VERRA MOBILITY Corp 10-K Cybersecurity GRC - 2026-02-24

Page last updated on February 24, 2026

VERRA MOBILITY Corp reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2026-02-24 16:46:11 EST.

Filings

10-K filed on 2026-02-24

VERRA MOBILITY Corp filed a 10-K at 2026-02-24 16:46:11 EST
Accession Number: 0001193125-26-067293

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity Our Board of Directors recognizes the importance of maintaining the trust and confidence of our customers, clients, business partners, and employees. Our Board of Directors, through the Audit Committee, oversees our cybersecurity program as part of our enterprise-wide approach to risk management. Our cybersecurity policies, standards, processes, and practices are integrated into our risk management approach and take into account recognized frameworks such as those established by the National Institute of Standards and Technology, as well as the International Organization for Standardization (ISO) 27001 . Risk Management and Strategy As one of the critical elements of enterprise-wide approach to risk management, our cybersecurity program is focused on the following key areas: Governance : As discussed in more detail under the heading "Governance" below, our cybersecurity program is led by our Vice President of Cybersecurity, who reports to our Chief Technology Officer , and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments, and maintaining our compliance. Our Chief Technology Officer regularly reports to our Audit Committee . Collaboration : We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents. We work with third-party firms to monitor our cybersecurity environment and report notable findings to executive leadership, internal audit, and the Audit Committee regularly. Technical Safeguards : We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls; these safeguards are evaluated and improved through vulnerability assessments, certifications, audits, and cybersecurity threat intelligence. Incident Response and Recovery Planning : We have established and maintained comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. Third-Party Risk Management : We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties , including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business operations in the event of a cybersecurity incident affecting those third-party systems. For vendors that handle confidential company data or personal data, our Supply Chain Risk Management Standard outlines applicable requirements and we conduct monitoring through a third-party monitoring tool . Education and Awareness : We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices. We engage in the periodic assessment and testing of our cybersecurity policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are periodically reported to our Board of Directors and Audit Committee by our Chief Technology Officer based on materiality. We adjust our cybersecurity policies, standards, processes, and practices as appropriate based on the information provided by these assessments, audits, and reviews . 34 Governance Our Board, through the Audit Committee, oversees our enterprise-wide approach to risk management, including the risks arising from cybersecurity threats. Our Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. Our Audit Committee also receives prompt and timely information regarding cybersecurity incidents that meet established reporting thresholds, as well as ongoing updates regarding any such applicable incident until it has been addressed. On an annual basis, our Audit Committee discusses our Company's approach to cybersecurity risk management with management. Our Audit Committee, in connection with management led by our Chief Technology Officer and Vice President of Cybersecurity, works collaboratively across our Company to oversee and to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Audit Committee monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. Both our Chief Technology Officer and Vice President of Cybersecurity have extensive related experience and have served in various roles in technology leadership and cybersecurity for over 20 years. Cybersecurity Threats As of December 31, 2025, during the past three years, we have not experienced any cybersecurity incidents that have resulted in material disruptions to operations, loss of data, or financial impact. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. We have in place insurance designed to provide coverage in connection with cybersecurity incidents, provided, however, that such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. Additional information on cybersecurity risks is discussed in Part I, Item 1A, "Risk Factors."

Company Information