Snapshot 147003
Normalized text
Scripts and page chrome removed; this is what change detection compares.
{
"cik": "1175454",
"name": "CORPAY, INC.",
"reports": [
{
"accession": "0001175454-26-000018",
"document": "https://www.sec.gov/Archives/edgar/data/1175454/000117545426000018/flt-20251231.htm",
"filed": "2026-02-27",
"form": "10-K",
"index": "https://www.sec.gov/Archives/edgar/data/1175454/000117545426000018/0001175454-26-000018-index.htm",
"period": "2025-12-31",
"text": "Risk Management and Strategy\nWe are subject to cybersecurity incidents and information theft risks in our operations, which we seek to manage through\ncybersecurity and information security programs, training and insurance coverage. To strengthen our security and cybersecurity\ndefenses, we maintain a defensive approach to cybersecurity and information security designed to defend our systems against\nmisuse, intrusions and cyberattacks and to protect the data we collect. We maintain continuous security monitoring and threat\ndetection capabilities, including centralized logging and alerting, intended to support the timely identification and triage of\ncybersecurity events. Our processes to assess, identify and manage material risks from cybersecurity threats are strategically\nintegrated into our overall risk management framework, as evidenced by annual risk assessments and required trainings across\nbusiness lines and applications. Our information security program maintains procedures and controls for the systems,\napplications and our data and data of our third-party providers. We also maintain processes intended to identify, assess and\nprioritize vulnerability remediation, including regular scanning of our environment.\nWe have an established cybersecurity training program which is administered through online learning modules and is required\nfor all employees at least annually. Such trainings cover topics such as password protection, phishing, the protection of\nconfidential information and asset security, among others and educate employees on mechanisms in place to report\ncybersecurity incidents or suspicions of cybersecurity incidents or threats. Further, we maintain a cybersecurity incident\nresponse plan, which is managed by our Chief Information Security Officer (CISO) and is reviewed and tested annually. The\nincident response process is overseen by a security operations and cybersecurity incident response team comprised of members\nacross the organization, including global management and IT operations and leverages an organizational-wide platform that\nallows us to track, manage and resolve information security risks across the organization. We conduct periodic exercises,\nincluding tabletop simulations, to evaluate readiness and drive continuous improvement.\nOur information security program is designed to generally align with recommended practices in security standards issued by the\nInternational Organization for Standardization (ISO), American Institute of Certified Public Accountants (AICPA, SSAE18),\nNational Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security\nStandard (PCI DSS) and other industry sources. Specifically, we strive to maintain ISO certifications (U.K.), SOC 1 and 2 Type\n2 reports and PCI DSS reports on compliance to adhere to industry standard practices.\nOur newly acquired businesses operate with independent cybersecurity programs and processes, which may vary in scope and\ncomplexity compared to our overarching cybersecurity framework, until they are fully integrated into our unified system, and\nduring this integration period we seek to establish baseline security requirements and reporting expectations appropriate to the\nrisk profile of the acquired business.\nAs part of our overall risk mitigation strategy, we also maintain cybersecurity insurance coverage; however, such insurance may\nnot be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other cybersecurity\nincidents.\nWe have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have\nmaterially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial\ncondition. However, we have been the target of cyber-attacks and expect them to continue as cybersecurity threats have been\nrapidly evolving in sophistication and becoming more prevalent in the industry. We cannot eliminate all risks from\ncybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident in the past or that\nwe will not experience such an incident in the future. For more information on the risks from cybersecurity threats and incidents\nthat we face, refer to Part I, “Item 1A. Risk Factors.”\nUse of Third Parties\nTo regularly assess whether our cybersecurity strategies and processes remain appropriate to prevent, investigate and address\ncybersecurity-related issues, we engage with information security and forensics firms with specialized industry knowledge. Our\ncollaboration with these third parties includes the administration of third-party security questionnaires, risk assessments and\ntesting and consultation on security enhancements to attempt to mitigate threats. We also collaborate with third parties,\nregulators and law enforcement, when appropriate, to resolve security incidents and assist in efforts to prevent unauthorized\naccess to our processing systems.\nIn order to oversee and identify risks from cybersecurity threats and incidents associated with our use of third-party service\nproviders, we maintain a risk management program designed to help protect against the misuse of information technology. In\naddition to risk assessments and questionnaires obtained upon selection of a new service provider, we also perform annual\nthird-party risk assessments to ensure these service providers continue to meet contractual obligations for cybersecurity,\nregulatory and industry requirements. We generally seek to include appropriate information security requirements in\nagreements with certain third-party service providers, including, where appropriate based on risk, incident notification\nobligations and rights to assess or validate the provider’s security controls.\nGovernance\nBoard of Directors Oversight\nThe Information Technology and Security Committee (ITSC) is responsible for providing oversight and leadership for our\ninformation technology security and cybersecurity planning processes, policies and objectives. The ITSC is composed of board\nmembers with both industry knowledge as well as expertise in technology and security, finance and risk management. The\nprimary purpose of the committee is to review, assess and make recommendations regarding the long-term strategy for global\ninformation security and the evolution of our technology in a competitive environment. The ITSC receives cybersecurity\nupdates in connection with its regularly scheduled meetings and more frequent briefings as needed regarding significant\ndevelopments, including notable incidents and the status of key risk management initiatives.\nTo accomplish this purpose, the information technology and security committee has four primary responsibilities:\n•to understand the security controls and assessments conducted on major card platforms and concur that such controls\nare comparable to industry best practices and standards as appropriate;\n•to assess technology modernization plans and processing platform strategies to validate proper investment in multi-\nyear initiatives that maintain effective and efficient use of Company resources;\n•to review progress on significant IT projects against milestones and quality indicators and evaluate actions intended to\ndrive quality and timeliness; and\n•to evaluate the prioritization of strategies for intellectual property protection.\nManagement's Role\nThe Board and the information technology and security committee directed the formation of a cross-functional cybersecurity\ncouncil and receive regular cybersecurity reports from the Company's Chief Information Officer (CIO) and the CISO, among\nothers. These reports include updates on our cybersecurity strategy and execution of its processes, including updates on\nprocedures to prepare for, prevent, detect, respond to and recover from (as applicable) cybersecurity incidents. Such updates\nalso include updates on our continued compliance with regulatory requirements. Our information security and risk management\nprogram is periodically evaluated by third-party specialists, and the results of those reviews are reported to the Board.\nOur CISO, who reports directly to our CIO, has served in various roles in information technology and information security for\nover 20 years, with experience in technology risk management, cybersecurity, compliance, network engineering, information\nsystems and business resiliency. He is a Certified Information Systems Security Professional and Certified Information Systems\nAuditor.\nOur CISO manages our information security and oversees our data security personnel and our incident response and business\ncontinuity management programs to assess and manage the cybersecurity element of our risk management program, including\npolicies, cybersecurity training, security operations and engineering, cybersecurity threat detection and incident response. Our\nCISO informs and updates the Board about any information security incidents that may pose a significant risk to us."
},
{
"accession": "0001628280-25-008746",
"document": "https://www.sec.gov/Archives/edgar/data/1175454/000162828025008746/flt-20241231.htm",
"filed": "2025-02-27",
"form": "10-K",
"index": "https://www.sec.gov/Archives/edgar/data/1175454/000162828025008746/0001628280-25-008746-index.htm",
"period": "2024-12-31",
"text": "Risk Management and Strategy\nWe are subject to cybersecurity incidents and information theft risks in our operations, which we seek to manage through\ncybersecurity and information security programs, training and insurance coverage. To strengthen our security and cybersecurity\ndefenses, we maintain a defensive approach to cybersecurity and information security designed to defend our systems against\nmisuse, intrusions and cyberattacks and to protect the data we collect. Our processes to assess, identify and manage material\nrisks from cybersecurity threats are strategically integrated into our overall risk management framework, as evidenced by\nannual risk assessments and required trainings across business lines and applications. Our information security program\nmaintains procedures and controls for the systems, applications and our data and data of our third-party providers. We have an\nestablished cybersecurity training program which is administered through online learning modules and is required for all\nemployees at least annually. Such trainings cover topics such as password protection, phishing, the protection of confidential\ninformation and asset security, among others and educate employees on mechanisms in place to report cybersecurity incidents\nor suspicions of cybersecurity incidents or threats. Further, we maintain a cybersecurity incident response plan, which is\nmanaged by our Chief Information Security Officer (CISO) and is reviewed and tested annually. The incident response process\nis overseen by a security operations and cybersecurity incident response team comprised of members across the organization,\nincluding global management and IT operations and leverages an organizational-wide platform that allows us to track, manage\nand resolve information security risks across the organization.