What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-08-25 compared with 2024-08-29 · 44 added, 24 removed, 5 unchanged (93% of the section changed)

2 unchanged sentences

Risk Management and Strategy

We maintain high standards with respect to cybersecurity, in accordance with regulatory guidelines, contractual requirements and industry practices.

Our cybersecurity strategy is aimed to anticipate, detect, and respond to threats, ensuring the resilience and integrity of our operations.

We use a risk management process, overseen by our Information Security Officer (“ISO”), that encompasses technical security controls, policy compliance mechanisms, monitoring systems, contractual agreements, and governance.

Our cybersecurity risk management process is integrated with our overall enterprise risk management process and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management process to other legal, compliance, strategic, operational and financial risk areas.

Key elements of our cybersecurity risk management program include a cybersecurity incident response plan with procedures for responding to cybersecurity incidents and annual data protection and cybersecurity awareness training of our employees who have access to information systems.

We have implemented security control principles that follow the National Institute of Standards and Technology (NIST) Cybersecurity Framework with the main goal of our cybersecurity risk management process being to protect the confidentiality, integrity, and availability of our information assets.

Our external auditors annually review our information security management system, which has an ISO/IEC 27001 certification.

We monitor our environment for cybersecurity threats with real-time ability to activate measures to minimize impact, respond to incidents, and investigate issues.

We routinely conduct security assessments of our applications, manage vulnerabilities, and perform penetration testing as well as exercises that mimic cybersecurity incidents to evaluate and enhance our security posture and lower cybersecurity risk.

In addition to our own systems and technology, we rely on third-party service providers for certain software, technology and cloud-based systems and services that support a variety of critical business operations.

We have policies and processes designed to identify, assess and manage cybersecurity risk relating to these third-party service providers.

When contracting with these providers, the procurement function works closely with the compliance and legal teams to conduct diligence and help appropriately manage risk, including cybersecurity risk, throughout the life cycle of the contract.

We have developed, and seek to incorporate, standard contractual security requirements into our service provider agreements.

We also perform cybersecurity assessments of third-party service providers where we deem appropriate given the nature of the engagement and the data and systems expected to be accessed.

We have not identified any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial situation.

However, despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident or will not experience a cybersecurity incident in the future.

We maintain high standards with respect to cybersecurity and our cybersecurity risk management program is integrated into our enterprise risk management framework, overseen by our Information Security Officer (“ISO”), meaning that cyber-risks are identified, evaluated, and managed with the same rigor as other strategic, operational, and financial risks.

We have adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework principles as a guide for our security controls and processes, helping us structure our activities around identifying potential threats, protecting systems, detecting incidents, responding to events, and recovering operations.

We engage independent third-party cybersecurity auditors and testers annually to review our Information Security Management (ISMS) and renew our ISO/IEC 27001 certification.

Key elements of our program include:

● Preventive Controls and Monitoring :

We employ multiple layers of technical controls (firewalls, intrusion detection systems, encryption, and multi-factor authentication) to proactively monitor IT controls to ensure compliance with security policies, legal regulations, contractual obligations and industry best practices.

Our Global Security Operations Center operates 24/7 with real-time monitoring capabilities to rapidly investigate alerts and trigger containment measures, which helps us minimize exposure or damage if a cybersecurity incident occurs.

● Vulnerability Management and Testing :

We conduct regular vulnerability assessments and annual external penetration testing of our systems and applications to probe for weaknesses.

We also perform periodic exercises simulating cybersecurity incidents to test our defenses and response procedures.

Findings from these tests are used to strengthen our security posture on an ongoing basis.

● Incident Response Planning :

We maintain a cybersecurity incident response plan that defines procedures for addressing security events.

This plan is updated and tested regularly (including through tabletop drills and simulated breach exercises) so that our teams remain practiced in incident handling.

In the event of an incident, our aim is to respond swiftly to contain the issue, notify appropriate stakeholders, investigate the root cause, and recover normal operations as soon as practicable.

● Third-Party Risk Management :

We carefully manage cybersecurity risks arising from our use of third-party software, cloud services, and suppliers.

We perform due diligence and security risk assessments on critical third-party service providers, both at onboarding and periodically during the relationship.

