Company: STGW
Filing Date: 2025-03-11
Form Type: 10-K
Source: 0000876883-25-000009
Chunk: 86

Company: Stagwell Inc
Filing Date: 2025-03-11
Form: 10-K
Item: Item 1C
Chunk 86
---
Item 1C. Cybersecurity

Risks from Cybersecurity Threats

Cybersecurity threats and attacks are becoming more sophisticated and pose a risk to our systems and information. While, to date, we have not been subject to cybersecurity incidents that, individually or in the aggregate, have been material to our operations or financial condition, there can be no guarantee that we will not experience such an incident in the future. For more information regarding the cybersecurity-related risks we face, see “Risk Factors - Risks Related to Data Privacy and Cybersecurity.”

Cybersecurity Risk Management and Strategy

Our approach to risk management is designed to identify, assess, prioritize and manage major risk exposures, including material risks from cybersecurity threats, which could affect our ability to execute our corporate strategy and fulfill our business objectives. We have implemented and incorporated into our operations, cybersecurity risk management processes and technologies to protect the integrity, availability and confidentiality of our critical systems and information.

Key aspects of our cybersecurity risk management program include:

•Risk assessments designed to identify risks to our systems and information;

•An internal security team principally responsible for managing our cybersecurity risk assessment processes, response to cybersecurity incidents, and information technology security controls;

•Engaging third-party service providers to assist with network, endpoint and cloud system monitoring;

•Monitoring emerging data protection laws and implementing responsive changes to our processes;

•Annual cybersecurity awareness training for employees and enhanced cybersecurity management and incident response training for employees involved in systems or processes that handle sensitive data;

•Regular audits and tests of our information systems (including review and assessment by independent third-party advisors, who help identify areas for continued focus and improvement);

•Regular phishing email simulations for employees and contractors with access to our email systems;

•A third-party risk management process for service providers, suppliers and vendors, including those with access to our customer data, employee data, or our systems; and

•A cybersecurity incident response plan that includes detailed procedures for responding to cybersecurity incidents, including processes to triage, assess severity, escalate, contain, investigate and remediate cybersecurity incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. 

In addition, we maintain insurance to protect against potential losses arising from cybersecurity incidents.

Cybersecurity Governance and Oversight

Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of our cybersecurity risk management program. The Audit Committee receives quarterly reports from management on cybersecurity risks, risk assessment and risk management, and discusses those matters with management. In addition, management updates