\nOur information security program is designed to generally align with recommended practices in security standards issued by the\nInternational Organization for Standardization (ISO), American Institute of Certified Public Accountants (AICPA, SSAE18),\nNational Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security\nStandard (PCI DSS) and other industry sources. Specifically, we strive to maintain ISO certifications (ISO 27001 Brazil and\nU.K.), SOC 1 and 2 Type 2 reports and PCI DSS reports on compliance to adhere to industry standard practices.\nOur newly acquired businesses operate with independent cybersecurity programs and processes, which may vary in scope and\ncomplexity compared to our overarching cybersecurity framework, until they are fully integrated into our unified system.\nAs part of our overall risk mitigation strategy, we also maintain cybersecurity insurance coverage; however, such insurance may\nnot be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other cybersecurity\nincidents.\nWe have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have\nmaterially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial\ncondition. However, we have been the target of cyber-attacks and expect them to continue as cybersecurity threats have been\nrapidly evolving in sophistication and becoming more prevalent in the industry. We cannot eliminate all risks from\ncybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident in the past or that\nwe will not experience such an incident in the future. For more information on the risks from cybersecurity threats and incidents\nthat we face, refer to Part I, “Item 1A. Risk Factors.”\nUse of Third Parties\nTo regularly assess whether our cybersecurity strategies and processes remain appropriate to prevent, investigate and address\ncybersecurity-related issues, we engage with information security and forensics firms with specialized industry knowledge. Our\ncollaboration with these third parties includes the administration of third-party security questionnaires, risk assessments and\ntesting and consultation on security enhancements to attempt to mitigate threats. We also collaborate with third parties,\nregulators and law enforcement, when appropriate, to resolve security incidents and assist in efforts to prevent unauthorized\naccess to our processing systems.\nIn order to oversee and identify risks from cybersecurity threats and incidents associated our use of third-party service\nproviders, we maintain a risk management program designed to help protect against the misuse of information technology. In\naddition to risk assessments and questionnaires obtained upon selection of a new service provider, we also perform annual\nthird-party risk assessments to ensure these service providers continue to meet contractual obligations for cybersecurity,\nregulatory and industry requirements.\nGovernance\nBoard of Directors Oversight\nThe Information Technology and Security Committee (ITSC) is responsible for providing oversight and leadership for our\ninformation technology security and cybersecurity planning processes, policies and objectives. The ITSC is composed of board\nmembers with both industry knowledge as well as expertise in technology and security, finance and risk management. The\nprimary purpose of the committee is to review, assess and make recommendations regarding the long-term strategy for global\ninformation security and the evolution of our technology in a competitive environment.\nTo accomplish this purpose, the information technology and security committee has four primary responsibilities:\n•to understand the security controls and assessments conducted on major card platforms and concur that such controls\nare comparable to industry best practices and standards as appropriate;\n•to assess technology modernization plans and processing platform strategies to validate proper investment in multi-\nyear initiatives that maintain effective and efficient use of Company resources;\n•to review progress on significant IT projects against milestones and quality indicators and evaluate actions intended to\ndrive quality and timeliness; and\n•to evaluate the prioritization of strategies for intellectual property protection.\nManagement's Role\nThe Board and the information technology and security committee directed the formation of a cross-functional cybersecurity\ncouncil and receive regular cybersecurity reports from the Company's Chief Information Officer (CIO) and the CISO, among\nothers. These reports include updates on our cybersecurity strategy and execution of its processes, including updates on\nprocedures to prepare for, prevent, detect, respond to and recover from (as applicable) cybersecurity incidents. Such updates\nalso include updates on our continued compliance with regulatory requirements. Our information security and risk management\nprogram is periodically evaluated by third-party specialists, and the results of those reviews are reported to the Board.\nOur CISO, who reports directly to our CIO, has served in various roles in information technology and information security for\nover 20 years, with experience in technology risk management, cybersecurity, compliance, network engineering, information\nsystems and business resiliency. He is a Certified Information Systems Security Professional and Certified Information Systems\nAuditor.\nOur CISO manages our information security and oversees our data security personnel and our incident response and business\ncontinuity management programs to assess and manage the cybersecurity element of our risk management program, including\npolicies, cybersecurity training, security operations and engineering, cybersecurity threat detection and incident response. Our\nCISO informs and updates the Board about any information security incidents that may pose a significant risk to us."
}
]
}