Our procurement and legal teams work together to incorporate robust cybersecurity requirements into contracts with vendors (for example, data protection standards and incident notification obligations).

Where appropriate, we require suppliers to adhere to our security policies or industry standards, and we conduct

ongoing monitoring or audits of their security controls.

These steps help reduce the risk that a weakness in a partner’s systems could compromise our data or operations.

● Employee Training and Awareness :

A strong security culture among our employees is one of our best defenses in relation to cybersecurity events.

Our employees are required to complete annual cybersecurity and data protection awareness training.

This training educates personnel on topics like phishing prevention, safe computing practices, and how to report potential security issues.

We supplement formal training with periodic phishing email simulations and security reminders.

Through a combination of these technical, procedural, and educational measures, our program is designed to detect and respond to cybersecurity threats effectively and thereby safeguard our business operations and sensitive information.

Cybersecurity threats are endemic to the modern business environment, and attempts to penetrate our network security are frequent and on-going.

However, to date, no cybersecurity threats (including incidents) have resulted in a material impact on our business strategy, results of operations, or financial condition .

Despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident, that we will not experience a cybersecurity incident in the future, or that a past cybersecurity incident will not result in a future material impact.

For additional information on cybersecurity related risks, see “Item 1A.

Risk Factors” of this Annual Report on Form 10-K.

Several members of the Board comprise the Risk Management Committee (RMC), which is responsible, among other things, for oversight of cybersecurity risks based on the authority given by our Board of Directors.

The RMC receives regular updates at least quarterly from management, including our Chief Information Officer (CIO) and our Information Security Officer (ISO) with evaluations of cyber risk, the threat environment, updates on incidents, and advancements on investments in cybersecurity risk reduction.

Our CIO has been with the Company since January 2021 and has over 25 years of global experience.

He has served in numerous senior leadership positions where he gained significant cybersecurity and risk management experience across multiple high-tech industries.

Our ISO has been with the Company since July 2018 and similarly has over 25 years of extensive cybersecurity, risk and compliance experience including CISSP and CISM certifications.

Information Security, Corporate Audit, Finance, Legal, Compliance and Investor Relations have a strong partnership at the management level and have established a Cybersecurity Council that connects the risk management and cybersecurity incident response processes.

In the event of a cybersecurity breach, the ISO will inform the Cybersecurity Council, and then the Cybersecurity Council will determine materiality and next steps.

The Cybersecurity Council will meet with the RMC and/or the full Board as needed to share details of the event and facilitate reporting to regulators as required.

Governance and Oversight

We have established strong governance practices to oversee cybersecurity and IT risks.

The Board of Directors has delegated primary oversight responsibility for cybersecurity to the Risk Management Committee (RMC) of the Board , which is composed of several Board members.

Our Chief Information Officer (CIO) and Information Security Officer (ISO) receive security reports and threat intelligence from the Security Operations Center, which apprises the CIO and ISO of any potential incidents and the status of ongoing preventive measures and they share this information at least quarterly with the RMC.

They also brief the full Board as needed on cybersecurity matters.

We have a multi-disciplinary Cybersecurity Council that connects our Information Security, IT, Corporate Audit, Finance, Legal, Compliance, and Investor Relations teams.

This Council facilitates coordination of cybersecurity risk management across our organization and a unified response to incidents.

In the event of a cybersecurity incident, the ISO will lead our incident response efforts and convene the Cybersecurity Council to evaluate the situation and determine appropriate next steps (for example, engaging law enforcement or cyber-experts, and considering disclosure obligations).

This integrated governance structure – from the operational teams up through senior management and the Board – helps drive accountability and visibility for cybersecurity throughout our organization.

Our leadership team includes seasoned professionals with deep expertise in technology and security.

Our CIO, Todd Weathersby, has more than 25 years of experience in global IT and cybersecurity management, and our ISO has more than 25 years of experience in cybersecurity, risk, and compliance (with certifications such as CISSP and CISM).

The knowledge and experience of our CIO and ISO, along with the Board’s active engagement, provides a strong oversight of our cybersecurity strategy.

The Board and management also receive regular briefings and training sessions regarding emerging cybersecurity threats and regulatory developments in order to be positioned to adapt to new challenges in the cybersecurity landscape.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments