Company: PAYC
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0000950170-25-024136
Chunk: 151

Company: Paycom Software, Inc.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 151
---
Risk Management and Strategy

Overview

We recognize that our clients entrust us with highly sensitive data. We also recognize our attendant responsibility to safeguard the accessibility, confidentiality, and integrity of this data. Our information security program consists of policies, procedures, systems, controls and technology designed to help us prevent, identify, detect and mitigate cybersecurity risks. Our processes are informed by cybersecurity events we have observed within the Company, across our industry, and across the cybersecurity landscape. We utilize the risk management framework for risk assessments as defined by the ISO 27001 Information Security Management Standard. We have integrated cybersecurity risk management into our overall risk management framework by conducting annual enterprise risk management assessments and IT risk management assessments, implementing periodic key risk indicator tracking, and holding periodic meetings among multiple department stakeholders to address cybersecurity risks. We review our information security policies at least annually and in connection with certain process changes to ensure that they meet the needs of the organization and the goals and objectives of the information security program.

Prevention, Identification, Detection and Mitigation Activities

We routinely undertake activities to prevent, identify, detect and mitigate risks from cybersecurity threats, including but not limited to the following:

•Procedures and guidelines designed to ensure that information security is a key consideration in the requirements for both new information systems and enhancements to existing systems and assets;

•IT environment risk assessments conducted at regular intervals and in connection with certain events, such as implementation of a new system, service or vendor;

•Tabletop and simulation exercises to discuss roles and responsibilities of team members in the event of a cybersecurity incident and to test and modify the plan as needed;

•Ongoing security penetration testing and threat modeling of our network and web application;

•Automated tools and manual review processes to ensure ongoing compliance with technical standards and identify configuration issues and technical vulnerabilities;

•Encryption of all communications with our servers, which are configured to utilize only high-grade encryption algorithms; and

•Ongoing employee training related to information security and data privacy policies and standards, including periodic phishing, vishing, and social engineering exercises.

We also have implemented and continue to maintain policies, procedures, systems, controls and technology to oversee and identify the cybersecurity risks associated with our use of third-party service providers. For example, we conduct thorough cybersecurity risk assessments of all third-party service providers prior to engagement and ongoing monitoring to ensure compliance with our robust cybersecurity requirements. The monitoring includes periodic audits of third-party systems and vendors. We engage third-party consultants and auditors in connection with assessing, identifying and managing material risks from cybersecurity threats. Our collaboration with