What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-02-13 compared with 2025-02-20 · 28 added, 28 removed, 23 unchanged (71% of the section changed)

16 unchanged sentences

The CIS18 framework provides us the ability to align measurable controls to actions and benchmark against recognized standards.

Using these recognized industry standards, we approach cyber risk management utilizing multiple layers of policies and technology to detect, protect against, and respond to cyberattacks.

Following our multi-pronged approach to protecting our systems and data, we:

• administer monthly mandatory ongoing information security training for all employees throughout the year;

• maintain security protocols and internal security controls;

• maintain a privacy policy that governs our collection, processing, and securing of personal information;

• limit collection and storage of information regarding our customers, suppliers and employees;

• use a zero trust network that verifies the device and user identity while restricting network access to only what is needed;

• limit access to network resources to only devices that are owned and administered by the Company;

• require multi-factor authentication for all employee user accounts;

• maintain application-aware firewalls to limit cyberattack access to data;

• use data breach detection software and a cybersecurity operations center that actively monitors our systems;

• conduct internal technical cyber incident exercises with our information security team and our third-party cybersecurity service providers;

• conduct an annual independent comprehensive security assessment, including penetration and vulnerability testing along with ransomware simulation, to evaluate the security of our environment and provide us the opportunity to understand and address identified deficiencies in our security program.

We review all technology third party vendors and service providers for the following:

access management controls including physical safeguards, disaster recovery capabilities, data privacy and notification processes, onboarding processes, and incident response procedures.

In addition, we perform periodic independent testing of vendor capabilities and review the annual System and Organization Controls ("SOC") Type 1 and/or SOC II Type 2 reports of all of our third-party vendors hosting our data to ensure they conform to those requirements.

Our IT department, lead by our Chief Information Officer ("CIO") , maintains and is responsible for our cybersecurity incident response plans.

Our cybersecurity incident response plans include processes for evaluating and escalating our response to cybersecurity incidents across our organization, up to and including our senior executive management and Board, and, where required, making public disclosures.

Cybersecurity threats and incidents (including potential cybersecurity threats and incidents) are identified through our cybersecurity detection, prevention, and mitigation tools and procedures.

These plans are reviewed and updated at least annually and we maintain third-party cybersecur ity insurance.

We have not identified any material cybersecurity incidents during the fiscal years covered by this report.

For a discussion of how risks from cybersecurity threats affect our business, see Part I, Item 1A - " Risk Factors – Operational Risks – Information technology failures and data security breaches could harm our business” in this Annual Report on Form 10-K.

Building on this framework, we have implemented processes to assess, identify, and manage risks from cybersecurity threats across the following domains:

• Identity & Access Controls:

we enforce Zero Trust through Conditional Access, multi‑factor authentication, and apply least privilege principles through periodic entitlement reviews to ensure only authorized users and compliant devices can access company resources.

• Network & Device Security:

we restrict network access to Company‑owned or managed devices and apply network segmentation and application‑aware firewalls to limit exposure and lateral movement.

• Threat Detection & Monitoring:

we use real‑time detection tools, centralized logging, correlated telemetry, and a security operations center with integrated threat intelligence to identify and mitigate malicious activity.

• Email & Endpoint Security:

we maintain layered email defenses and enforce endpoint security baselines including real‑time threat protection and behavioral detection to reduce phishing, malware, and ransomware risks.

• Vulnerability Management & Testing:

we conduct continuous vulnerability scanning and annual independent evaluations, including penetration tests and assumed‑breach exercises.

• Data Protection, Privacy & Resilience:

we maintain a privacy policy that limits the collection and storage of personal information, apply encryption and other privacy controls, and safeguard systems and data through comprehensive, immutable, and regularly tested backups of identity platforms, critical systems, and operational data.

• Incident Response & Escalation:

we maintain documented incident‑response plans that are updated annually, conduct periodic cyber incident exercises, and follow defined escalation paths to senior leadership and the Board.

• Training & Human Risk Management:

we provide mandatory cybersecurity education, conduct phishing simulation at least monthly, reinforce secure employee behaviors, and maintain channels for reporting suspicious activity.

• Program Governance & Continuous Improvement:

we regularly update and enhance our cybersecurity program to address evolving threats, align with recognized frameworks, and maintain third‑party cybersecurity insurance to mitigate potential financial impacts of cyber incidents.

• Vendor Management:

we review technology vendors for appropriate access controls, data protection, incident response capabilities, and disaster recovery.

We also perform independent testing and review the annual System and Organization Controls ("SOC") Type 1 and/or SOC II Type 2 reports for vendors that host company data.

To date, we have not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition .

Cybersecurity and data privacy risks related to our information technology resources are a key component of our Board's risk oversight.

1 unchanged sentence

Our Audit Committee is also responsible for reviewing and analyzing significant financial and operational risks and how management is managing and mitigating such risks through its internal controls and financial risk management processes and is regularly engaged in discussions with management regarding business risks, operational risks, transactional risks, cybersecurity, enterprise-level and financial risks.

Our CIO provides a formal update to our Audit Committee at least twice per year, reviewing cybersecurity risks, trends, plans for future actions and measurements against recognized external cybersecurity frameworks and benchmarks and our Vice President of Internal Audit/Compliance conducts an annual ERM survey, which includes cybersecurity risk, and provides the findings to the Board.

Our cybersecurity program is led and managed by experienced technology leadership that drives the creation of our cybersecurity and data privacy strategy, policies, and procedures and consists of experts in the execution of the related controls and safeguards.

Our Chief Information Officer ("CIO") provides a formal update to our Audit Committee at least twice per year, reviewing cybersecurity risks, trends, plans for future actions and measurements against recognized external cybersecurity frameworks and benchmarks and our Vice President of Internal Audit/Compliance conducts an annual ERM survey, which includes cybersecurity risk, and provides the findings to the Board.

Our cybersecurity program is led and managed by our CIO and driven by an experienced technology leadership team.

Our CIO has more than 30 years of experience working in information technology including chief information officer roles in the financial services, banking, healthcare, and hospitality sectors.

While in those roles, the CIO has led governance, risk, and compliance technology programs and information security programs.

Supporting the CIO is a dedicated cybersecurity team that designs and monitors cybersecurity control framework and data privacy procedures, as well as implements cybersecurity control systems and solutions.

This cybersecurity team collectively has experience in:

cybersecurity, information systems management and security, and related fields of focus.

While in those roles, our CIO has led governance, risk, and compliance with technology programs and information security programs.

Supporting the CIO is a dedicated cybersecurity team that designs and monitors cybersecurity control frameworks and data privacy procedures, as well as implements cybersecurity control systems and solutions.

Our corporate office is in a leased building located in Scottsdale, Arizona with approximately 72,000 square feet and a September 30, 2035 lease expiration.

1 unchanged sentence

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments