What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-26 compared with 2025-03-31 · 78 added, 33 removed, 4 unchanged (97% of the section changed)

2 unchanged sentences

Cybersecurity

recognize the critical importance of maintaining the safety and security of our systems and data and have a process for overseeing and

managing cybersecurity and related risks.

This process is supported by both management, as well as our Board of Directors and our Science

and Technology Committee.

The current chair of our Science and Technology Committee is a National Association of Corporate Directors

(“NACD”) certified cybersecurity expert.

Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees

assists the Board in the role of risk oversight .

The full Board receives an update on the Company’s risk management process and

the risk trends related to cybersecurity at least annually .

Science and Technology Committee specifically assists the Board in its oversight of risks related to cybersecurity.

To help ensure effective

oversight, the Science and Technology Committee receives reports on information security and cybersecurity from the Company’s information

technology managers at least four times a year .

approach to cybersecurity risk management includes the following key elements:

Multi-Layered

Defense and Continuous Monitoring – We work to protect our computing environments and products from cybersecurity threats

through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks.

We utilize data analytics to detect anomalies and search for cyber threats.

We engage third-party consultants or other advisors to

assist in assessing, identifying and/or managing cybersecurity threats.

Risk Assessments – We conduct information security assessments before sharing or allowing the hosting of sensitive data

in computing environments managed by third parties.

and Awareness – We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats.

Our employees with network access participate periodically in required training, including phishing, spear phishing and other security

and awareness training.

Engagement – We review critical third-party systems at least annually, including the various System and Organizational

Controls (“SOC”) reports or perform risk assessments.

we have experienced cybersecurity incidents in the past, to date none have materially affected the Company or our financial

position, results of operations and/or cash flows.

We continue to invest in the cybersecurity and resiliency of our networks and to enhance

our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.

For more information regarding the risks we face from cybersecurity threats, please see Item 1A.

recognize the critical importance of maintaining the confidentiality, integrity, and availability of our systems, products, and data.

Our cybersecurity risk management program is designed to identify, assess, and manage material risks arising from cybersecurity threats

across our U.S.

and international operations, including third-party service providers and suppliers.

The program integrates governance,

technical and administrative controls, incident response, training and awareness, and continuous improvement practices that are tailored

to our risk profile as a medical device, aerospace & defense, and industrial EMS provider.

Identification and Assessment.

employ a risk-based approach to identify and assess cybersecurity threats, including threat-intelligence monitoring, vulnerability management,

security logging and analytics, and periodic security testing (e.g., penetration tests and tabletop exercises).

Cybersecurity risks are

recorded in our enterprise risk register with likelihood and impact scoring and are prioritized for remediation based on potential operational,

financial, regulatory, and reputational effects.

We maintain an incident response plan that defines triage, escalation, containment,

recovery, and post-incident review activities.

During incident response, management, including representatives from information technology,

legal, and executive leadership, evaluates cybersecurity incidents to determine whether an event is reasonably likely to have a material

impact on our business, strategy, financial condition, or results of operations, which informs disclosure decisions under applicable

SEC requirements.

with Strategy, Operations, and Capital Allocation.

Cybersecurity

risk considerations are incorporated into strategic planning, new program launches, capital allocation, and supplier selection.

cybersecurity controls in connection with our quality systems and regulatory commitments (including FDA QMSR/ISO 13485 and AS9100), our

participation in defense supply chains, and customer expectations for secure manufacturing and data handling.

We maintain cybersecurity

insurance coverage and periodically reassess limits and retentions in light of market conditions and our evolving risk posture.

and Supplier Risk Management.

assess cybersecurity risks associated with third-party service providers and critical suppliers through security questionnaires, contractual

requirements, and reviews of independent assurance reports (e.g., SOC reports) where available.

Data sharing with vendors and cloud platforms

is limited to business need, and we require appropriate controls, including access restrictions, encryption, and incident notification

We periodically reassess third-party risks and adjust controls as necessary .

and Awareness.

with network access participate in periodic training and simulated phishing exercises.

Role-based training is provided to personnel with

elevated privileges or access to sensitive data.

Awareness materials are refreshed to reflect current threat trends.

and Oversight.

Board of Directors oversees enterprise risk management, including cybersecurity risk.

The Audit Committee assists the Board in its oversight

of cybersecurity matters and receives cybersecurity updates from management at least quarterly, including updates on the Company’s

cybersecurity risk posture, program initiatives, and significant cybersecurity incidents, if any.

The full Board receives periodic briefings

on cybersecurity risk management.

cybersecurity program is led by the Vice President of Information Technology, who is responsible for day-to-day cybersecurity risk

management activities, including policy governance, control implementation, security monitoring, incident response, and vendor risk

management, and reports to Chief Executive Officer.

The individual responsible for leading the cybersecurity program has over

10 years of experience in information technology, cybersecurity, and risk management, including experience in regulated

manufacturing and defense supply chains, and holds relevant professional certifications.

Cross-functional

leaders from Operations, Quality/Regulatory, Supply Chain, and Legal participate in cybersecurity governance and incident response activities.

Incidents and Program Improvements.

many companies, we have experienced cybersecurity incidents in the past.

To date, none have had a material impact on our business, financial

condition, or results of operations.

Lessons learned from past events have informed enhancements to controls, user awareness, logging

and monitoring, and incident response processes.

Supply Chain and CMMC Compliance.

participate in the U.S.

Department of Defense (“DoD”) supply chain, including handling Federal Contract Information and,

for certain programs, Controlled Unclassified Information (CUI).

On October 23, 2025, we obtained a Cybersecurity Maturity Model Certification

(“CMMC”) Level 2 certification via an authorized C3PAO, applicable to the systems within our assessed boundary that process

Beginning November 10, 2025, DoD CMMC rule phases in requirements for Level 1 or Level 2 compliance in solicitations, with increasing

reliance on third-party assessments over a staged rollout.

We maintain the technical and procedural controls necessary for Level 2 and

manage ongoing compliance through evidence maintenance, annual affirmations, and timely updates to the Supplier Performance Risk System,

as applicable.

Non-compliance could limit our eligibility for certain defense contracts;

therefore, we monitor and remediate any issues

promptly, including through Plans of Action and Milestones where permitted.

and Other Regulatory Linkages.

locations supporting defense customers operate in an ITAR-compliant manner.

Our cybersecurity controls, including access control,

network segmentation, encryption, and data-loss prevention, among others, support our ITAR compliance program and align with our quality

systems for regulated manufacturing.

more information regarding the risks we face from cybersecurity threats, please see Item 1A.

“Risk Factors.”

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments