What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-06-29 compared with 2025-06-27 · 22 added, 49 removed, 6 unchanged (92% of the section changed)

1 unchanged sentence

CYBERSECURITY

maintains a cybersecurity program that aims to protect the confidentiality, integrity, and availability of data required by our business

to be stored, analyzed, transported, and/or processed.

We have implemented various internal and external controls and processes, including

internal risk assessment and policy implementation, to incorporate a risk-based cybersecurity framework to monitor and mitigate security

threats and other strategies to increase security for our information, facilities, and infrastructure.

maintains a risk-based cybersecurity program designed to protect the confidentiality, integrity, and availability of information systems

and data used in our operations.

The program includes technical, administrative, and organizational safeguards intended to identify,

assess, and mitigate cybersecurity risks.

Management and Strategy.

Mexco recognizes the risk that cybersecurity threats pose to our operations, and cybersecurity is an

important component of our overall risk management strategy.

Mexco’s cybersecurity team consists of our executive officers and

third-party cybersecurity personnel.

The third-party cybersecurity team, led by professionals with cybersecurity expertise across multiple

industries, takes a cross-functional approach to addressing these risks and engages in discussions with our executive management team

on an as-needed basis.

have implemented a monitoring and detection system to help promptly identify cybersecurity incidents.

We also require our employees to

receive annual cybersecurity awareness training.

We perform cybersecurity tabletop exercises to test the effectiveness of our incidence

response plan (“IRP”) and implement post-incident “lessons learned” to enhance our response.

We provide our system

users with access consistent with the principle of least privilege, which requires that such users be given no more access than necessary

to complete their job functions.

We have programs in place to monitor our retained data with the goal of identifying personal identifiable

information and taking appropriate actions to secure the data.

have an IRP that delineates the procedures to be followed for handling a variety of cybersecurity incidents;

categorizes potential cybersecurity

incidents and the required timeframe for reporting each;

establishes cybersecurity incident response levels;

provides for investigations

designed to help us to meet applicable legal obligations, including possible notification requirements;

and outlines the roles and responsibilities

for various personnel in the event of a cybersecurity incident.

The Board, in coordination with the Audit Committee and Chief Financial Officer, is responsible for the oversight of risks from

cybersecurity threats.

The responsibilities of the Audit Committee include overseeing policies and management systems for cybersecurity

matters and reviewing Mexco’s strategy, objectives, and policies relative to cybersecurity.

In addition, the Board and the Audit

Committee receive regular presentations and reports on cybersecurity risks that address a range of topics, including developments, technological

trends or tools, third party updates, and regulatory standards.

Our IRP calls for prompt and timely direct notifications and updates

to the Board (or its committees) as necessary in connection with cybersecurity incidents deemed to have a moderate or higher business

impact, even if immaterial.

On a periodic basis, the Board and the Audit Committee discuss our approach to cybersecurity with our executive

officers and cybersecurity personnel.

plays a role in assessing and managing our material risks from cybersecurity threats through membership on our cybersecurity team, as

well as by making final materiality determinations and disclosures and other compliance decisions, as reflected in our IRP.

Cybersecurity risk is integrated into our overall risk management processes.

We use internal policies

and controls, supported by third-party cybersecurity professionals, to monitor and respond to cybersecurity threats.

We maintain systems

to detect and respond to potential cybersecurity incidents.

receive periodic cybersecurity awareness training.

We implement access controls based on the principle of least privilege.

We also conduct

periodic testing of our incident response capabilities, including tabletop exercises, and maintain an incident response plan that outlines

procedures for identifying, escalating, investigating, and responding to cybersecurity incidents.

The Board of Directors, through the Audit Committee, oversees cybersecurity risk.

Management is responsible for implementing

and maintaining cybersecurity controls and for day-to-day risk management activities.

The Board and Audit Committee receive periodic

updates on cybersecurity risks and are notified of material cybersecurity incidents in accordance with our incident response processes.

of Risks from Cybersecurity Threats.

As of the date of this Report, we are not aware of any previous cybersecurity threats that

have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations

or financial condition.

Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a

cybersecurity incident that could have a material adverse effect on us.

As of the date of this report, we are not aware of any cybersecurity threats that have materially

affected, or are reasonably likely to materially affect, the Company’s business, financial condition, or results of operations.

However, we may not be able to prevent all cybersecurity incidents, and future incidents could have a material adverse effect on the

more information on our cybersecurity-related risks, see “Item 1A.

1 unchanged sentence

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments