1 unchanged sentence
CYBERSECURITY
−Removed: Our management team is responsible for identifying, assessing and managing the material risks facing Columbia, supported by an enterprise risk management program .
−Removed: This program includes an annual enterprise risk assessment, during which interviews are conducted with independent directors and members of senior management seeking participants' judgement and assessment of the material risks facing Columbia.
−Removed: The enterprise risk management program then monitors the risks identified and mitigation efforts underway through periodic meetings with senior management.
−Removed: Our enterprise risk management program addresses risks facing Columbia from cybersecurity threats impacting our internal systems and/or systems supported by third-party software providers.
−Removed: On January 6, 2025, Skip Potter, Executive Vice President, Chief Digital Information Officer, departed the Company.
−Removed: Jim Swanson, Executive Vice President and Chief Financial Officer, is overseeing the digital technology department at the Company in an interim capacity.
−Removed: Our Chief Information Security Officer ("CISO") reports to Mr.
−Removed: Swanson and is responsible for identifying, assessing and managing risks facing the Company from cybersecurity threats impacting our internal systems and/or systems supported by third-party providers.
−Removed: Our CISO has served in various information technology and information security roles for over 20 years, including management of information security programs in the Department of Defense, private and public companies, and holds multiple industry certifications in information security.
−Removed: We leverage certain third-party providers and our internal Incident Response Team to alert us when a cybersecurity event occurs.
+Added: Management's Role in Managing Risk
+Added: Our management team is responsible for identifying, assessing and managing the material risks facing the Company.
+Added: On January 6, 2025, the Company's Executive Vice President, Chief Digital Information Officer, departed the Company.
+Added: Jim Swanson, Executive Vice President and Chief Financial Officer, oversaw the digital technology department at the Company in an interim capacity until January 21, 2026 when the Company appointed a Senior Vice President, Chief Technology Officer ("CTO").
+Added: The CTO, together with our Chief Information Security Officer ("CISO"), are responsible for identifying, assessing and managing risks facing the Company from cybersecurity threats impacting our internal systems and/or systems supported by third-party providers.
+Added: Our CTO has served in various information technology roles for over 20 years, including the role of CTO at a private company and management of information technology programs of private and public companies.
+Added: Our CISO has served in various information technology and information security roles for over 20 years, including management of information security programs in the Department of Defense and private and public companies, and holds multiple industry certifications in information security.
+Added: We leverage certain third-party providers and our internal Incident Response Team to help alert us when a cybersecurity event occurs.
Cybersecurity events may include unauthorized access, attacks on our resources, compromised accounts, malware, or ransomware.
Upon alert of an event, we estimate the level of severity, create a response plan, and communicate to management as needed.
−Removed: Based on the estimated level of severity, timing of incident communication to management may range from immediate to quarterly.
−Removed: Our risk assessment process related to cybersecurity threats is subject to change in the future as threats may evolve over time.
−Removed: COLUMBIA SPORTSWEAR COMPANY | 2024 FORM 10-K | 17
−Removed: Our Information Security committee oversees this cybersecurity program and consists of senior management, including Mr.
+Added: Based on the estimated level of severity, timing of incident communication to management may vary in accordance with established escalation protocols.
+Added: Our cybersecurity risk assessment process is subject to change in the future as threats may evolve over time.
+Added: An Information Security committee oversees this cybersecurity program and consists of senior management, including Mr.
Swanson and our Chief Administrative Officer and General Counsel.
At least quarterly, this committee reviews updates regarding cybersecurity threats and incidents that have occurred.
−Removed: Periodically, this committee approves cybersecurity strategy and initiatives proposed by our CISO.
+Added: Periodically, this committee approves cybersecurity strategy and initiatives proposed by our CTO and CISO.
+Added: In 2025, we engaged an independent third party review of our cybersecurity program against the NIST Cybersecurity Framework 2.0 to provide an independent assessment and perspective measured against industry standards.
+Added: Additionally, we periodically engage independent third parties to perform audits of portions of our cybersecurity control environment based on risk.
+Added: Cybersecurity risks are also considered in the Company's enterprise risk management program.
+Added: Board Oversight
Our Board of Directors ("Board") generally oversees Columbia's risk management practices and processes.
−Removed: Annually, the Board reviews the results of the annual enterprise risk management program, including updates from our CISO related to cybersecurity matters.
−Removed: The Audit Committee also receives an update on the enterprise risk management program annually.
The Board has delegated primary oversight of the management of cybersecurity risk to the Audit Committee.
−Removed: The Audit Committee annually reviews the strategies, investments and risks related to Columbia's information technology systems, including a review of Columbia's cybersecurity programs, and also receives quarterly updates from our CISO.
+Added: The Audit Committee performs an annual deep dive on the strategies, investments and risks related to Columbia's information technology systems, including a review of Columbia's cybersecurity
+Added: COLUMBIA SPORTSWEAR COMPANY | 2025 FORM 10-K | 18
+Added: programs, and also receives quarterly updates from our CTO and CISO.
The Board is informed of cybersecurity events to the extent they may materially impact Columbia or management otherwise believes they should be escalated to the Board.
+Added: Risks from Cybersecurity Threats
+Added: In the three-year period ended December 31, 2025, we are not aware of any cybersecurity incidents that have had a material impact on our business.
+Added: There can be no assurance that we, or the third parties with which we interact, will not face a cybersecurity incident in the future that will materially affect us.
See Item 1A of this Annual Report on Form 10-K for more information of risks relating to cybersecurity, including the risk factors "We Rely on Information Technology Systems, including Third-Party Cloud-based Solutions, and Any Failure of These Systems or Interruption in Services Provided by the Systems May Result in Disruptions or Outages in Our E-Commerce and In-Store Retail Platforms, Loss of Processing Capabilities, and/or Loss of Data, Any of Which May Have a Material Adverse Effect on Our Financial Condition, Results of Operations or Cash Flow" and "A Security Breach of Our or Our Third Parties' Systems, Exposure of Personal or Confidential Information or Increased Government Regulation Relating to Handling of Personal Data, Could, Among Other Things, Disrupt Our Operations or Cause Us to Incur Substantial Costs or Negatively Affect Our Reputation".
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.