McDonald's (MCD) Risk Analysis

The CISO reports to the CIO. McDonald's CIO and CISO are responsible for assessing and implementing our cybersecurity risk management programs, which are informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework. These leaders and their teams have significant relevant experience in various fields, such as incident response, application security, data security, network security and identity and access management, and have implemented and executed security programs across multiple industries at Fortune 100 companies. Our programs are designed to create a comprehensive, cross-functional approach to identify, assess, manage and mitigate cybersecurity risks as well as to mitigate cybersecurity incidents to support business continuity and achieve operational resiliency. The CISO leads the Global Cybersecurity organization, which is responsible for executing the Company's Global Cybersecurity Program and initiatives. This global program is responsible for identifying technology and cybersecurity risks and for implementing and maintaining controls to manage cybersecurity threats. These controls are designed to mitigate, detect and respond to cybersecurity incidents to help safeguard the confidentiality, integrity and availability of McDonald's infrastructure, resources and information. McDonald's Global Cybersecurity Program includes the following functions: - Cybersecurity Services, which is responsible for deploying and operating the frontline security controls that are designed to protect and defend McDonald's against cyber-attacks. Cybersecurity teams are focused on specific areas of a layered defense, including Network Security, Endpoint Protection, Identity and Access Management, Data Protection, and others, to ensure that these controls are integrated into critical systems and processes throughout the McDonald's environment and operating effectively. - Cyber Defense, which is responsible for implementing and maintaining controls designed to detect and respond to cybersecurity incidents against McDonald's and includes a dedicated function for incident response and regular monitoring for cybersecurity threats and vulnerabilities, including those among McDonald's third-party suppliers. The Company has established and regularly tested incident response processes and controls that identify and risk-rank incidents through a centralized system to promote timely escalation of cybersecurity incidents that exceed a particular level of risk, including escalation of incidents of sufficient magnitude or severity to the CIO and CISO. - Cyber Governance, Risk & Compliance, which is responsible for operationalizing technology risk and control frameworks, analyzing regulatory developments that may impact McDonald's, and developing control catalogs and assessments of controls, as well as overseeing governance and reporting of technology and cybersecurity risk. The team provides awareness and training that reinforces information risk and security management practices and compliance with McDonald's policies, standards and practices. The training is mandatory for all employees globally on a periodic basis, and it is supplemented by Company-wide testing initiatives, including periodic phishing tests. - Cyber Market Engagement, which is responsible for working with our market teams, International Developmental Licensee partners, and other entities to ensure a consistent approach for cybersecurity across the McDonald's system. The governance structure for the Global Cybersecurity organization is designed to appropriately identify, escalate, and mitigate cybersecurity risks. Cybersecurity risk management and its governance and oversight are integrated into McDonald's operational risk management framework, including through the escalation of key risk and control issues to management and the development of risk mitigation plans for heightened risk and control issues. As needed, McDonald's engages third-party assessors or auditing firms with industry-recognized expertise on cybersecurity matters to review specific aspects of McDonald's cybersecurity risk management framework, processes and controls. These efforts include a wide range of activities focused on evaluating the effectiveness of the program, including audits, modeling, tabletop exercises and vulnerability testing.