Keysight Technologies Inc
For the period ended Mar 21, 2024. Filed Jan 29, 2024.
View on SEC.govAbout this filing
What shareholders are asked to vote on at a company's meeting. It is where to find what directors and top executives are paid, and who owns the most shares.
Mar 21, 2024 · Filed Jan 29, 2024
Contents
Information Security
Information security is an important priority for Keysight. Our Borderless Information Security Program applies an enterprise-wide, risk-based approach to information security that has foundations in industry standards and best practices. Our information security operations and procedures provide a comprehensive Information Security Management System (“ISMS”) that enable us to maintain the confidentiality, integrity, and availability of information and systems in our environment.
BORDERLESS INFORMATION SECURITY PROGRAM
The Borderless Information Security Program is focused on the following priorities:
| • | Risk Management and Compliance – We have worldwide-operations and are subject to laws and regulatory requirements wherever we conduct business, and we have implemented a variety of processes designed to comply with these requirements. We use an enterprise-wide risk management programs and Information Security Review process designed to identify, assess, document, monitor and report information security risks. Based on this information, we evaluate the likelihood and impact of harmful events and deliver recommendations regarding a response to risks presented. |
|---|
| • | Training and Awareness – Keysight requires employees to take annual security awareness training. We regularly deploy enterprise-wide phishing simulation tests with mandatory follow-up training and education as needed. Our information security policies are based on NIST SP 800-171 and apply enterprise-wide. They are reviewed at least annually and are updated as needed. Additionally, we provide an easy mechanism for employees to report suspicious email messages to the information security team for additional investigation. |
|---|
| • | Security Tools Optimization – We utilize a variety of tools designed to protect our network and systems, including firewalls, intrusion detection and prevention systems, web content filtering protection, anti-virus and malware detection tools, system scans and full disk encryption. We use Security Information and Event Management (“SIEM”) to process logs and events from many systems, devices and applications in the environment. The SIEM correlates input from these sources and creates alerts when suspicious behavior is detected. |
|---|
| • | Third Party Risk – We have processes in place designed to catalogue and review third party access to Keysight networks. Our Internal Audit organization performs audits to help identify potential control weaknesses, compliance concerns or operational inefficiencies in our processes. |
|---|
| • | Data Protection and Asset Management – We maintain an inventory of assets and apply encryption where appropriate on mobile devices and control configurations of those devices. We have documented disaster recovery plans and processes which are regularly reviewed and tested. |
|---|
| • | Security Operations – We have multiple processes in place for detection and response to potential attacks, breaches or disruptions, including the Security Operations Center which is a dedicated, in-house, 24x7 monitoring and response center. Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. |
|---|
GOVERNANCE AND OVERSIGHT
Keysight has a dedicated Chief Information Security Officer (“CISO”) who is responsible for the ISMS, including the legal, physical, and technical controls associated with that system. The CISO and reports directly to the Company’s Chief Information Officer (“CIO”). The CIO is the head of the Company’s global information technology (“IT”) team which has an integrated governance structure consisting of a Senior Executive Committee, a Cyber Executive Committee and Cyber Leaders. The Senior Executive Committee prioritizes the information technology components of strategic business imperatives and oversees IT capability and security programs. The Cyber Executive Committee reviews identified risks, sponsors initiatives to address risk and oversees security and compliance responses. Cyber leaders are management representatives from all functions and lines of business who are responsible for executing programs and initiatives sponsored by the Executive Committee.
24 2024 Proxy Statement
The Audit and Finance Committee, which is comprised entirely of independent directors with information security experience, oversees and monitors the Company’s information security programs. In this past year, Robert Rango received a CERT Certification in Cybersecurity Oversight from Carnegie Mellon University Software Engineering Institute. The CIO meets with the Audit and Finance Committee regularly to report on risks, mitigation, initiatives, compliance and outcomes and the Audit and Finance Committee reports relevant information to the full Board.
AUDIT AND SCORING
We engage with approved third-party companies that audit our regulatory compliance, validate control performance, perform penetration testing and provide impartial risk assessments. Additionally, our information security programs are monitored by Bitsight and Security Scorecard, leading cybersecurity ratings agencies, that continuously monitor and provide security report cards for all companies with an internet presence. We are proud that our Bitsight rating puts us in the “Advanced” category, and we maintained our “A” rating from Security Scorecard as of October 31, 2023. There have been no known information security breaches in Fiscal Years 2021, 2022, or 2023.
INFORMATION SECURITY RISK INSURANCE
Keysight maintains information security risk insurance to offset the costs of an information security breach. The policy is reviewed annually and updated as needed.
The text of this filing, as the company filed it with the SEC, without its images or exhibits. This is not investment advice.