3 unchanged sentences
Our Cybersecurity program and processes are based upon the International Standards Organization (“ISO”) guidance on information security.
−Removed: The Company’s processes used to identify, assess, and mitigate cybersecurity risks are integrated into the Company’s broader risk management system and processes, including through the risk management activities of the Board and its Audit Committee, our Enterprise Risk Management Committee (“ERM Committee”), and our internal audit and information technology functions.
+Added: The Company’s processes used to identify, assess, and mitigate cybersecurity risks are integrated into the Company’s broader risk management system and processes, including through the risk management activities of the Board and its Audit Committee, our Enterprise Risk Management Committee (“ERM Committee”), and our internal audit and
+Added: December 31, 2025 | 43
+Added: information technology functions.
Refer to Part I, Item 1A, “Risk Factors— We are subject to cybersecurity risks and may experience cyber incidents resulting in disruption or harm to our businesses ” of this Report for further discussion of our processes for managing cybersecurity risks.
13 unchanged sentences
At the management level, the Company’s cybersecurity risk management activities are led by our Chief Executive Officer and his executive team and is integrated into the day-to-day activities of the Company’s information technology function led by our Chief Information Officer, who operates under the supervision of our Chief Financial Officer, and reports regularly to the Audit Committee on cybersecurity risks, typically on a quarterly basis.
−Removed: The Company’s information technology function has a dedicated cybersecurity team comprised of employees with, on average, nearly 20 years of experience and expertise in cybersecurity, and includes individuals with degrees in Computer Studies and cybersecurity-related certifications including
−Removed: December 31, 2024 | 46
−Removed: Certified Information Systems Security Specialist (CISSP), Certified in Risk and Information Systems Controls (CRISC), and Certified Information Security Manager (CISM).
+Added: The Company’s information technology function has a dedicated cybersecurity team comprised of employees with, on average, nearly 20 years of experience and expertise in cybersecurity, and includes individuals with degrees in Computer Studies and cybersecurity-related certifications including Certified Information Systems Security Specialist (CISSP), Certified in Risk and Information Systems Controls (CRISC), and Certified Information Security Manager (CISM).
Management utilizes certain tools and controls to detect, monitor, prevent, mitigate, and remediate cybersecurity threats to our systems, networks, applications, and data.
3 unchanged sentences
Management also monitors AI usage and has implemented a framework that tracks use and is governed by the Company’s Artificial Intelligence Policy, which was most recently updated in 2024, and includes a review and approval process for adopting use of AI tools.
−Removed: Such governance activities are designed to mitigate the risks presented by AI.
−Removed: Lastly, management maintains information security incident response processes to guide response and mitigate impact in the event of a cybersecurity incident.
+Added: Such governance activities are intended to mitigate the risks presented by AI.
+Added: Management also maintains information security incident response processes to guide response and mitigate impact in the event of a cybersecurity incident.
A third-party cybersecurity service provider is on retainer to assist the Company should a cybersecurity incident occur.
2 unchanged sentences
The information technology function maintains processes to oversee and identify cyber risks associated with the Company’s use of third-party service providers who may have access to sensitive Company data and systems.
+Added: December 31, 2025 | 44
Material Impact on Company
−Removed: During 2024 , the Company did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company , including its business strategy, results of operations, or financial condition.
+Added: As of February 18, 2026 , the Company has not ex perienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company , including its business strategy, results of operations, or financial condition.
Refer to Part I, Item 1, “Petroleum”, “Renewables”, and “Nitrogen Fertilizer” of this Report for more information on our core business properties.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.