Snapshot 22507
Normalized text
Scripts and page chrome removed; this is what change detection compares.
{
"cik": "1576427",
"name": "Criteo S.A.",
"reports": [
{
"accession": "0001576427-26-000014",
"document": "https://www.sec.gov/Archives/edgar/data/1576427/000157642726000014/crto-20251231.htm",
"filed": "2026-02-26",
"form": "10-K",
"index": "https://www.sec.gov/Archives/edgar/data/1576427/000157642726000014/0001576427-26-000014-index.htm",
"period": "2025-12-31",
"text": "Overview\nCriteo recognizes the critical importance of maintaining the safety and security of our systems and data and has a holistic\nprocess for overseeing and managing cybersecurity and related risks. Our security program is led by our Chief Information\nSecurity Officer (“CISO”), who reports directly to our Chief Technology Officer (“CTO”), who is responsible for managing\ncybersecurity risks as well as protecting our products, networks and systems. Our CISO has extensive information\ntechnology and program management experience and has served many years in our corporate information security\norganization. Our CISO manages our security organization, which is composed of dedicated teams of experts in security\nengineering, incident response, compliance, and software development.\nGovernance\nOur Board is primarily responsible for the oversight of our risk management activities and has delegated to the Audit\nCommittee the responsibility to assist in this task.\nThe Audit Committee regularly reviews and discusses with management and, as appropriate, the Company’s auditors, the\nCompany’s guidelines and policies with respect to risk assessment and risk management, including the Company’s data\nprivacy and cybersecurity risk exposures and the steps taken to monitor and manage those exposures.\nThe CISO helps maintain a comprehensive security program that serves as a governance framework for information\nsecurity at Criteo, supports the business goals of the company and details, across problem spaces and security core\nfunctions, the various initiatives, their scope, the associated risks and weaknesses, the roadmap and the current progress.\nCriteo assesses and manages its cybersecurity risks in part through an executive committee referred to as the\nGovernance Risk and Compliance Committee (the “GRCC”). The GRCC is composed of the CISO and certain members\nof our executive and leadership teams, and meets several times a year to discuss strategic information security matters\nincluding the security program, major risks and incidents and significant key performance indicators (“KPIs”).\nAs a member of the GRCC, the CISO briefs the Audit Committee on the information security program, major risks and any\ncybersecurity incidents, typically at least annually. Additionally, cybersecurity risks are reported to the Board, at least\nannually, as part of Criteo’s enterprise risk mapping (“ERM”) program.\nQuality Control of Security\nTo help ensure that our security program functions in line with industry expectations, Criteo invests in identifying and\nremediating gaps in our security posture. To accomplish this, we use a mix of our internal expertise and external third-\nparty expertise, as needed, to audit ourselves against industry standards, such as the National Institute of Standards and\nTechnology (“NIST”) Cybersecurity Framework, International Organization for Standardization 27001 Information Security\nManagement System Requirements (“ISO27001”) and the American Institute of Certified Public Accountants’ Service\nOrganization Control Type 2 (“AICPA SOC 2”). Various parts of our business maintain independently assessed security\ncertifications, and we also run certification programs to expand the scope of our existing security certifications.\nRisk Management\nOur security team has several touch points within the business in order to adequately address and mitigate risks. For\ninstance, the team provides mandatory cybersecurity awareness training for all employees and a recurring phishing\nsimulation campaign. Our technical security teams use a combination of threat intelligence tools, defensive tools and\nproactive testing to detect vulnerabilities and respond. Our technical security teams also invest in building new tools and\nintegrating solutions to improve our security posture on an ongoing basis.\nOur security compliance teams perform third-party risk assessments, respond to client inquiries about security, help the\nbusiness to manage our security controls, and translate our external requirements into policies, standards, and actions for\nthe rest of our business. Various parts of our team also participate in risks assessments during project kick-offs.\nWith regards to third-party risk assessments, our process involves assessing how third parties interact and connect with\nour information systems and our data, assessing the security of the third-party (including through questionnaires), and\nobtaining independent proofs of security (including via security certification and/or penetration tests) depending on the\nassociated level of risk, as evaluated by our team. Our procurement teams also run checks to ensure vendors are not\nsanctioned or otherwise identified as potentially corrupt.\nThe process of assessing, identifying and managing cybersecurity related risks is integrated into our overall ERM via a\ndedicated Information Security Risk Management program that is focused on cybersecurity risk and run by our security\ncompliance team. Risks that are identified through our security processes go through a process of analysis, prioritization,\ntreatment and monitoring. During the lifecycle of cybersecurity specific risks, risk owners, working alongside the security\ncompliance team, are assigned to develop risk mitigation plans, which are followed by the team until a risk is sufficiently\nmitigated or resolved, at which point such risk reaches a monitoring state. Cybersecurity risks are aggregated into\nstrategic business risks and incorporated into the ERM program.\nCybersecurity Incidents\nWhile we have experienced cybersecurity incidents in the past, there have been none to date which have materially\naffected, or are reasonably likely to materially affect, the Company, our financial position, results of operations and/or cash\nflows. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and\nprocesses, which are designed to help protect our systems and infrastructure, and the information they contain.\nFor more information regarding the risks we face from cybersecurity threats, please see “Item 1A. Risk Factors – Risks\nRelated to Data Privacy, Intellectual Property and Cybersecurity.”"
