Our CIO and CISO are responsible for assessing and implementing our cybersecurity risk management programs, which are informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework. These leaders and their teams have significant relevant experience in various fields, such as incident response, application security, data protection, network security and identity and access management, and have implemented and executed security programs across multiple industries at Fortune 100 companies. Our programs are designed to create a comprehensive, cross-functional approach to identify and mitigate cybersecurity risks as well as to prevent cybersecurity incidents in an effort to support business continuity and achieve operational resiliency.
We leverage certain third-party providers and local technology support teams to help execute certain aspects of our cybersecurity risk management programs. We also engage third parties in assessments and testing of our policies, processes and standards that are designed to identify and remediate cybersecurity incidents. These efforts include a wide range of activities focused on evaluating the effectiveness of the program, including audits, modeling, tabletop exercises and vulnerability testing. We also periodically engage independent third parties to perform assessments and evaluations of certain aspects of our information security control environment and operation of our program. Further, we have various processes and programs to manage cybersecurity risks associated with our use of third-party vendors and suppliers.
We provide regular, mandatory training for employees regarding cybersecurity threats to bring awareness on how they can help prevent and report potential cybersecurity incidents. In addition, key stakeholders involved with our cybersecurity risk management programs receive additional training and regularly participate in scenario-based training exercises to support the effective administration of our programs.
We have established and regularly tested incident response processes and controls that identify and risk-rank incidents through a centralized system to promote timely escalation of cybersecurity incidents that exceed a particular level of risk, including escalation of incidents of sufficient magnitude or severity to our CIO and CISO. In evaluating cybersecurity incidents, management considers the potential impact to our results of operations, control framework, and financial condition, as well as the potential impact, if any, to our business strategy or reputation.
Cybersecurity threats, including as a result of our previous cybersecurity incidents, have not materially affected our results of operations or financial condition, including our business strategy, in 2023. For additional information on risks from cybersecurity threats, please see our Risk Factors beginning on page 28.
McDonald's Corporation 2023 Annual Report 34
McDonald's Corporation 2023 Annual Report 34
McDonald's Corporation 2023 Annual Report 34