September 30, 2024
Via EDGAR
Ms. Pearlyne Paulemon
Mr. Sebastian Gomez Abero
Division of Corporation Finance
Office of Life Sciences
Securities and Exchange Commission
100 F Street, N.E.
Washington, D.C. 20549
| Re: | Equifax Inc. |
Form 10-K for the Fiscal Year Ended December 31, 2023
File No. 001-06605
Dear Ms. Paulemon and Mr. Abero,
We have reviewed the comment letter dated September 16, 2024 from the staff (“Staff”) of the Securities and Exchange Commission related to the above-mentioned filing by Equifax Inc. (the “Company”). In this letter, we are providing a response to the Staff’s comment. To assist your review, we have included the text of the Staff’s comment below in italicized type followed by the Company’s response.
Annual Report on Form 10-K for fiscal year ended December 31, 2023
Item 1C. Cybersecurity, page 26
| 1. | We note your senior leadership team consisting of your CEO and his direct reports (SLT) is responsible for setting the tone for strategic growth, effective operations and risk mitigation at the management level, as well as, the overall managerial responsibility for confirming that the information security program functions in a manner that meets the needs of Equifax. We also note that you described the relevant expertise of your CISO but not of the other members of the SLT. Please revise future filings to discuss the relevant expertise of such members of senior management as required by Item 106(c)(2)(i) of Regulation S-K. |
Response
We respectfully acknowledge the Staff’s comment above. While our senior leadership team (“SLT”) has responsibility for risk management at the managerial level and overall managerial responsibility for the various programs of the Company, including information security, our Chief Information Security Officer (“CISO”) is the management position responsible for assessing and managing material risks from cybersecurity threats under Item 106(c)(2)(i) of Regulation S-K. In future filings, we will clarify that the CISO is the management position responsible for assessing and managing material risks from cybersecurity threats.