},
{
"accession": "0001576427-25-000031",
"document": "https://www.sec.gov/Archives/edgar/data/1576427/000157642725000031/crto-20241231.htm",
"filed": "2025-02-28",
"form": "10-K",
"index": "https://www.sec.gov/Archives/edgar/data/1576427/000157642725000031/0001576427-25-000031-index.htm",
"period": "2024-12-31",
"text": "Overview\nCriteo recognizes the critical importance of maintaining the safety and security of our systems and data and has a holistic\nprocess for overseeing and managing cybersecurity and related risks. Our security program is led by our Chief Information\nSecurity Officer (“CISO”), who reports directly to our Chief Technology Officer (“CTO”), who is responsible for managing\ncybersecurity risks as well as protecting our products, networks and systems. Our CISO has extensive information\ntechnology and program management experience and has served many years in our corporate information security\norganization. Our CISO manages our security organization, which is composed of dedicated teams of experts in security\nengineering, incident response, compliance, and software development.\nGovernance\nOur Board of Directors is primarily responsible for the oversight of our risk management activities and has delegated to\nthe Audit Committee the responsibility to assist in this task.\nThe Audit Committee regularly reviews and discusses with management and, as appropriate, the Company’s auditors, the\nCompany’s guidelines and policies with respect to risk assessment and risk management, including the Company’s data\nprivacy and cybersecurity risk exposures and the steps taken to monitor and manage those exposures.\nThe CISO helps maintain a comprehensive security program that serves as a governance framework for information\nsecurity at Criteo, supports the business goals of the company and details, across problem spaces and security core\nfunctions, the various initiatives, their scope, the associated risks and weaknesses, the roadmap and the current progress.\nCriteo assesses and manages its cybersecurity risks in part through an executive committee referred to as the\nGovernance Risk and Compliance Committee (the “GRCC”). The GRCC is composed of the CISO and certain members\nof our executive and leadership teams, and meets several times a year to discuss strategic information security matters\nincluding the security program, major risks and incidents and significant key performance indicators (“KPIs”).\nAs a member of the GRCC, the CISO briefs the Audit Committee on the information security program, major risks and any\ncybersecurity incidents, typically at least annually. Additionally, cybersecurity risks are reported to the Board of Directors,\nat least annually, as part of Criteo’s enterprise risk mapping (“ERM”) program.\nQuality Control of Security\nTo help ensure that our security program functions in line with industry expectations, Criteo invests in identifying and\nremediating gaps in our security posture. To accomplish this, we use a mix of our internal expertise and external third-\nparty expertise, as needed, to audit ourselves against industry standards, such as the National Institute of Standards and\nTechnology (“NIST”) Cybersecurity Framework, International Organization for Standardization 27001 Information Security\nManagement System Requirements (“ISO27001”) and the American Institute of Certified Public Accountants’ Service\nOrganization Control Type 2 (“AICPA SOC 2”). Various parts of our business maintain independently assessed security\ncertifications, and we also run certification programs to expand the scope of our existing security certifications.\nRisk Management\nOur security team has several touch points within the business in order to adequately address and mitigate risks. For\ninstance, the team provides mandatory cybersecurity awareness training for all employees and a recurring phishing\ncampaign. Our technical security teams use a combination of threat intelligence tools, defensive tools and proactive\ntesting to detect vulnerabilities and respond. Our technical security teams also invest in building new tools and integrating\nsolutions to improve our security posture on an ongoing basis.\nOur security compliance teams perform third-party risk assessments, respond to client inquiries about security, help the\nbusiness to manage our security controls, and translate our external requirements into policies, standards, and actions for\nthe rest of our business. Various parts of our team also participate in risks assessments during project kick-offs.\nWith regards to third-party risk assessments, our process involves assessing how third parties interact and connect with\nour information systems and our data, assessing the security of the third-party (including through questionnaires), and\nobtaining independent proofs of security (including via security certification and/or penetration tests) depending on the\nassociated level of risk, as evaluated by our team. Our procurement teams also run checks to ensure vendors are not\nsanctioned or otherwise identified as potentially corrupt.\nThe process of assessing, identifying and managing cybersecurity related risks is integrated into our overall ERM via a\ndedicated Information Security Risk Management program that is focused on cybersecurity risk and run by our security\ncompliance team. Risks that are identified through our security processes go through a process of analysis, prioritization,\ntreatment and monitoring. During the lifecycle of cybersecurity specific risks, risk owners, working alongside the security\ncompliance team, are assigned to develop risk mitigation plans, which are followed by the team until a risk is sufficiently\nmitigated or resolved, at which point such risk reaches a monitoring state. Cybersecurity risks are aggregated into\nstrategic business risks and incorporated into the ERM program.\nCybersecurity Incidents\nWhile we have experienced cybersecurity incidents in the past, there have been none to date which have materially\naffected, or are reasonably likely to materially affect, the Company, our financial position, results of operations and/or cash\nflows. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and\nprocesses, which are designed to help protect our systems and infrastructure, and the information they contain.\nFor more information regarding the risks we face from cybersecurity threats, please see “Item 1A. Risk Factors – Risks\nRelated to Data Privacy, Intellectual Property and Cybersecurity.”"
}
]
}