Moody's Corporation recently released its 10-K report, providing a comprehensive overview of the company's financial performance and operations. Moody's Corporation operates as an integrated risk assessment firm worldwide, with two main segments * Moody's Analytics and Moody's Investors Services. The Moody's Analytics segment offers a range of products and services to support risk management activities in financial markets, while the Moody's Investors Service segment publishes credit ratings and provides assessment services on various debt obligations and entities.
In its 10-K report, Moody's detailed its cybersecurity and risk management practices. The company maintains a dedicated internal cybersecurity team that interacts with executive management and its business units to identify, assess, manage, and respond to cybersecurity risks and incidents relating to the company’s information systems and operations. At the end of 2024, the internal cybersecurity team consisted of members located in various countries and time zones across the world, with expertise in governance, risk management and compliance, threat monitoring, and cyber incident management.
Moody's also outlined its Cyber Committee, responsible for identifying cybersecurity risks and threats, recommending mitigating actions, and validating that the company has appropriate capabilities to identify, mitigate, and report on cybersecurity risks to the executive leadership team and the Board of Directors. The company's cybersecurity program leverages the NIST Framework and incorporates training and awareness, ongoing monitoring and assessment, and periodic internal and external reviews.
The company's cybersecurity environment is subject to routine vulnerability assessment processes, including penetration testing, red teaming, tabletop exercises, and phishing drills. Moreover, the company contracts with reputable third parties to conduct annual external assessments of its cybersecurity program and its components. Moody's also has an Information Security Policy and Information Security Standards in place, which describe the standards and minimum requirements expected of all business and information security personnel to protect the company’s information and technology assets.
The 10-K report emphasizes the dynamic and volatile nature of the cybersecurity threat landscape, highlighting the significant investment required in terms of talent recruitment and retention, as well as procuring and deploying the correct tools to address threats. The report also directs readers to Item 1A of Part I, “Risk Factors,” under the heading “Technology Risks,” for additional information on cybersecurity risks.
The market has reacted to these announcements by moving the company's shares -0.9% to a price of $522.84. For more information, read the company's full 10-K submission here.
