Company: OC
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0001370946-25-000077
Chunk: 131

Company: Owens Corning
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1
Chunk 131
---
 and perspective related to risk, including cybersecurity risks. The risk committee identifies risks and mitigation strategies, and it provides key updates to executive officers and the Audit Committee of our Board of Directors.We use third-party service providers to execute certain business processes, maintain certain information systems and infrastructure, evaluate defenses and implement recommendations. We periodically have external information security assessments performed by third parties to analyze our information technology systems and to stay informed of information security risks. Additionally, we have a supplier validation process, which provides for review and approval by our cybersecurity group for cloud services.Although we experience cybersecurity incidents from time to time as part of our operations, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have had or are reasonably likely to have, a material impact on our business strategy, results of operations or financial condition. Any breach of our security measures, or those of our third-party service providers, could result in unauthorized access to and misappropriation of our information, corruption of data or disruption of systems, operations or transactions, any of which could have a material adverse effect on our business strategy, results of operations or financial condition. See Item 1A. Risk Factors of this Annual Report on Form 10-K for further discussion of the risks related to cybersecurity threats.

Governance

The Board of Directors is responsible for overseeing risk for the Company and has delegated to the Audit Committee responsibility for overseeing the cybersecurity risk management strategy for the Company. The Audit Committee receives regular updates on our cybersecurity risk management process from members of management, including our Chief Information Officer (“CIO”). The Audit Committee reviews our comprehensive cybersecurity framework, including reviewing our cybersecurity reporting protocol that provides for the notification, escalation and communication of significant cybersecurity events to a crisis management team and appropriate levels of management, including our CIO, as well as to the Audit Committee. Management also provides the Audit Committee with a cybersecurity dashboard, which the full Board of Directors can access as well. Additionally, the Audit Committee regularly provides updates to the Board on the status of the Company’s cybersecurity risk management process.

19

ITEM 1C.CYBERSECURITY (continued)

The Company’s cybersecurity program is overseen by our CIO, who is responsible for global information technology, including cybersecurity. Our Vice President, Global Information Security, is primarily responsible for assessing and managing material risks from cybersecurity threats, including monitoring the measures used for prevention, detection, mitigation and remediation of cybersecurity incidents. Our CIO is responsible for our information security organization, which is comprised of internal Owens Cor