Company: LPX
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0000060519-25-000005
Chunk: 6

Company: LOUISIANA-PACIFIC CORP
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 6
---
ITEM 1C.    Cybersecurity

CYBERSECURITY OVERSIGHT

Risk Management and StrategyLP places utmost priority on ensuring consistent and uninterrupted operational capability, as well as securing confidential business assets. We have systems and processes in place to assess, identify and manage cybersecurity incidents, and those systems and processes are integrated into our overall enterprise risk management system. We invest heavily in technology and third-party support to identify, mitigate, and quickly respond to cybersecurity incidents, and we have maintained a strong focus in consistently reviewing fundamental cybersecurity practices and ensuring we are reviewing emerging threats. To respond to the threat of security breaches and cyberattacks, we maintain a cybersecurity program designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, LP. This program includes mechanisms to monitor and detect unusual network activity, cybersecurity incident response and containment tools, and a response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident. We also have a cybersecurity training and compliance program in place for the Company whereby our connected employees receive training and are tested routinely through simulated phishing attempts. We rely heavily on third-party suppliers and vendors, and a cybersecurity incident at one of our suppliers or vendors could have a material adverse impact on our business operations. We evaluate third-party cybersecurity risk controls through various assessment activities carried out by LP employees and by third-party service providers acting on our behalf. We engage an independent third party to conduct an annual Security Program Assessment under the Capability Maturity Model Integration framework. For incident alerts and response, we outsource around-the-clock coverage to a third-party managed service provider who provides timely alerting and notification of potential cybersecurity issues. In 2023, we also engaged a specialized third-party assessor to perform an operational technology security assessment for a subset of our manufacturing facilities. We continually work with third-party experts to advise on new threats and cybersecurity strategy best practices for specific capabilities. No risks from cybersecurity threats have materially affected, nor has LP identified any specific risks from known cybersecurity threats that are reasonably likely to materially affect, LP, including our business strategy, results of operations or financial condition. Please see "Risk Factors – Business and Operational Risk Factors – Cybersecurity risks related to the technology used in our operations and other business processes, as well as security breaches of Company, customer, consumer, employee, or vendor information, could adversely affect our business" in Item 1A of this annual report on Form 10-K for additional discussion of cybersecurity risks applicable to LP.

Management ResponsibilitiesOur cybersecurity