our collaboration with these third parties includes cybersecurity audits and testing, threat assessments and tabletop exercises, along with regular consultation on security enhancements.We have implemented processes designed to mitigate risks related to data breaches or other security incidents originating from third parties. With our vendors, we conduct security assessments of key third-party providers before engagement and maintain ongoing monitoring to ensure their compliance with our cybersecurity standards.Through our cybersecurity training program, employees and contractors are provided with cybersecurity training upon hire and thereafter on an annual basis. In addition, training and awareness campaigns continue throughout the year, where we employ various methods such as conducting mock phishing tests, live training sessions and informational articles.

Based on the information we have as of the date of this Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or cybersecurity incidents may not be fully insured. See Item 1A. – Risk Factors for additional information regarding cybersecurity threats.