What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-04-18 compared with 2024-04-12 · 41 added, 14 removed, 5 unchanged (92% of the section changed)

2 unchanged sentences

Risk Management and Strategy

The Company's cybersecurity risk management program is integrated into the overall risk management framework, including risk identification, assessment, and mitigation across all business areas.

We have collaborated with external consultants and built a cybersecurity program designed to protect and safeguard the integrity of our information systems, which aligns with industry best practices and regulatory requirements.

To continually enhance the effectiveness of the practice, we regularly assess the program’s measures, contractual obligations, and compliance with industry standards.

Additionally, we maintain cyber insurance coverage, including protection against social engineering fraud, to further mitigate potential financial losses from cybersecurity incidents.

We have previously experienced actual or attempted cyber-attacks on our information systems or networks;

however, none of these incidents had a material impact on our operations or financial condition.

The Company’s cybersecurity risk management program

is integrated into the overall risk management framework, including risk identification, assessment, and mitigation across all business

We have collaborated with third-party consultants and built a cybersecurity program designed to protect and safeguard the integrity

of our information systems, which aligns with industry standards and regulatory requirements.

Key components of our cybersecurity risk

management and strategy include:

◾ Risk assessments, including vulnerability scans

and penetration testing to identify potential system weaknesses.

These are performed internally and supported by third-party consultants;

◾ Alignment of our cybersecurity framework with

industry standards;

◾ Employee training and awareness:

all employees

receive mandatory regular cybersecurity training, with additional specialized sessions for high-risk roles.

We also conduct simulated

phishing exercises to enhance awareness and preparedness;

◾ Continuous monitoring and threat detection:

IT security team uses advanced tools for real-time network and system monitoring, enabling rapid detection and response to potential threats;

◾ Comprehensive cyber insurance coverage, including

protection against social engineering fraud and other cyber incidents, to further mitigate potential financial losses.

We have previously experienced actual or attempted

cyber-attacks on our information systems or networks;

however, none of these incidents had a material impact on our operations or financial

For additional information on the impact of cyber risks, refer to Part I, Item 1A.

Risk Factors on page 12.

The board of directors oversees the Company’s practice for assessing, identifying and managing material risks from cybersecurity threats.

The Audit Committee, consisting of all of the board’s independent directors with one member holding the CERT Certificate in Cybersecurity Oversight, reviews and discusses with management and the independent auditor on the Company’s significant financial risk exposures for matters related to cybersecurity risk, including the steps management has taken to monitor and manage such exposures.

The Company’s Chief Information Officer leads the overall cybersecurity strategy and risk management program.

This includes overseeing risk assessments, developing security policies and procedures, and managing the IT security team.

Senior executives, including the Company’s CEO and CFO, integrate cybersecurity risks into the overall business strategy and financial planning.

The IT department executes daily security tasks such as vulnerability scanning, threat detection, and incident response.

The Chief Information Officer and IT security team provide regular reports to senior management on the Company’s cybersecurity posture, identified vulnerabilities, and ongoing incident management activities.

Management provides the Audit Committee with quarterly updates on the Company's cybersecurity practices.

The board of directors oversees the Company’s

practice for assessing, identifying and managing material risks from cybersecurity threats.

The Audit Committee, consisting of all of

the board’s independent directors, with one member holding the CERT Certificate in Cybersecurity Oversight, reviews and discusses

with management and the independent auditor on the Company’s significant financial risk exposures for matters related to cybersecurity

risk, including the steps management has taken to monitor and manage such exposures.

The Company’s VP of enterprise systems and

applications leads the overall cybersecurity strategy and risk management program.

This role oversees development and execution of risk

assessments, implementation of security policies and procedures, regular cybersecurity training for our employees, and leadership of the

IT security team and coordination with third-party consultants.

Senior executives, including the Company’s

CEO and CFO , integrate cybersecurity risks into the overall business strategy and financial planning.

The VP and IT security team provide

regular reports to senior management on the Company’s identified vulnerabilities, progress on cybersecurity initiatives and remediation

efforts, and details of ongoing incidents.

Management notifies the board of directors when significant incidents occur and provides the

Audit Committee with quarterly updates on the Company’s cybersecurity practices.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments