Our risk management program includes focused efforts on identifying, assessing and managing cybersecurity risk, including the following:
A robust information security training program that requires all company employees with access to our networks to participate in regular and mandatory training on how to be aware of, and help defend against, cyber risks, combined with periodic testing to measure the efficacy of our training efforts.
Alignment of our program with the National Institute of Standards and Technology Cybersecurity Framework to prevent, detect and respond to cyberattacks.
Ongoing adoption of a “zero trust” cybersecurity model.
Regular and robust testing of our systems to assess our vulnerability to cyber risk, which includes targeted penetration testing, tabletop incident response exercises, periodic audits of our systems by outside industry experts and regular vulnerability scanning.
A formal vendor risk assessment process to ensure any vendors with information access have appropriate security measures and practices in place.
Engaging external cybersecurity experts in incident response development and management.
Business continuity plans and critical recovery backup systems.
Insurance for damage to property caused by a cyberattack.
Our chief information security officer (CISO) is primarily responsible for leading the technical team that assesses and manages cybersecurity risk for the company on a day-to-day basis. He and other members of the cybersecurity team have deep and broad experience and training in cybersecurity management, as well as relevant education and industry recognized certifications in information systems security.