What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-01-23 compared with 2025-01-24 · 45 added, 32 removed, 60 unchanged (56% of the section changed)

13 unchanged sentences

firewall systems;

endpoint detection and response;

cloud service defenses;

Internet address and content

filtering monitoring software intended to secure against known malicious websites and potential data exfiltration;

and a variety

of cyber intelligence and threat monitoring sources, which provide ongoing updates, all provided by third parties that we

believe are capable of performing the service for which they have been engaged or governmental agencies.

When engaging a

third party for these types of services and resources, we typically conduct a security review involving, as relevant to the service

or resource, discussions with the firm’s security personnel, evaluation of auditor reports, and other requested information and

documentation.

and endpoint detection and response.

We also utilize cloud service defenses;

address and content filtering monitoring software intended to secure against known malicious websites and potential data

exfiltration;

and enterprise gateway security for workforce mobile devices and applications.

Additionally, a variety of cyber

intelligence and threat monitoring sources provide us with ongoing updates on potential or emerging risks.

For all these

measures we rely on third-party providers that we believe are capable of performing the service for which they have been

engaged or on certain governmental agencies.

Before we engage a third-party provider for these types of services and

resources, we typically conduct a security review involving, as relevant to the service or resource, discussions with the

provider’s security personnel, evaluation of auditor reports, and other requested information and documentation.

We evaluate, and adjust as determined appropriate, our cybersecurity strategies and measures based on the above-noted

30 unchanged sentences

systems misconfiguration, denial-of-service attacks, service provider error, mismanaged user access protocols, personnel action,

or otherwise, as we may be severely limited in conducting operations for an extended period, experience internal control

failures, be cut off from assets or funds, face reputational damage, lose customers and related revenues and/or have private

party or governmental legal proceedings instituted against us, and incur significant expenses to resolve any such issues.

impacts may result from a substantial disruption, or security incident or breach KBHS or an outside service provider to our

customers suffers, which could also result in sensitive personal information being publicly disclosed or misused.

or otherwise.

Depending on source or severity, among other factors, should any such compromise(s) occur, we may be severely

limited in conducting operations for an extended period, experience internal control failures, be cut off from assets or funds,

face reputational damage, lose customers and related revenues and/or have private party or governmental legal proceedings

instituted against us, and incur significant expenses to resolve any such issues.

Similar impacts may result from a substantial

disruption, or security incident or breach, suffered by KBHS or an outside service provider to our customers, which could also

result in sensitive personal information being publicly disclosed or misused.

Our management is responsible for the ongoing assessment of, and for developing and implementing our

4 unchanged sentences

engaging in periodic reviews with management covering, among other things, our cybersecurity practices and risks.

information officer (“CIO”) periodically provides this review to the audit and compliance committee, with the most recent

review conducted in January 2025.

The CIO, who has more than 34 years of experience in IT and cybersecurity, is supported

by a chief information security officer and various employees and dedicated contract personnel experienced with IT and

cybersecurity matters who are responsible for procuring, using, maintaining, updating and evaluating the cybersecurity

measures detailed above.

These individuals also hold numerous cloud, security and privacy certifications.

Our IT function, which is led by the CIO, maintains and is initially responsible for executing on a cybersecurity incident

response plan and specific runbooks, which describe processes for evaluating and escalating, depending on severity, within the

enterprise and up to our senior executive management and board of directors the cybersecurity threats and incidents, or potential

threats or incidents, identified through our cybersecurity measures, as well as making public disclosures thereof.

This team also

maintains other policies and procedures concerning cybersecurity matters, such as encryption standards, antivirus protection,

remote access, multifactor authentication, data classification, confidential information and the use of the internet, social media,

email and wireless devices.

We also maintain insurance coverage for cybersecurity insurance as part of our overall insurance

our directors have experience with overseeing cybersecurity practices and incident management.

Our chief information officer

(“CIO”) periodically provides this review to the audit and compliance committee, with the most recent review conducted in

January 2026.

The CIO, who has more than 35 years of experience in IT and cybersecurity, is supported by a chief information

security officer, who has more than 30 years of experience in IT and cybersecurity, and various employees and dedicated

contract personnel experienced with IT and cybersecurity matters who are responsible for procuring, using, maintaining,

updating and evaluating the cybersecurity measures detailed above.

These individuals also hold numerous cloud, security and

privacy certifications.

We have a cybersecurity incident response plan (“CIRP”) that, among other things.

defines roles and responsibilities,

outlines steps for managing a cybersecurity event that is assessed to be a cybersecurity incident, including determining whether

such an incident is material and required to be publicly disclosed per SEC rules, and specifies internal and external

communication channels with respect to a cybersecurity incident.

Our IT function, which is led by the CIO, maintains and is

initially responsible for executing on our CIRP and specific runbooks, which describe processes for evaluating and escalating,

depending on severity, within the enterprise and up to our senior executive management and board of directors the

cybersecurity threats and incidents, or potential threats or incidents, identified through our cybersecurity measures.

also maintains other policies and procedures concerning cybersecurity matters, such as encryption standards, antivirus

protection, remote access, multifactor authentication, data classification, confidential information and the use of the internet,

social media, email and wireless devices.

We also maintain insurance coverage for cybersecurity insurance as part of our

overall insurance portfolio.

Our IT systems have faced a variety of phishing, denial-of-service and other attacks.

7 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments