What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-01-28 compared with 2025-01-29 · 54 added, 61 removed, 4 unchanged (97% of the section changed)

1 unchanged sentence

Cybersecurity

We maintain an information

security and cybersecurity program, as well as a cybersecurity governance framework, which are designed to protect our information systems

against operational risks related to cybersecurity.

Cybersecurity Risk Management and Strategy

We recognize the importance

of assessing, identifying, and managing material risks associated with cybersecurity threats which include, among other things, operational

risks, intellectual property theft, fraud or extortion, harm to employees or customers, violation of privacy or security laws and related

litigation and legal risk, and reputational risks.

We have developed and implemented

a cybersecurity risk management program overseen by our Audit Committee intended to protect the confidentiality, integrity, and availability

of our critical systems and information, and detect and contain any cybersecurity incidents that impact us.

The program is integrated

into our overall risk management systems and processes, and includes a cybersecurity risk assessment process that routinely evaluates

potential impacts of cybersecurity risks on our business, including risks from cybersecurity threats associated with our use of third-party

service providers.

maintain an information security and cybersecurity program, as well as a cybersecurity governance framework, which are designed to protect

our information systems against operational risks related to cybersecurity.

Cybersecurity

Risk Management and Strategy

recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats which include,

among other things, operational risks, intellectual property theft, fraud or extortion, harm to employees or customers, violation of

privacy or security laws and related litigation and legal risk, and reputational risks.

have developed and implemented a cybersecurity risk management program overseen by our Audit Committee intended to protect the confidentiality,

integrity, and availability of our critical systems and information, and detect and contain any cybersecurity incidents that impact us.

The program is integrated into our overall risk management systems and processes and includes a cybersecurity risk assessment process

that routinely evaluates potential impacts of cybersecurity risks on our business, including risks from cybersecurity threats associated

with our use of third-party service providers.

These assessments inform our cybersecurity risk mitigation strategies.

The results are regularly shared with our information

technology committee comprised of our Vice President of Information Technology, our Information Technology Manager, our President and

our Chief Financial Officer (the “IT Steering Committee”) and the Audit Committee of our Board as part of the committees’

involvement in managing and overseeing cybersecurity risks.

Our cybersecurity risk management

program also includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate an incident, as well

as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

If a cybersecurity incident is

determined to be a potentially material cybersecurity incident, our disclosure controls and procedures define the steps to determine materiality

and disclose such a material cybersecurity incident.

In addition, we engage

an independent third-party provider in connection with our cybersecurity risk management program to monitor cybersecurity threats and

provide certain security measures.

We regularly engage with this provider to aid in the identification and remediation of potential threats.

The results are

regularly shared with our information technology committee comprised of our Vice President of Information Technology, our Information

Technology Manager, our President and our Chief Financial Officer (the “IT Steering Committee”) and the Audit Committee of

our Board as part of the committees’ involvement in managing and overseeing cybersecurity risks.

cybersecurity risk management program also includes processes to triage, assess the severity of, escalate, contain, investigate, and

remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

If a cybersecurity incident is determined to be a potentially material cybersecurity incident, our disclosure controls and procedures

define the steps to determine materiality and disclose such a material cybersecurity incident.

addition, we engage an independent third-party provider in connection with our cybersecurity risk management program to monitor cybersecurity

threats and provide certain security measures.

We regularly engage with this provider to aid in the identification and remediation of

potential threats.

This provider has qualifications that include Microsoft Certified:

Security, Compliance, and Identity Fundamentals, Certified Information

Systems Security Professional (CISSP), Certified Hacking Forensic Investigator, Certified Ethical Hacker (CEH) and Security+.

While we believe that our

business strategy, results of operations or financial condition have not been materially adversely affected by any cybersecurity incidents,

cybersecurity threats are pervasive and, similar to other institutions, we, as well as our employees, customers, regulators, service providers,

and other third parties have experienced a significant increase in information security and cybersecurity risk in recent years and will

likely continue to be the potential target of cyber attacks.

We continue to assess the risks and changes in the cyber environment and

invest in enhancements to our cybersecurity capabilities as deemed necessary to promote advancements in our cybersecurity capabilities.

Cybersecurity Governance

Our cybersecurity risk management

program is overseen by the Audit Committee and led by the IT Steering Committee.

Our Audit Committee is responsible in overseeing risks

from cybersecurity threats, and has the authority to regularly review the adequacy of our cybersecurity, information and technology security,

and data privacy programs, procedures, and policies.

Our IT Steering Committee, led by the Vice President of Information Technology,

is primarily responsible for monitoring, assessing, and managing material risks from cybersecurity threats.

The Audit Committee regularly

receives updates from the IT Steering Committee / management with respect to our efforts to manage data protection, cybersecurity, and

information and technology risks, and assesses the results of reviews from internal audits.

Materials presented to our Audit Committee

by our IT Steering Committee include updates on our data security posture, results from internal audit and third-party assessments, our

incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken

to respond to such risks.

The Audit Committee / IT Steering Committee also regularly engages with management on technology risk-related

Our processes also allow for our Board and the

Audit Committee to be informed of key cybersecurity risks outside the regular reporting schedule.

While the Audit Committee meets periodically,

the Audit Committee is authorized to meet with management or individual directors at any time it deems appropriate to discuss matters

relevant to the committee.

Our policy is for the Board and the Audit Committee to receive prompt and timely information regarding any

cybersecurity risk (including any incident) that meets reporting thresholds, as well as ongoing updates regarding any such risk.

Security, Compliance, and Identity Fundamentals,

Certified Information Systems Security Professional (CISSP), Certified Hacking Forensic Investigator, Certified Ethical Hacker (CEH)

and Security+.

we believe that our business strategy, results of operations or financial condition have not been materially adversely affected by any

cybersecurity incidents, cybersecurity threats are pervasive and, similar to other institutions, we, as well as our employees, customers,

regulators, service providers, and other third parties have experienced a significant increase in information security and cybersecurity

risk in recent years and will likely continue to be the potential target of cyber-attacks.

We continue to assess the risks and changes

in the cyber environment and invest in enhancements to our cybersecurity capabilities as deemed necessary to promote advancements in

our cybersecurity capabilities.

Cybersecurity

cybersecurity risk management program is overseen by the Audit Committee and led by the IT Steering Committee.

Our Audit Committee is

responsible for overseeing risks from cybersecurity threats and has the authority to regularly review the adequacy of our cybersecurity,

information and technology security, and data privacy programs, procedures, and policies.

Our IT Steering Committee, led by the Vice

President of Information Technology, is primarily responsible for monitoring, assessing, and managing material risks from cybersecurity

Audit Committee regularly receives updates from the IT Steering Committee / management with respect to our efforts to manage data protection,

cybersecurity, and information and technology risks, and assesses the results of reviews from internal audits.

Materials presented to

our Audit Committee by our IT Steering Committee include updates on our data security posture, results from internal audit and third-party

assessments, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management

has taken to respond to such risks.

The Audit Committee / IT Steering Committee also regularly engages in management on technology risk-related

processes also allow for our Board and the Audit Committee to be informed of key cybersecurity risks outside the regular reporting schedule.

While the Audit Committee meets periodically, the Audit Committee is authorized to meet with management or individual directors at any

time it deems appropriate to discuss matters relevant to the committee.

Our policy is for the Board and the Audit Committee to receive

prompt and timely information regarding any cybersecurity risk (including any incident) that meets reporting thresholds, as well as ongoing

updates regarding any such risk.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments