Company: WBD
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001437107-25-000031
Chunk: 81

Company: Warner Bros. Discovery, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 81
---
ITEM 1C. Cybersecurity.

We have a cybersecurity program to assess and manage risks to the confidentiality, integrity, and availability of our data, networks and technology assets across WBD. Our board of directors oversees risk management at WBD and has delegated functional oversight of cybersecurity and information technology risks to the Audit Committee. Our Chief Information Security Officer (“CISO”) is responsible for the management of such risks and oversees a global organization whose responsibilities include proactively managing and monitoring information and content security, cybersecurity risk, and processes to enable secure and resilient access to, and use of, WBD products and services. Our cybersecurity risk management processes are aligned and integrated into our overall enterprise risk management approach.Risk Management and StrategyWe have a cybersecurity risk management strategy for safeguarding our digital assets that includes both technical and non-technical cybersecurity controls. Our multi-layered technical defense involves a series of protective measures across various levels of our technology environment. This includes fortifying our network perimeter through intrusion detection and prevention systems, securing individual devices with antivirus solutions and endpoint detection, implementing network security measures, and ensuring the resilience of applications. In addition to these technical security solutions, we also leverage non-technical methods, such as promoting a cybersecurity-conscious culture throughout WBD which includes mandatory annual cybersecurity training for all employees, a regular cadence of cybersecurity messaging to our employees, and frequent phishing simulations. Further, we engage independent third parties to conduct annual internal and external penetration testing and independent assessments of our cybersecurity risk management practices using the National Institute of Standards and Technology’s cybersecurity framework and other leading industry practices as guidelines. We also engage an independent third party to conduct a biennial cybersecurity maturity assessment to evaluate the maturity of our entire cybersecurity program.We also invest in cybersecurity incident detection and response. Our Cybersecurity Operations Center provides continuous threat monitoring and anomaly detection that is intended to prevent or minimize damage from a cybersecurity attack. We have a Cybersecurity Incident Response Plan that establishes procedures, roles, responsibilities, and communication protocols for WBD executive management and technical staff in the event of a cybersecurity incident. We test the efficacy of the Cybersecurity Incident Response Plan and assess our response capabilities by conducting annual tabletop exercises that simulate cybersecurity threat scenarios.

27

We have ongoing processes to identify and assess cybersecurity risks associated with current and prospective third-party service providers. These processes include a vendor cybersecurity compliance assessment at the time of onboarding, contract renewal and/or as needed in the event of a cybersecurity incident affecting such third-party vendor. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and