MP Materials Corp. / DE 10-K Cybersecurity GRC - 2024-02-28

Page last updated on April 11, 2024

MP Materials Corp. / DE reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-02-28 12:16:40 EST.

Filings

10-K filed on 2024-02-28

MP Materials Corp. / DE filed an 10-K at 2024-02-28 12:16:40 EST
Accession Number: 0001801368-24-000014

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C. CYBERSECURITY The Company s information security program is managed by a dedicated Chief Technology Officer ( CTO ), who has over 25 years of professional experience within information technology roles, including 15 years of security consulting experience. The CTO leads the information technology department, which is responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Company s Cybersecurity Incident Response Committee (the CIRC ), which is comprised of the Company s CTO, Chief Financial Officer, General Counsel, Senior Vice President of Financial Reporting and Technical Accounting, and Senior Director of Internal Audit, meets periodically and more often, as needed, in the event cybersecurity incidents are identified. As part of the Company s overall risk assessment process, the enterprise risk management framework considers cybersecurity risk alongside other company risks. The Company s internal audit department collaborates with the Company s information technology department to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations. The Company actively engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security policies and procedures. In addition, the Company s vendor management program addresses cybersecurity risks associated with its use of third-party service providers including suppliers, software and cloud-based service providers. The Company proactively evaluates the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence during contracting, and vendor selection processes. Security issues are documented and tracked, and periodic monitoring of third parties is conducted in an effort to mitigate risk. The Company s CTO provides periodic reports to the Audit Committee of the Company s Board of Directors, as well as the CIRC, as appropriate. These periodic reports include updates on the Company s cyber risks and threats, the status of projects to strengthen its information security systems, assessments of the information security program, and the emerging threat landscape. The information security program is regularly evaluated by the CTO with the results of those reviews reported to the CIRC, the Audit Committee of the Company s Board of Directors, and the Board of Directors, as appropriate. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected nor are they reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. 25 Table of Contents

Company Information