XML 138 R42.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Cybersecurity risk management is an important element of WPP’s overall enterprise risk management program. WPP assesses, identifies, and manages cybersecurity risks in a manner designed so that assets, information, systems, devices, and the provision of services to clients can be protected from internal and external cyber threats. WPP seeks to manage this risk while ensuring business resilience.

WPP’s cybersecurity risk management program is designed to protect the confidentiality, integrity, and availability of our critical systems and information. To achieve this, we use a variety of security tools and techniques in order to prevent, detect, investigate, contain, escalate, and recover from identified vulnerabilities and security incidents. As foundational components of our cybersecurity risk management program, we have:

a.A Data, Privacy and Security policy that defines our practices and procedures to protect the confidentiality, integrity and availability of the information we handle.
b.Internal and external assurance to assess and test our security controls.
c.A Cyber Security Incident response plan designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations.
d.With respect to third-party vendors, we (i) conduct due diligence on third-party vendors before entering into contracts with them, (ii) include cyber-and other related audit rights in our contracts with them, and (iii) include contractual obligations on them to report security incidents, risk identification, or other security-related issues promptly.
e.A Chief Information Security Officer who is responsible for executing on relevant internal policies and external legislative obligations, identifying appropriate technical and organisational controls to deliver information security in compliance with those requirements in consultation with our Chief Privacy Officer and Global Data Protection Officer who are responsible for advising on legal obligations with regards to personal data privacy.

WPP devotes significant resources to protecting the security of its computer systems, software, networks and other technology assets. WPP's cybersecurity policies, standards and procedures include cyber and data breach response plans, which are periodically reviewed and updated.

We and certain of our third-party service providers have been subject to cyberattacks and security incidents in the past due to, for example, computer malware, viruses, computer hacking, credential stuffing, and phishing attacks. We recognise cyberattacks and security incidents as a principal risk for WPP (see page 4). From time to time, we retain certain external parties, including consultants, computer security firms and risk management companies, to assist with enhancing our cybersecurity oversight.

The sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner. However, as of the date of this update, we do not believe there to be any known risks from cybersecurity threats that are reasonably likely to materially affect WPP or its business strategy, results of operations or financial condition.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] A Data, Privacy and Security policy that defines our practices and procedures to protect the confidentiality, integrity and availability of the information we handle.
b.Internal and external assurance to assess and test our security controls.
c.A Cyber Security Incident response plan designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
The Audit Committee of WPP’s Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives and provides feedback on periodic updates from management regarding cybersecurity, and is notified between such updates regarding significant new cybersecurity threats or incidents. Agendas for updates are developed and adjusted throughout the year to adapt to any emerging risks or key topics and include, among other things, training initiatives, the status of projects to strengthen cybersecurity, emerging global policies and regulations, cybersecurity technologies and best practices, remediation plans, mitigation efforts and response plans. The Board of Directors receives regular reports from the Audit Committee, including with respect to cybersecurity.

WPP’s Chief Information Security Officer has a team that is responsible for leading company-wide cybersecurity strategy, policy, standards and processes and works across relevant WPP agencies to assess and prepare WPP and its employees to address cybersecurity risks and respond to cybersecurity incidents. The Chief Information Security Officer has over 20 years of experience in various senior roles concerning information security and cybersecurity.

In an effort to deter and detect cyber threats, WPP periodically provides all employees, including part-time and temporary, with data protection and cybersecurity training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and educates employees on the importance of reporting all incidents immediately. WPP also uses technology-based tools to mitigate cybersecurity risks and to bolster its employee-based cybersecurity programs.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee of WPP’s Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives and provides feedback on periodic updates from management regarding cybersecurity, and is notified between such updates regarding significant new cybersecurity threats or incidents.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee receives and provides feedback on periodic updates from management regarding cybersecurity, and is notified between such updates regarding significant new cybersecurity threats or incidents. Agendas for updates are developed and adjusted throughout the year to adapt to any emerging risks or key topics and include, among other things, training initiatives, the status of projects to strengthen cybersecurity, emerging global policies and regulations, cybersecurity technologies and best practices, remediation plans, mitigation efforts and response plans.
Cybersecurity Risk Role of Management [Text Block]
The Audit Committee of WPP’s Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives and provides feedback on periodic updates from management regarding cybersecurity, and is notified between such updates regarding significant new cybersecurity threats or incidents. Agendas for updates are developed and adjusted throughout the year to adapt to any emerging risks or key topics and include, among other things, training initiatives, the status of projects to strengthen cybersecurity, emerging global policies and regulations, cybersecurity technologies and best practices, remediation plans, mitigation efforts and response plans. The Board of Directors receives regular reports from the Audit Committee, including with respect to cybersecurity.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
WPP’s Chief Information Security Officer has a team that is responsible for leading company-wide cybersecurity strategy, policy, standards and processes and works across relevant WPP agencies to assess and prepare WPP and its employees to address cybersecurity risks and respond to cybersecurity incidents. The Chief Information Security Officer has over 20 years of experience in various senior roles concerning information security and cybersecurity.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The Chief Information Security Officer has over 20 years of experience in various senior roles concerning information security and cybersecurity.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Board of Directors receives regular reports from the Audit Committee, including with respect to cybersecurity.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true