XML 29 R13.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management, Strategy and Governance
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Abstract]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Risk Management and Strategy

We recognize the importance of establishing governance and oversight over cybersecurity risks, and we have implemented mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks.

The landscape of cyber threats is constantly evolving, making it increasingly challenging to effectively defend against them or implement sufficient preventative measures. We have observed a rise in the volume, frequency, and sophistication of cyber-attacks. There can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. For more information regarding the cybersecurity risks that we face, see “Risks Related to Our Control Environment – Breaches of our information systems and cyberattacks could compromise our intellectual property and cause significant damage to our business and reputation” included as part of our risk factor disclosures in Part I, Item 1A of this report.

We have adopted and continue to maintain a cybersecurity risk management program that implements various controls, technology, and procedures for the evaluation, identification, and handling of significant cybersecurity risks that could impact the confidentiality, integrity, or availability of our information systems.

Our practices include providing ongoing security awareness training for our global workforce, conducting ransomware and phishing simulations, deploying advanced tools for detecting and analyzing anomalous network activities, and implementing robust containment and incident response procedures. We leverage threat intelligence from our security vendors, as well as from trusted sources such as CISA and the FBI, to enhance our defenses and stay ahead of emerging threats. Additionally, we are committed to staying aligned with the latest industry standards and actively participating in industry forums to exchange insights and proactively address evolving cybersecurity challenges.

A critical component of our cybersecurity strategy is the integration of a third-party Security Operations Center support, which monitors our global network environment on a 24/7/365 basis, and is designed to rapidly identify and respond to threats. This program monitors both internally detected and externally reported vulnerabilities that could impact our products, which are then evaluated for their cybersecurity implications according to Company protocols. We also utilize third-party service providers as part of our cybersecurity risk management program and maintain a framework for managing cybersecurity risks presented by our third-party Service Providers. This framework governs the third party’s security management system and mandates that the program (i) adhere to certain information handling and asset management protocols and (ii) promptly notify us of any cybersecurity incidents that impact its systems.

Our enterprise risk management ("ERM") framework is designed to systematically integrate the assessment, identification, and handling of cybersecurity-related risks into our broader risk management strategy. This process involves an annual evaluation of the spectrum of risks facing the enterprise, including those related to cybersecurity. When elevated cybersecurity risks are detected, designated risk owners are tasked with formulating and overseeing the execution of targeted mitigation strategies.

We did not experience any material losses relating to cybersecurity threats or incidents for the year ended December 31, 2024. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

Governance

Adtran maintains a cybersecurity governance structure led by its Information Security Management "ISM" team, which oversees the Company's cybersecurity risk management efforts. The ISM team ensures that appropriate controls are in place to protect Adtran’s corporate assets, ensuring their availability, confidentiality, and integrity. This risk management approach informs strategic decision-making, resource allocation, and oversight mechanisms. The governance of Adtran’s cybersecurity program is ultimately the responsibility of the Board of Directors, with the Audit Committee providing critical oversight through regular reviews and periodic updates at least quarterly, or more frequently as needed.

The Company’s cybersecurity leadership includes the Chief Information Officer "CIO"/Chief Information Security Officer "CISO", who is responsible for governing and protecting Adtran’s information assets, leading the cybersecurity strategy, and reporting directly to the Chief Executive Officer. The CIO/CISO ensures compliance with ISO 27001, oversees annual external audits, and leads the monthly Information Technology Cybersecurity meetings and the Data Privacy Committee. Since joining Adtran in November 2018, the CIO/CISO has leveraged extensive leadership experience to enhance the company’s security posture. Additionally, the Chief Technology Officer ("CTO"), who joined the company in January 2023 following the Business Combination, plays a key role in product

security oversight, drawing on prior experience as Adtran Networks' CTO leading their product management and advanced technology teams. Our CTO helps oversee our product security programs.

Adtran employs a comprehensive cybersecurity program that integrates proactive risk management strategies to identify, assess, and mitigate cybersecurity threats. Key elements of this program include an Incident Response Plan to manage and resolve security incidents, regular vulnerability scanning to identify and address potential risks, and a structured patch management process to ensure timely remediation of security vulnerabilities. Additionally, the Company has established a dedicated Product Security Incident Response Team (PSIRT) to assess and respond to product security vulnerabilities. To strengthen its security culture, Adtran implements a Cybersecurity Testing and Awareness Program, requiring all employees to participate in quarterly cybersecurity assessments and complete mandatory annual training. This initiative ensures that employees remain well-informed about emerging cybersecurity threats and best practices, reinforcing a proactive security mindset across the organization.

Cybersecurity risk management is integrated into Adtran’s Enterprise Risk Management "ERM" program, in order to provide for continuous oversight and executive engagement. The ERM program undergoes quarterly executive reviews and annual assessments by the Board of Directors, and the Board receives regular briefings on cybersecurity risks, regulatory compliance, and security program updates from management. Key policies include the Information Security Program, which establishes governance principles across facilities, employees, business partners, and customers; the Cybersecurity Framework, which ensures compliance with ISO 27001 and industry standards; employee handbooks outlining security best practices; and the Incident Response Plan, which includes a material impact assessment workflow to support timely regulatory disclosures.

For additional discussion of risks associated with cybersecurity, see “Risk Factors – Breaches of our information systems and cyberattacks could compromise our intellectual property and cause significant damage to our business and reputation.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Our enterprise risk management ("ERM") framework is designed to systematically integrate the assessment, identification, and handling of cybersecurity-related risks into our broader risk management strategy.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

Adtran maintains a cybersecurity governance structure led by its Information Security Management "ISM" team, which oversees the Company's cybersecurity risk management efforts. The ISM team ensures that appropriate controls are in place to protect Adtran’s corporate assets, ensuring their availability, confidentiality, and integrity. This risk management approach informs strategic decision-making, resource allocation, and oversight mechanisms. The governance of Adtran’s cybersecurity program is ultimately the responsibility of the Board of Directors, with the Audit Committee providing critical oversight through regular reviews and periodic updates at least quarterly, or more frequently as needed.

The Company’s cybersecurity leadership includes the Chief Information Officer "CIO"/Chief Information Security Officer "CISO", who is responsible for governing and protecting Adtran’s information assets, leading the cybersecurity strategy, and reporting directly to the Chief Executive Officer. The CIO/CISO ensures compliance with ISO 27001, oversees annual external audits, and leads the monthly Information Technology Cybersecurity meetings and the Data Privacy Committee. Since joining Adtran in November 2018, the CIO/CISO has leveraged extensive leadership experience to enhance the company’s security posture. Additionally, the Chief Technology Officer ("CTO"), who joined the company in January 2023 following the Business Combination, plays a key role in product

security oversight, drawing on prior experience as Adtran Networks' CTO leading their product management and advanced technology teams. Our CTO helps oversee our product security programs.

Adtran employs a comprehensive cybersecurity program that integrates proactive risk management strategies to identify, assess, and mitigate cybersecurity threats. Key elements of this program include an Incident Response Plan to manage and resolve security incidents, regular vulnerability scanning to identify and address potential risks, and a structured patch management process to ensure timely remediation of security vulnerabilities. Additionally, the Company has established a dedicated Product Security Incident Response Team (PSIRT) to assess and respond to product security vulnerabilities. To strengthen its security culture, Adtran implements a Cybersecurity Testing and Awareness Program, requiring all employees to participate in quarterly cybersecurity assessments and complete mandatory annual training. This initiative ensures that employees remain well-informed about emerging cybersecurity threats and best practices, reinforcing a proactive security mindset across the organization.

