Company: MWA
Filing Date: 2025-11-19
Form Type: 10-K
Source: 0001350593-25-000066
Chunk: 300

Company: Mueller Water Products, Inc.
Filing Date: 2025-11-19
Form: 10-K
Item: Item 1C
Chunk 300
---
  Similarly, the Audit Committee reports cybersecurity threats and incidents to the full Board of Directors as appropriate.

Risk Management and StrategyRisk AssessmentOur cybersecurity policies, standards, processes and practices are integrated into our enterprise risk management processes and are based on a recognized framework established by the National Institute of Standards and Technology (“NIST”) and combined with the Center of Internet Security (“CIS”) controls framework are used to develop actionable steps for improving technical defenses and protecting against common threats.  In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.  We have established and maintain comprehensive incident response and recovery plans that detail our planned responses to cybersecurity incidents.  These plans are tested and evaluated on a regular basis.  We periodically assess and test the policies, standards, processes and practices that are designed to address cybersecurity threats and incidents.  These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.Independent AssessmentsWe engage third parties to perform assessments of our cybersecurity programs, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.Technical SafeguardsWe deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including 24/7 detect and response services, network activity monitoring, phishing prevention, penetration testing and periodic IT security maturity assessments.  As part of these efforts, we have engaged third-party cybersecurity providers to help deploy and monitor these safeguards and to assist in the event of a security incident or similar issue by conducting forensics reviews and assisting more broadly with the mitigation and remediation of any such event.Third-Party RisksWe maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. 

 22

Table of ContentsIndex to Financial Statements

Education and AwarenessAll employees are required to