TEXAS INSTRUMENTS INC 10-K Cybersecurity GRC - 2024-02-02

Page last updated on July 16, 2024

TEXAS INSTRUMENTS INC reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-02-02 11:11:54 EST.

Filings

10-K filed on 2024-02-02

TEXAS INSTRUMENTS INC filed a 10-K at 2024-02-02 11:11:54 EST
Accession Number: 0000097476-24-000007

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C. Cybersecurity Cybersecurity risk management and strategy Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, the Center for Internet Security Controls, and the International Organization for Standardization. We use these frameworks, together with information collected from internal assessments, to develop policies for use of our information assets (for example, TI business information and information resources such as mobile phones, computers and workstations), access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multifactor authentication and malware defenses. We also work with internal stakeholders across the company to integrate foundational cybersecurity principles throughout our organization’s operations, including employment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information. Throughout the year, we also regularly train our employees on cybersecurity awareness, confidential information protection and simulated phishing attacks. We regularly engage third-party assessors to conduct penetration testing and measure our program to industry standard frameworks. We also have standing engagements with incident response experts and external counsel. We frequently collaborate with industry experts and cybersecurity practitioners at other companies to exchange information about potential cybersecurity threats, best practices and trends. Our cybersecurity risk management extends to risks associated with our use of third-party service providers. For instance, we conduct risk and compliance assessments of third-party service providers that request access to our information assets. 14 Our cybersecurity risk management is an important part of our comprehensive business continuity program and enterprise risk management. Our global information security team periodically engages with a cross-functional group of subject matter experts and leaders to assess and refine our cybersecurity risk posture and preparedness. For example, we regularly evaluate and update contingency strategies for our business in the event that a portion of our information resources were to be unavailable due to a cybersecurity incident. We practice our response to potential cybersecurity incidents through regular tabletop exercises, threat hunting and red team exercises. For more information about cybersecurity risks, see the Risk factors discussion in Item 1A of this Form 10-K. Governance of cybersecurity risk management The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The audit committee assists the board of directors with this responsibility by reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The audit committee, in turn, periodically reports on its review with the board of directors. Management is responsible for day-to-day assessment and management of cybersecurity risks. Our chief information officer has primary oversight of material risks from cybersecurity threats. Our chief information officer is the senior vice president responsible for the Information Technology Solutions (ITS) organization and for information protection. Our chief information officer has more than 25 years of experience across various engineering, business and management roles, including serving as the vice president of the design and manufacturing ITS organization, leading the development and implementation of information technology strategies and roadmaps for manufacturing automation. Our chief information security officer reports to our chief information officer. Our chief information security officer has more than 15 years of experience working in information technology-related roles, a degree in Information Technology, and Global Information Assurance Certifications in Security Essentials (GSEC) as an Intrusion Analyst (GCIA) and as a Penetration Tester (GPEN). Our chief information officer and chief information security officer assess our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to our chief information officer and chief information security officer, such as potential threats or vulnerabilities. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards. Our chief information officer meets with the audit committee periodically to review our information technology systems and discuss key cybersecurity risks. In addition, the chief financial officer reviews with the audit committee at least annually our global enterprise risk management program, which includes cybersecurity risks, and is also reported to the board. 15

Company Information