Company: LBRDK
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001558370-25-001788
Chunk: 31

Company: Liberty Broadband Corp
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 31
---
Item 1C. Cybersecurity 

Risk Management and Strategy

Liberty Broadband’s corporate level Information Technology (“IT”) and cybersecurity functions are provided by Liberty as part of the services agreement described in Part I, Item 1. “Business.” Through the services agreement, we participate in Liberty’s processes for assessing, identifying, and managing risks from cybersecurity threats at the corporate headquarters, as detailed below. GCI operates its own cybersecurity function with oversight from Liberty Broadband.Charter, an equity method affiliate, as a separate publicly traded company from Liberty Broadband, operates its own cybersecurity function. Oversight for Charter’s cybersecurity functions rests with its board of directors and Audit Committee.We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.Cybersecurity risks are assessed as part of our enterprise risk assessment and risk management program and our cybersecurity risk management program is designed and assessed based on recognized frameworks, including the NIST CSF.We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party consultants, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, using manual and automated tools such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry’s risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments. To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our IT, Security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing. Cybersecurity awareness training is also made available annually to our board of directors.In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at the corporate level and at GCI. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification