Whole Earth Brands, Inc. 10-K Cybersecurity GRC - 2024-03-12

Page last updated on July 16, 2024

Whole Earth Brands, Inc. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-03-12 07:49:58 EDT.

Filings

10-K filed on 2024-03-12

Whole Earth Brands, Inc. filed a 10-K at 2024-03-12 07:49:58 EDT
Accession Number: 0001753706-24-000006

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity. We maintain a comprehensive process for assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity risk management processes include security controls, monitoring systems, employee training, and cybersecurity risk insurance. Our processes include overseeing and identifying risks from cybersecurity threats associated with the use of tools and services from third-party providers. We conduct quarterly assessments to identify cybersecurity threats. Based on these assessments, we design, implement and maintain risk-based controls to protect our information, our information systems and our business operations, address any identified gaps in existing controls, update existing controls, as necessary, and monitor the effectiveness of our controls. We have allocated adequate resources and have designated appropriate personnel, including our Global IT Senior Director, to manage the cybersecurity risk management process and engage with consultants, auditors, and other third parties in connection with our cybersecurity risk management process. Senior leadership, including our Global IT Senior Director who has extensive cybersecurity knowledge and skills gained from 20 years of work experience, is responsible for our overall enterprise risk management program and has integrated the cybersecurity risk management processes into the overall enterprise risk management program. The Board of Directors, in coordination with the Audit Committee, oversees the Company’s enterprise risk management processes, including the management of risks arising from cybersecurity threats. The Audit Committee generally receives quarterly reports from our Global IT Senior Director regarding cybersecurity risks, which may address a range of topics including recent developments, risk assessments, third-party and independent reviews and technology trends. We have protocols in place by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally, and as appropriate, reported to the Audit Committee or Board in a timely manner. The Global IT Senior Director oversees the Company’s incident response plan and related processes designed to assess and manage material risks from cybersecurity threats. The Company’s Global IT Senior Director also coordinates with internal audit and other third parties to assess and manage material risks from cybersecurity threats and is responsible for informing the Audit Committee of cybersecurity incidents that may be material. In the three year period ending December 31, 2023, we have not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For additional information regarding whether risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, see Item 1A. Risk Factors - “Risks Related to Our Business,” included in this Annual Report on Form 10-K.

Company Information