What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-30 compared with 2025-03-24 · 33 added, 28 removed, 5 unchanged (92% of the section changed)

2 unchanged sentences

RISK MANAGEMENT AND STRATEGY

We have developed an information security program that is designed to address material risks from cybersecurity threats.

Our information security program is integrated into our overall enterprise risk management process, which the Board ultimately oversees.

The Board has delegated its responsibility for cybersecurity risk oversight to the Technology Committee of the Board, which is responsible for (i) regularly reviewing with management significant cybersecurity, privacy, artificial intelligence, and IT risks or exposures, and our policies and processes with respect to risk assessment and risk management of the same;

(ii) regularly reviewing with management an assessment of the steps management has taken to monitor and control such risks;

and (iii) regularly reporting to the full Board on such matters.

As described in further detail below, our information security program is led by our Director of IT Security & Compliance ("DITSC") , who is responsible for our overall information security strategy, policy, security engineering, operations, and cyber threat detection and response.

The program includes policies and procedures that guide our implementation and maintenance of security measures and controls.

Risk-based analysis and judgment of the DITSC and our management team, along with feedback from internal and third-party audits and assessments, are used to select security controls to address risks.

The following factors, among others, are considered when identifying security controls:

likelihood and severity of a risk, impact on the Company and others if a risk materializes, feasibility of controls, and impact of controls on operations and others.

Third parties also play a role in our cybersecurity, as we engage security firms in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services.

For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing.

We use a variety of processes to address and oversee cybersecurity threats related to the use of third-party technology and services, including a vendor risk management program.

We have a written incident response plan and conduct tabletop exercises to enhance incident response preparedness.

We have other response protocols to address operating impacts due to disruptions in services and technology, including scenario run books and mitigation plans for key vendors.

Employees undergo security awareness training when hired and annually.

The DITSC is the Company's management position with primary responsibility for the development, operation, and maintenance of our information security program.

The DITSC offers over 20 years in cybersecurity expertise, cultivated through service in the United States Air Force and subsequent roles in both public and private sectors across diverse industries.

The DITSC has obtained multiple industry specific certifications, including the Certified Information Systems Security Professional and Certified Information Security Manager.

The DITSC briefs the Technology Committee of the Board regularly and oversees regular cybersecurity training and education opportunities for the Board, which covers topics ranging from the current threat landscape to our cybersecurity program metrics, risks, and roadmap.

Management receives regular updates on cybersecurity risks from the DITSC.

In the event of a security incident, the DITSC will follow the escalation process in our incident response plan to notify the Company's Crisis Committee, which is composed of a cross-functional group of Company leaders.

The Crisis Committee will work with the DITSC to respond to and remediate any actual cybersecurity incidents.

Depending on the severity of the security incident, the DITSC and the Crisis Committee are to escalate the security incident to the Company's General Counsel and the Principal Accounting Officer, who will assess materiality in consultation with outside counsel.

The General Counsel will notify the Technology Committee and the Board of any potential material incident.

We have implemented and continue to maintain a comprehensive information security program designed to identify, assess, and manage material risks from cybersecurity threats.

This program is integrated into our overall enterprise risk management process, ensuring that cybersecurity considerations are incorporated into the Company’s broader strategic planning and risk oversight.

The Board maintains ultimate oversight of the Company's risk management strategy.

The Board has delegated primary responsibility for the oversight of cybersecurity risks to the Technology Committee of the Board ("Technology Committee"), which is responsible for:

(i) regularly reviewing with executive management significant cybersecurity, privacy, artificial intelligence, and IT risks, as well as our policies and processes for risk assessment;

(ii) overseeing the steps management has taken to monitor and control such risks;

and (iii) regularly reporting its findings to the full Board.

Our information security program is operationally led by the Director of Information Security, who is responsible for the day-to-day execution of our information security strategy, security engineering, operations, and cyber threat detection.

The program utilizes a defense-in-depth approach, employing policies and procedures to guide the implementation and maintenance of security measures.

We utilize a risk-based methodology to select and implement security controls, relying on the analysis and judgment of the Director of Information Security and executive management, supplemented by feedback from internal and third-party audits.

When identifying security controls, we consider factors such as the likelihood and severity of a risk, the potential impact on the Company and its stakeholders, the feasibility of controls, and the impact on business operations.

We recognize that cybersecurity risks extend to our service providers.

We maintain a vendor risk management program to oversee risks related to the use of third-party technology and services, including cloud-based platforms.

We engage third-party security firms to assist in the operation of specific controls and to conduct independent assessments, such as vulnerability scans and penetration testing.

To ensure preparedness, we maintain a written incident response plan and conduct tabletop exercises to test our response capabilities.

We also maintain distinct response protocols to address operational impacts caused by service disruptions, including scenario-specific runbooks and mitigation plans for critical vendors.

Employees are required to undergo security awareness training upon hiring and annually thereafter.

While the Board oversees the Company's risk strategy, the Company's executive management is responsible for the strategic assessment and management of cybersecurity risk.

The Director of Information Security serves as the operational lead for the development, maintenance, and enforcement of the information security program.

The Director of Information Security reports to executive management to ensure that cybersecurity risks are reviewed and evaluated.

The Director of Information Security possesses over 20 years of cybersecurity expertise, including service in the United States Air Force and subsequent roles in both the public and private sectors across diverse industries.

The Director holds multiple industry-recognized certifications, including the Certified Chief Information Security Officer (CCISO), Certified Information Systems Security Professional (CISSP), and Certified Information Security Manager (CISM).

The Director of Information Security briefs the Technology Committee regularly and facilitates cybersecurity training for the Board, covering the current threat landscape, program metrics, risks, and the security roadmap.

In the event of a security incident, the Director of Information Security is responsible for executing the technical response and notifying the Company’s Crisis Committee, a cross-functional group of senior Company leaders.

The Crisis Committee works with the Director of Information Security to coordinate the response and remediation efforts.

The authority to determine whether a cybersecurity incident is material resides with the Company’s executive management.

In the event of a potential material incident, the Director of Information Security and the Crisis Committee escalate the matter to the Company’s General Counsel and Principal Accounting Officer.

These executive officers, in consultation with outside counsel, are responsible for assessing the materiality of the incident.

The General Counsel is responsible for notifying the Technology Committee and the Board of any incident determined to be material.

As of the date of this report, the Company has not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

However, there can be no assurance that the Company, or third parties on which it relies, will not experience a cybersecurity threat or incident in the future, and we continue to closely monitor cyber risk.

We may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.

However, there can be no assurance that the Company, or third parties on which it relies, will not experience a cybersecurity threat or incident in the future.

We continue to monitor cyber risk closely;

however, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

While we maintain cybersecurity insurance, costs related to cybersecurity threats or disruptions may not be fully insured.

Risk factors for a discussion of cybersecurity risks.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments