Company: CF
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001324404-25-000006
Chunk: 66

Company: CF Industries Holdings, Inc.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 66
---
ITEM 1C.    CYBERSECURITY.

Cybersecurity risk management, including our processes for assessing, identifying and managing material risks from cybersecurity threats, is an integral part of our overall enterprise risk management (ERM) program. The ERM program includes an annual assessment process designed to identify risks, including those from cybersecurity threats, that could affect achievement of our business, operations and strategic objectives and to understand, assess, and prioritize those risks. The ERM program also intends to facilitate the implementation of risk management strategies and risk mitigation processes across the Company that are responsive to the Company’s risk profile, overall business strategies, and specific material risk exposures. The ERM program seeks to integrate consideration of risk and risk management into business decision-making throughout the Company, including through the implementation of policies and procedures intended to ensure that necessary information with respect to material risks, including material risks from cybersecurity threats, is appropriately communicated to senior executives and the Board of Directors (Board) or relevant committees. The Board regularly reviews and discusses with members of management responsible for risk management the guidelines and policies governing the ERM process. This includes the key risks identified in the ERM process, the likelihood of occurrence and the potential impact assigned to those risks by management, in addition to the risk mitigation strategies in each instance. The Audit Committee of the Board oversees management’s cybersecurity risk management efforts. Our chief information officer oversees information technology, cybersecurity risk and efforts to prevent and mitigate such risks. The Audit Committee receives periodic reports summarizing threat detection and mitigation plans, audits of internal controls, summaries of training activities and certification achievements, assessments of cybersecurity program effectiveness and reports on other cybersecurity priorities and initiatives. This is in addition to management’s periodic updates on cybersecurity incidents involving the Company or other industry and global participants. The Audit Committee also receives regular updates on the efficacy of our cybersecurity program and risk management from our chief information officer and other members of management that are tasked with monitoring cybersecurity risks. Our chief information officer has over 10 years of experience overseeing cybersecurity teams at both the Company and two other public companies. Our chief information officer is supported by a dedicated team of certified cybersecurity professionals, with an average of over 13 years of relevant experience. Our cybersecurity strategy prioritizes governance, protection, detection, analysis, and response to known, anticipated, or unexpected cyber threats, effective management of cyber risks and resilience against cyber incidents. We maintain a formal cybersecurity program structured around the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), a voluntary framework created by industry and the