5 unchanged sentences
We maintain a cybersecurity incident response plan to help enable timely, consistent responses to actual or attempted cybersecurity incidents impacting the Company.
−Removed: This plan provides guidance to address the overall coordination of our response to a cybersecurity crisis and plan for resources, actions, and decisions we may need to be prepared for;
−Removed: a communication plan for timely and accurate dissemination of evolving information to stakeholders during the crisis;
−Removed: and business continuity plans that document strategies and measures to enable core business activities to continue during a cybersecurity event.
−Removed: To support our cybersecurity incident response plan, we conduct exercises simulating cybersecurity incidents to educate and train our management on response capabilities and inform adjustments to our controls and response.
+Added: This plan provides guidance to address the coordination of our response to a cybersecurity crisis and plan for resources, actions, and decisions that we may need in response;
+Added: a communication plan for timely and accurate dissemination of evolving information to stakeholders;
+Added: and business continuity plans that document strategies and measures to enable core business activities to continue during a cybersecurity disruption.
+Added: To support our cybersecurity incident response plan, we conduct e xercises simulating cybersecurity incidents to educate and train our management on response capabilities and inform adjustments to our controls and response.
We have engaged third-party cybersecurity firms to advise on these exercises.
6 unchanged sentences
Further, after engagement, we periodically perform information security assessments of certain third-party service providers that we consider critical to our operations.
−Removed: In addition, in new or amended supplier contracts, we look to include provisions that require the suppliers to maintain an effective information
−Removed: security management program and to notify us in the event of a known or suspected cyber incident.
−Removed: For suppliers with required access to our data or systems, a cybersecurity risk assessment is performed to identify potential risk to Company systems or data.
+Added: In addition, in new or amended supplier contracts, we look to include provisions that require the suppliers to maintain an effective information security management program and to notify us in the event of a known or suspected cyber incident.
+Added: For suppliers with required access to our data or systems, a cybersecurity risk assessment is performed to identify any potential risk to Company systems or data.
If risks are identified, we implement measures to mitigate or remediate the risk and, in cases where we cannot do so effectively, we will not grant access to our data or systems to the supplier.
4 unchanged sentences
See “Item 1A.
−Removed: Risk Factors – Technology Risks” of this Form 10-K for additional discussion of cybersecurity risks and potential related impacts on the Company.
+Added: Risk Factors – Cybersecurity and Technology Risks” of this Form 10-K for additional discussion of cybersecurity risks and potential related impacts on the Company.
Corporate Governance
2 unchanged sentences
The Board is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board on its activities on a quarterly basis or more frequently as warranted.
−Removed: Our cybersecurity program is managed by our interim Chief Information Security Officer (“CISO”), who reports to our Chief Information Officer (“CIO”) .
+Added: Our cybersecurity program is managed by our Chief Information Security Officer (“CISO”), who reports to our Chief Strategy and Technology Officer (“CTO”) .
Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the Company’s information security team, many of whom hold cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager, and through the use of technological tools and software and results from third-party audits.
Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk.
−Removed: Our CISO has served in this position since March 2025 and has over 20 years of experience in information security.
−Removed: His background includes technical experience, strategy and architecture focused roles, governance, risk, and compliance roles, secure application development and implementation roles, cyber and threat experience, and various leadership roles in several areas of information technology.
−Removed: Our CIO joined the Company in May 2025 with 35 years of experience in information technology roles, including implementing new information security teams on a global scale and overseeing information technology teams in multiple industries, including wholesale distribution, retail, manufacturing, finance, and information technology services, leading new global software development, and establishing global information security standards for his previous company.
−Removed: Our CISO and CIO regularly update the Audit Committee on the Company's cybersecurity programs, policies, and practices as warranted, including review of the state of the Company's cybersecurity programs and risks, emerging cybersecurity developments, threats and vulnerability, and the Company's strategy and key cybersecurity initiatives designed to improve the Company’s risk posture.
+Added: Our CISO has served in this position since May 2026 and has over 35 years of experience in information technology and security.
+Added: His experience spans technical roles, strategy and architecture-focused roles, governance, risk, and compliance roles, application security and development, manufacturing technology and implementation roles, cyber threat intelligence and incident response experience, and various leadership roles across several areas of information technology.
+Added: Our CTO joined the Company in May 2026 with deep expertise across strategy, analytics, operational transformation and technology in the consumer packaged goods industry, including an aggregate of ten years of experience overseeing cybersecurity for his previous companies.
+Added: He holds a bachelor’s degree in computer science.
+Added: Our CISO and CTO regularly update the Audit Committee on the Company's cybersecurity programs, policies, and practices as warranted, including review of the state of the Company's cybersecurity programs and risks, emerging cybersecurity developments, threats and vulnerability, and the Company's strategy and key cybersecurity initiatives designed to improve the Company’s risk posture.
In addition, we have an escalation process in place to inform senior management and the Board of material cyber-related issues.
−Removed: The Audit Committee also reviews with our CIO, on an annual basis, our global information technology structure and strategic efforts to protect, optimize, and support the growth of the Company.
+Added: The Audit Committee also reviews with our CTO, on an annual basis, our global information technology structure and strategic efforts to protect, optimize, and support the growth of the Company.
The Chair of the Audit Committee reports to the full Board on its activities.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.