Criteo

Overview

Criteo recognizes the critical importance of maintaining the safety and security of our systems and data and has a holistic

process for overseeing and managing cybersecurity and related risks. Our security program is led by our Chief Information

Security Officer (“CISO”), who reports directly to our Chief Technology Officer (“CTO”), who is responsible for managing

cybersecurity risks as well as protecting our products, networks and systems. Our CISO has extensive information

technology and program management experience and has served many years in our corporate information security

organization. Our CISO manages our security organization, which is composed of dedicated teams of experts in security

engineering, incident response, compliance, and software development.

Governance

Our Board is primarily responsible for the oversight of our risk management activities and has delegated to the Audit

Committee the responsibility to assist in this task.

The Audit Committee regularly reviews and discusses with management and, as appropriate, the Company’s auditors, the

Company’s guidelines and policies with respect to risk assessment and risk management, including the Company’s data

privacy and cybersecurity risk exposures and the steps taken to monitor and manage those exposures.

The CISO helps maintain a comprehensive security program that serves as a governance framework for information

security at Criteo, supports the business goals of the company and details, across problem spaces and security core

functions, the various initiatives, their scope, the associated risks and weaknesses, the roadmap and the current progress.

Criteo assesses and manages its cybersecurity risks in part through an executive committee referred to as the

Governance Risk and Compliance Committee (the “GRCC”). The GRCC is composed of the CISO and certain members

of our executive and leadership teams, and meets several times a year to discuss strategic information security matters

including the security program, major risks and incidents and significant key performance indicators (“KPIs”).

As a member of the GRCC, the CISO briefs the Audit Committee on the information security program, major risks and any

cybersecurity incidents, typically at least annually. Additionally, cybersecurity risks are reported to the Board, at least

annually, as part of Criteo’s enterprise risk mapping (“ERM”) program.

Quality Control of Security

To help ensure that our security program functions in line with industry expectations, Criteo invests in identifying and

remediating gaps in our security posture. To accomplish this, we use a mix of our internal expertise and external third-

party expertise, as needed, to audit ourselves against industry standards, such as the National Institute of Standards and

Technology (“NIST”) Cybersecurity Framework, International Organization for Standardization 27001 Information Security

Management System Requirements (“ISO27001”) and the American Institute of Certified Public Accountants’ Service

Organization Control Type 2 (“AICPA SOC 2”). Various parts of our business maintain independently assessed security

certifications, and we also run certification programs to expand the scope of our existing security certifications.

Risk Management

Our security team has several touch points within the business in order to adequately address and mitigate risks. For

instance, the team provides mandatory cybersecurity awareness training for all employees and a recurring phishing

simulation campaign. Our technical security teams use a combination of threat intelligence tools, defensive tools and

proactive testing to detect vulnerabilities and respond. Our technical security teams also invest in building new tools and

integrating solutions to improve our security posture on an ongoing basis.

Our security compliance teams perform third-party risk assessments, respond to client inquiries about security, help the

business to manage our security controls, and translate our external requirements into policies, standards, and actions for

the rest of our business. Various parts of our team also participate in risks assessments during project kick-offs.

With regards to third-party risk assessments, our process involves assessing how third parties interact and connect with

our information systems and our data, assessing the security of the third-party (including through questionnaires), and

obtaining independent proofs of security (including via security certification and/or penetration tests) depending on the

associated level of risk, as evaluated by our team. Our procurement teams also run checks to ensure vendors are not

sanctioned or otherwise identified as potentially corrupt.

The process of assessing, identifying and managing cybersecurity related risks is integrated into our overall ERM via a

dedicated Information Security Risk Management program that is focused on cybersecurity risk and run by our security

compliance team. Risks that are identified through our security processes go through a process of analysis, prioritization,

treatment and monitoring. During the lifecycle of cybersecurity specific risks, risk owners, working alongside the security

compliance team, are assigned to develop risk mitigation plans, which are followed by the team until a risk is sufficiently

mitigated or resolved, at which point such risk reaches a monitoring state. Cybersecurity risks are aggregated into

strategic business risks and incorporated into the ERM program.

Cybersecurity Incidents

While we have experienced cybersecurity incidents in the past, there have been none to date which have materially

affected, or are reasonably likely to materially affect, the Company, our financial position, results of operations and/or cash

flows. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and

processes, which are designed to help protect our systems and infrastructure, and the information they contain.

For more information regarding the risks we face from cybersecurity threats, please see “Item 1A. Risk Factors – Risks

Related to Data Privacy, Intellectual Property and Cybersecurity.”