BERRY GLOBAL GROUP, INC. 10-K Cybersecurity GRC - 2024-11-26

Page last updated on November 26, 2024

BERRY GLOBAL GROUP, INC. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-11-26 16:15:32 EST.

Filings

10-K filed on 2024-11-26

BERRY GLOBAL GROUP, INC. filed a 10-K at 2024-11-26 16:15:32 EST
Accession Number: 0001140361-24-047881

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. CYBERSECURITY Governance While our Board of Directors has responsibility for the oversight of risk management on an enterprise-wide basis, it has delegated certain risk oversight responsibilities to its committees. The Audit & Finance Committee of our Board of Directors is tasked with, among other things, providing oversight of cybersecurity risk. The Audit & Finance Committee receives quarterly briefings regarding the Company’s cybersecurity matters from our Chief Information Security Officer, who has primary management oversight of cybersecurity matters and reports to our Chief Information Officer. The topics reported by the Chief Information Security Officer include updates on the Company’s cybersecurity threats, the status of projects to strengthen our information security systems, assessments of the cybersecurity program, and the emerging threat landscape, as well as the results of any third-party and internal assessments conducted. The full Board of Directors receives briefings on an as-needed basis from the Audit & Finance Committee or management, as applicable. The Global IT Team is led by the Chief Information Officer, who has served in various roles in information technology and information security for over 30 years and has significant experience across information security, infrastructure, operations and compliance. Our Chief Information Security Officer reports to the Company’s Chief Information Officer and has served in various roles in information technology and information security for over 30 years. He leads a team that focuses on the Company’s cybersecurity, including primary responsibility for leading enterprise-wide information security strategy, processes, as well as assessing, identifying, and managing cybersecurity risks, which is an integrated aspect of our overall enterprise risk management program. Members of our Global IT Leadership Team and appropriate members of Senior Management, supervise efforts to identify, assess, manage and mitigate cybersecurity risks and incidents through various means, including briefings from internal personnel and other information obtained from governmental, public, or private sources, including external consultants engaged by us. Risk Management and Strategy Risk Assessment We recognize that global cybersecurity threats and targeted attacks are an evolving risk to our data, infrastructure, and overall operations and are committed to addressing cybersecurity risks through a comprehensive, cross-functional approach that reduces security risks, helps ensure business and stakeholder information is handled securely, and effectively responds to cybersecurity incidents when they occur. We have also established and maintain a comprehensive Global Incident Response Plan designed to enable compliance with reporting standards and provide robust response to global cybersecurity events. Incidents are reviewed by the Global IMS Leadership Team and appropriate members of Senior Management. Cybersecurity Assessments We conduct targeted security assessments and penetration tests throughout the year by internal teams as well as through engagements with third party service providers, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. Effects and Impacts of Cybersecurity Risks As of the date of this report, we have not identified any risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a discussion on the Company’s cybersecurity related risks, see the risk factors titled " We depend on information technology systems and infrastructure to operate our business, and increased cybersecurity threats, system inadequacies, and failures could disrupt our operations, compromise customer, employee, vendor and other data which could negatively affect our business " and other risk factors contained in Part 1, Item 1A of this Annual Report on Form 10-K.

Company Information