Cybersecurity risk management is integrated into Adtran’s Enterprise Risk Management "ERM" program, in order to provide for continuous oversight and executive engagement. The ERM program undergoes quarterly executive reviews and annual assessments by the Board of Directors, and the Board receives regular briefings on cybersecurity risks, regulatory compliance, and security program updates from management. Key policies include the Information Security Program, which establishes governance principles across facilities, employees, business partners, and customers; the Cybersecurity Framework, which ensures compliance with ISO 27001 and industry standards; employee handbooks outlining security best practices; and the Incident Response Plan, which includes a material impact assessment workflow to support timely regulatory disclosures.

For additional discussion of risks associated with cybersecurity, see “Risk Factors – Breaches of our information systems and cyberattacks could compromise our intellectual property and cause significant damage to our business and reputation.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The governance of Adtran’s cybersecurity program is ultimately the responsibility of the Board of Directors, with the Audit Committee providing critical oversight through regular reviews and periodic updates at least quarterly, or more frequently as needed.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Since joining Adtran in November 2018, the CIO/CISO has leveraged extensive leadership experience to enhance the company’s security posture. Additionally, the Chief Technology Officer ("CTO"), who joined the company in January 2023 following the Business Combination, plays a key role in product

security oversight, drawing on prior experience as Adtran Networks' CTO leading their product management and advanced technology teams. Our CTO helps oversee our product security programs.

Cybersecurity Risk Role of Management [Text Block]

The Company’s cybersecurity leadership includes the Chief Information Officer "CIO"/Chief Information Security Officer "CISO", who is responsible for governing and protecting Adtran’s information assets, leading the cybersecurity strategy, and reporting directly to the Chief Executive Officer. The CIO/CISO ensures compliance with ISO 27001, oversees annual external audits, and leads the monthly Information Technology Cybersecurity meetings and the Data Privacy Committee. Since joining Adtran in November 2018, the CIO/CISO has leveraged extensive leadership experience to enhance the company’s security posture. Additionally, the Chief Technology Officer ("CTO"), who joined the company in January 2023 following the Business Combination, plays a key role in product

security oversight, drawing on prior experience as Adtran Networks' CTO leading their product management and advanced technology teams. Our CTO helps oversee our product security programs.

Adtran employs a comprehensive cybersecurity program that integrates proactive risk management strategies to identify, assess, and mitigate cybersecurity threats. Key elements of this program include an Incident Response Plan to manage and resolve security incidents, regular vulnerability scanning to identify and address potential risks, and a structured patch management process to ensure timely remediation of security vulnerabilities. Additionally, the Company has established a dedicated Product Security Incident Response Team (PSIRT) to assess and respond to product security vulnerabilities. To strengthen its security culture, Adtran implements a Cybersecurity Testing and Awareness Program, requiring all employees to participate in quarterly cybersecurity assessments and complete mandatory annual training. This initiative ensures that employees remain well-informed about emerging cybersecurity threats and best practices, reinforcing a proactive security mindset across the organization.

Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our enterprise risk management ("ERM") framework is designed to systematically integrate the assessment, identification, and handling of cybersecurity-related risks into our broader risk management strategy. This process involves an annual evaluation of the spectrum of risks facing the enterprise, including those related to cybersecurity. When elevated cybersecurity risks are detected, designated risk owners are tasked with formulating and overseeing the execution of targeted mitigation strategies.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The CIO/CISO ensures compliance with ISO 27001, oversees annual external audits, and leads the monthly Information Technology Cybersecurity meetings and the Data Privacy Committee.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Company’s cybersecurity leadership includes the Chief Information Officer "CIO"/Chief Information Security Officer "CISO", who is responsible for governing and protecting Adtran’s information assets, leading the cybersecurity strategy, and reporting directly to the Chief Executive Officer. The CIO/CISO ensures compliance with ISO 27001, oversees annual external audits, and leads the monthly Information Technology Cybersecurity meetings and the Data Privacy Committee. Since joining Adtran in November 2018, the CIO/CISO has leveraged extensive leadership experience to enhance the company’s security posture.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true