Company: PENG
Filing Date: 2025-12-19
Form Type: DEF 14A
Source: 0001616533-25-000073
Chunk: 26

Company: Penguin Solutions, Inc.
Filing Date: 2025-12-19
Form: DEF 14A
Chunk 26
---
 the Responsible Business Alliance (“RBA”) and its code of conduct, which align with the United Nations (“UN”) Guiding Principles and its framework on the issue of human rights and transnational corporations and other business enterprises.

#### Privacy and Data Security
Our Board takes a direct interest in privacy, data security, and IP protection. In 2021, the Board formed the Cybersecurity Committee, which oversees information technology use and data security, including enterprise cybersecurity, AI, privacy, data collection and protection, and compliance with information security and data protection laws in accordance with our ongoing implementation of our Information Security Risk Management framework, which is built with reference to National Institute of Standards and Technology and International Organization for Standardization (“ISO”) standards. In 2023, we took steps to strengthen our information technology strategy and cybersecurity protections, including increasing the size of our cybersecurity team and implementing a new comprehensive cybersecurity training program. Key elements of our cybersecurity risk management program include: periodic risk assessments designed to help identify material cybersecurity risks to critical systems and information; use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; cybersecurity awareness training for employees; an information security event response plan and a cross‑functional information security event response team; and third‑party risk management processes for key IT vendors based on their criticality and risk profile. Our Chief Information Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats, and, together with our management team, supervises our internal cybersecurity personnel and retained external cybersecurity consultants. During fiscal 2023, 2024, and 2025, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected us.

#### AI Governance
In fiscal 2024, we formed an AI Governance Committee, which oversees the implementation, use, and management of generative AI tools at the Company to ensure that our AI initiatives align with the Company's ethical standards, regulatory requirements, and strategic objectives. The AI Governance Committee, which consists of key executives across Company departments, reports its activities and findings to the Cybersecurity Committee at least annually. We also adopted a Generative AI Use in the Workplace Policy to set forth rules, requirements, and processes governing our employees’ use of AI tools.

#### Product Safety and Compliance
Product safety and compliance efforts are also central to Penguin Solutions. For example, we work with our suppliers so that we have visibility into the components we use which, based on our suppliers’ transparency, are lead