Company: KHC
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001637459-25-000011
Chunk: 76

Company: Kraft Heinz Co
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 76
---
Item 1C. Cybersecurity

Cybersecurity Risk Management, Strategy, Governance, and Incident DisclosureThe Company assesses, identifies, and manages cybersecurity risk using a data-driven risk management program intended to reduce risks to the following impact classes: the Company’s obligations to prevent harm to parties, including employees, customers, and stockholders; and the Company’s business objectives.As part of our cybersecurity strategy, we set risk targets based on our risk thresholds using industry-recognized standards for controlling and evaluating the risk of cybersecurity threats. The Company has developed cybersecurity policies supported by defined standards, including identity and access control, network controls, operational security, information classification, cybersecurity risk management, incident management and reporting, and security in software development lifecycle.We undertake scheduled and targeted cybersecurity risk assessments to identify and prioritize risks to our three impact classes so that foreseeably harmed parties (which include our employees, contractors, partners, customers, stockholders, consumers, and suppliers) are explicitly included in our risk analysis and risk management priorities. We plan for, implement, and improve safeguards that are designed to reduce unacceptable risks to any foreseeably harmed party. We engage third-party service 

21

providers (including contractors and vendors) as part of our normal business operations, including collaborating with third-party experts to assist with evaluating, identifying, and managing our cybersecurity risks. Our cybersecurity risk management program includes:•Ongoing audits of third-party service providers, including penetration testing and reviews of program maturity based on the National Institute of Standards and Technology (“NIST”) cybersecurity framework;•Due diligence reviews of third-party service providers’ information security programs;•Regular phishing, social engineering, and cybersecurity awareness training for employees with Company emails and access to connected devices;•Annual tabletop exercises to educate and train our personnel on response capabilities and inform adjustments to our controls and response;•Regular consultation with external advisors and specialists regarding opportunities and enhancements to strengthen our cybersecurity practices and policies;•Ongoing cybersecurity event monitoring, management, and testing of incident response procedures; and•Ongoing enhancements to cybersecurity capabilities based on evolving threats.We have adopted an incident response plan that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to such cybersecurity incidents. The plan sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management, the Board, and other key stakeholders informed and involved as appropriate. The plan is aligned to NIST guidance. It also adheres to standards of practice and includes the involvement of any personnel who may detect incidents