Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
None.
Item 1C. Cybersecurity
We recognize the importance of developing, implementing and maintaining cybersecurity measures designed to
safeguard our information systems and protect the confidentiality, integrity and availability of our data.
Risk management and strategy
In the ordinary course of our business, we and our third-party service providers collect, maintain and transmit sensitive
data, including personal information from customers, employees and business partners, through our equipment financing
program and Speed Queen and Huebsch apps. The secure maintenance of this information is critical to our business and
reputation. In addition, we are heavily dependent on the functioning of our information technology infrastructure to carry
out our both internal and external operations. While we have adopted administrative, technical and physical safeguards to
protect such systems and data, our systems and those of third-party service providers may be vulnerable to a cyber-attack.
We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those
processes include frameworks to respond to and assess internal and external threats to the security, confidentiality, and
integrity of our data and information systems, along with other material risks to our operations, which we review with our
technology leadership and information security steering committee, and Audit Committee at least twice annually or
whenever there are material changes to our systems or operations.
Our technology department is tasked with evaluating and addressing cybersecurity risks in alignment with our business
objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical
safeguards. As part of our risk management process, we conduct regular security audits to assess and respond to internal
and external security threats and engage outside providers to conduct periodic internal and external penetration testing.
45
Table of Contents
We rely on third parties , including cloud vendors and consultants, for various business functions. Many of our third-
party service providers have access to our information systems and data, and we rely on such third parties for the
continuous operation of our business operations. We oversee third-party service providers by conducting vendor diligence.
Vendors are generally assessed for risk based on the nature of their service, access to data and systems and supply chain
risk and, based on that assessment, we conduct diligence that may include completing security questionnaires, onsite
evaluation, and scans or other technical evaluations.
Governance
Our Board of Directors has established oversight mechanisms to manage risks from cybersecurity threats. Our Audit
Com mittee has primary responsibility for cybersecurity oversight, including reviewing management’s assessments of
information security, data protection, business continuity, and related internal controls. The Audit Committee also reviews,
with management and the Company’s auditors, the adequacy and effectiveness of the Company’s cybersecurity policies.
The Audit Committee, or the Board of Directors as a whole, is briefed on any material cybersecurity incidents that may
adversely affect the Company and on cybersecurity risks in general at least semiannually.
The Company’s cybersecurity program is led by the Director of Cybersecurity , who has over 20 years of experience in
information security, including leadership roles at healthcare and global financial institutions. The Director of
Cybersecurity reports to the Chief Technology Officer. The Chief Technology Officer has more than 25 years of
experience in technology leadership, software development and enterprise systems. Working with teams across technology
operations, facilities, and firmware and software development, the cybersecurity team implements processes to identify,
assess, and manage material risks to our networks, third‑party‑hosted services, communications systems, hardware,
software, and critical data.
The cybersecurity team uses tools such as security‑awareness training, dark‑web monitoring, vulnerability scanning,
penetration testing, threat‑intelligence services, and tabletop exercises to identify and manage risks. The Director of
Cybersecurity reports to the Audit Committee at least twice per year regarding risk assessments, control decisions,
service‑provider oversight, testing results, security incidents, response activities, and recommended policy and procedure
updates.
Although we have experienced cybersecurity incidents in the past, as of the date of this report, we have not
experienced any risks from cybersecurity threats, including as a result of any previous cybersecurity incident, that have
resulted in a material effect on our business strategy, results of operations, or financial condition. Information security
threats, including cybersecurity threats, could pose risks to the security of our systems and networks, as well as the
confidentiality, availability and integrity of our data. Cyberattacks are expected to accelerate on a global basis in frequency
and magnitude as threat actors are becoming increasingly sophisticated in using techniques and tools—including artificial
intelligence (“AI”)—that circumvent security controls, evade detection and remove forensic evidence. Any material
incidents could cause us to experience financial losses that are either not insured against or not fully covered through any
insurance maintained by us and increased expenses related to addressing or mitigating the risks associated with any such
material incidents. Despite our efforts to ensure the integrity of our systems, as cyber threats evolve and become more
difficult to detect and successfully defend against, one or more cyber threats might defeat the measures that we or our
vendors take to anticipate, detect, avoid or mitigate such threats. For more information, see “Item 1.A Risk Factors - The
protection of our data involves risks regarding security incidents which could damage our reputation, harm our operating
results or result in significant liabilities or other adverse consequences that could have a material and adverse effect on our
business.”