Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
Not applicable.
Item 1C. Cybersecurity
The Company recognizes the increasing complexity and significance of cybersecurity risks in safeguarding its technology, operations, proprietary systems, and data. The Company’s operations rely on interconnected digital infrastructure, cloud-based systems, and proprietary software platforms, making cybersecurity an essential component of its risk management framework.
The Company has implemented a cybersecurity program designed to identify, assess, mitigate, and respond to cybersecurity risks. This program is informed by recognized industry practices, including the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”). The following disclosure outlines the Company’s cybersecurity risk management strategy and governance, including the Board’s oversight and management’s role.
1. Cybersecurity Risk Management (Risk Management and Strategy)
The Company employs a structured cybersecurity risk management program to assess, identify, and manage cybersecurity risks across its information technology environment, including corporate systems and cloud-based platforms. Key elements of the program includes:
• Risk assessments and periodic evaluation of cybersecurity risks across systems and environments.
• Threat detection and monitoring, including alert triage and investigation, to identify suspicious activity and potential incidents.
• Vulnerability management, including scanning, prioritization, and remediation activities.
• Access controls and security protections, including multi-factor authentication, encryption protocols, and endpoint security measures where appropriate.
• Third-party risk management, including evaluation of vendors and service providers that may access Company data or systems
Cybersecurity risks are evaluated in coordination with management and are considered within the Company’s broader operational and enterprise risk considerations.
2. Governance and Oversight (Board Oversight and Management’s Role)
Cybersecurity oversight is a shared responsibility between the Company’s Board of Directors and management. The Vice President, Intelligent Platform App provides cybersecurity updates to the full Board on a biannual basis, including information regarding the Company’s cybersecurity posture, risk environment, incident trends, and mitigation efforts.
In addition to scheduled updates, management’s incident response procedures require that potential material cybersecurity incidents are escalated to senior leadership and the Board promptly, as appropriate
80
Table of Contents
The Company enforces a top-down approach to cybersecurity governance, ensuring accountability and continuous risk monitoring at all levels of the organization.
3. Management’s Role in Cybersecurity
Management is responsible for the day-to-day execution of the Company’s cybersecurity program. The Vice President, Intelligent Platform App oversees cybersecurity initiatives and supervises cybersecurity personnel and processes.
The Network and Information Security Engineer monitors threats, investigates alerts, and reports identified incidents to the IT Vice President through established escalation procedures.
The Company’s cybersecurity incident response governance is supported by an Incident Response Policy that defines roles and responsibilities, incident classification, documentation expectations, evidence preservation requirements, and communication protocols.
4. Cybersecurity Strategy and Resilience
The Company maintains cybersecurity resilience measures designed to support business continuity and protect critical assets. These measures include monitoring and response capabilities, as well as processes for containment, remediation, and recovery when incidents occur.
5. Material Cybersecurity Incidents
During fiscal year 2025, the Company did not experience any material cybersecurity incidents. No cybersecurity incidents required disclosure under Form 8-K Item 1.05 during 2025.
6. Impact of Cyber Incidents
Cybersecurity incidents, if material, could adversely affect the Company’s financial condition, results of operations, operational stability, and reputation. Potential impacts may include remediation costs, operational disruptions, litigation or regulatory exposure, and reputational harm. The Company evaluates cybersecurity risks as part of its ongoing risk assessment processes.
7. Board Expertise in Cybersecurity
The Board’s cybersecurity oversight is informed through management briefings and periodic updates. The Company may enhance Board education on cybersecurity trends and governance practices as appropriate.
8. Use of Third-Party Services (Third-Party Risk)
The Company uses third-party service providers to support certain technology and security functions. The Company evaluates third-party cybersecurity risks through vendor due diligence processes, including review of security documentation and reports where applicable, and monitors third-party risks on an ongoing basis.
9. Regulatory and Legal Compliance Risks
The Company is subject to cybersecurity and data privacy requirements, including applicable data privacy laws and SEC disclosure requirements. Failure to comply with applicable requirements could result in financial penalties, legal liabilities, and reputational harm. The Company performs compliance-focused activities as part of its cybersecurity program.
10. Incident Response Plan
The Company maintains an incident response policy framework intended to support timely identification, containment, investigation, remediation, and recovery. Incident response procedures include incident severity classification, escalation, documentation, evidence preservation, and communications protocols.
11. Cyber Insurance
The Company does not maintain standalone cybersecurity insurance coverage. The Company evaluates risk mitigation and risk transfer options as part of its broader risk management considerations.
12. Historical Cyber Incidents
81
Table of Contents
The Company did not record any material cybersecurity incidents during fiscal year 2025.
13. Technology and Infrastructure Risks
The Company’s cybersecurity program includes measures intended to protect systems and data, including monitoring, endpoint protections, access controls, and vulnerability management. As cybersecurity threats continue to evolve, the Company may adjust its cybersecurity tools, processes, and controls over time.
14. Data Security and Privacy Policies
The Company maintains policies and controls intended to protect sensitive data, including access controls and other security measures designed to safeguard data confidentiality and integrity.
15. Ongoing Cybersecurity Efforts
The Company continues to invest in cybersecurity capabilities, including monitoring, vulnerability management, employee awareness training, and improvements to policies and procedures, to address evolving cybersecurity threats.