Company: OC
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0001370946-25-000077
Chunk: 200

Company: Owens Corning
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1C
Chunk 200
---
ITEM 1C.CYBERSECURITY

Risk Management and Strategy

We have a range of security measures that are designed to protect against the unauthorized access to and misappropriation of our information, corruption of data, intentional or unintentional disclosure of confidential information, or disruption of operations. These security measures include controls, security processes and monitoring of our manufacturing systems. We have cloud security and other tools and governance processes designed to assess, identify and manage material risks from cybersecurity threats. In addition, we maintain an information security training program designed to address phishing and email security, password security, data handling security, cloud security, operational technology security processes, and cybersecurity incident response and reporting processes.Our cybersecurity strategy includes defense in depth, zero trust, and standards-based controls intended to protect our information technology systems. We perform incident response tabletop exercises that include members of the Company’s senior management team to validate, test, and assess the effectiveness and adequacy of certain roles and decision-making processes in the event of a cybersecurity incident. We also assess, identify, and manage cybersecurity risk associated with divestiture and merger and acquisition activities.The oversight of our cybersecurity risk management process is integrated into our overall risk management process. The risk committee is responsible for overseeing and monitoring our risk assessment and mitigation-related actions, including with respect to cybersecurity risks. The risk committee is not a committee of our Board of Directors. It is a cross-functional committee that includes members across many areas of expertise and is structurally independent of our business lines. The risk committee’s membership is designed to provide diversity of thought and perspective related to risk, including cybersecurity risks. The risk committee identifies risks and mitigation strategies, and it provides key updates to executive officers and the Audit Committee of our Board of Directors.We use third-party service providers to execute certain business processes, maintain certain information systems and infrastructure, evaluate defenses and implement recommendations. We periodically have external information security assessments performed by third parties to analyze our information technology systems and to stay informed of information security risks. Additionally, we have a supplier validation process, which provides for review and approval by our cybersecurity group for cloud services.Although we experience cybersecurity incidents from time to time as part of our operations, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have had or are reasonably likely to have, a material impact on our business strategy, results of operations or financial condition. Any breach of our security measures, or those of our third-party service providers, could result in unauthorized access to and misappropriation of our information, corruption