What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-31 compared with 2025-03-31 · 96 added, 82 removed, 9 unchanged (95% of the section changed)

1 unchanged sentence

Cybersecurity

Risk management and strategy.

While no organization can eliminate cybersecurity risk, the Company

employs a cybersecurity strategy that is designed to mitigate cybersecurity and information technology risk.

The Company and its contracted

providers have implemented practices consistent with the National Institute of Standards and Technology (NIST) methodology for security.

These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized

parties attempt to access confidential, sensitive, or personal information;

potentially hold such information for ransom;

Management and Strategy.

no organization can eliminate cybersecurity risk, the Company employs a cybersecurity strategy that is designed to mitigate cybersecurity

and information technology risk.

The Company maintains processes to identify, assess, and prioritize cybersecurity risks based on potential

impact to operations, financial objectives, and reputation.

These processes include periodic risk assessments, vulnerability identification,

and evaluation of threat intelligence, which are integrated into the Company’s broader enterprise risk management and business

decision-making processes.

Company and its contracted providers have implemented practices consistent with the National Institute of Standards and Technology (NIST)

methodology for security.

These efforts are implemented to help protect against, and mitigate the effects of, among other things, cybersecurity

incidents where unauthorized parties attempt to access confidential, sensitive, or personal information;

potentially hold such information

destroy data;

disrupt or delay our operations or systems;

or otherwise cause harm to the Company, our customers, employees, vendors, or other key stakeholders.

Managing Material Risks & Integrated Overall Risk Management

Cybersecurity is part of the Company’s enterprise risk management

In addition, the Company has comprehensive monitoring and employee training, underscored by a set of policies and procedures that

directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access,

multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices.

the Company’s management work closely with the IT department and its contracted providers to continuously evaluate and address cybersecurity

risks and policies in alignment with the Company’s business objectives and operational needs.

Use of Third Parties

The Company engages cybersecurity consultants and service providers

to assess and enhance its cybersecurity practices, and to monitor its infrastructure in real time for threats.

These third parties conduct

penetration testing and risk assessments to identify weaknesses and recommend improvements.

Additionally, the Company leverages a number

of third-party tools, training and technologies as part of its efforts to enhance cybersecurity functions.

This includes a managed security

service provider to augment the Company’s dedicated security operations team, an endpoint detection and response system for continuous

monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat

detection, investigation, and prioritization.

We also rely on technology integration with third party vendors to

support and conduct our business and operations, which may include processing of confidential and other sensitive data.

We require contractually

and operationally that appropriate data security and cybersecurity practices are in place.

Despite our efforts, it’s important to note

that service providers are ultimately responsible to establish and uphold their respective cybersecurity programs.

We have limited ability

to monitor the cybersecurity practices of our service providers and there can be no assurance that we can prevent or mitigate the risk

of any compromise or failure in the information systems, software, networks, or other assets owned or controlled by outside service providers,

which could have an adverse effect on the security of our information systems.

Monitoring and Response to Cybersecurity Incidents

The Company’s IT security stakeholders regularly monitor alerts

and meet to discuss threat levels, trends, and remediation.

The team prepares a monthly report on cybersecurity threats and risk areas

and conducts an annual risk assessment.

or otherwise cause harm to the Company, our customers, employees,

vendors, or other key stakeholders.

Material Risks & Integrated Overall Risk Management

Cybersecurity

is part of the Company’s enterprise risk management scope.

The Company maintains processes to identify, assess, and prioritize

cybersecurity risks based on potential impact to operations, financial objectives, and reputation.

These processes include periodic risk

assessments, vulnerability identification, and evaluation of threat intelligence, which are integrated into the Company’s broader

enterprise risk management and business decision-making processes.

In addition, the Company has comprehensive monitoring and employee

training, underscored by a set of policies and procedures that directly or indirectly relate to cybersecurity, such as policies related

to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the

internet, social media, email and wireless devices.

Members of the Company’s management work closely with the IT department and

its contracted providers to continuously evaluate and address cybersecurity risks and policies in alignment with the Company’s

business objectives and operational needs.

Cybersecurity considerations may also inform the Company’s technology investments, vendor

selection, and operational planning.

of Third Parties

Company engages cybersecurity consultants and service providers to assess and enhance its cybersecurity practices, and to monitor its

infrastructure in real time for threats.

These third parties conduct penetration testing and risk assessments to identify weaknesses

and recommend improvements.

Additionally, the Company leverages a number of third-party tools, training and technologies as part of its

efforts to enhance cybersecurity functions.

This includes a managed security service provider to augment the Company’s dedicated

security operations team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities,

and a security information and event management solution to automate real-time threat detection, investigation, and prioritization.

Company relies on third-party service providers to support certain aspects of its operations, including the processing of sensitive data.

The Company seeks to manage associated risks through vendor selection processes, contractual requirements, and ongoing oversight activities.

However, because these third parties operate their own systems and controls, the Company cannot guarantee the effectiveness of their

cybersecurity measures, and a failure or breach at a third-party provider could adversely affect the Company.

and Response to Cybersecurity Incidents

Company, with support from third-party service providers, monitors security alerts on an ongoing basis and conducts periodic reviews

of threat levels, trends, and remediation activities.

The team prepares a monthly report on cybersecurity threats and risk areas and

conducts an annual risk assessment.

This ongoing knowledge acquisition and continuing education is crucial for the effective prevention,

detection, mitigation, and remediation of cybersecurity incidents.

If a security event is alerted, upper management and the incident response

team are notified and the steps identified in the Incident Response Plan, or IRP, are initiated.

This plan includes immediate actions

to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

Risks from Cybersecurity Threats

The Company faces risks from cybersecurity threats that could have

a material adverse effect on its business, financial condition, results of operations, cash flows or reputation.

For more information

about the cybersecurity risks the company faces, see the risk factor entitled “Information technology risks, including the risk

of cyberattacks, may disrupt our business, result in losses or limit our growth.” in Item 1A., Risk Factors.

The Company has not

encountered cybersecurity challenges that have materially impaired its operations or financial standing.

Cybersecurity

The Board is acutely aware of the critical nature of managing risks

associated with cybersecurity threats and recognizes the significance of these threats to the Company’s operational integrity and

shareholder confidence.

Risk Management Personnel

The Company’s Chief Operating Officer and Director of IT are

responsible for developing and implementing the Company’s information security program.

Additionally, the Vice President of Safety

and Risk Management leads the enterprise risk management (ERM) for the Company and guides the handling of all material risks, including

If a security event is alerted, upper management and the incident

response team are notified and the steps identified in the Incident Response Plan, are initiated.

The Company’s incident response

processes include defined escalation procedures intended to facilitate timely assessment of whether a cybersecurity incident could be

This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future

from Cybersecurity Threats

Company faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results

of operations, cash flows or reputation.

For more information about the cybersecurity risks the company faces, see the risk factor entitled

“Information technology risks, including the risk of cyberattacks, may disrupt our business, result in losses or limit our growth.”

in Item 1A., Risk Factors.

The Company has not , to date and based on currently available information, identified cybersecurity incidents

that have materially impaired its operations or financial standing.

The Company maintains cybersecurity insurance coverage;

such insurance may not be sufficient to cover all losses or liabilities associated with a cybersecurity incident, and coverage may be

subject to exclusions, limitations, and evolving market conditions.

Cybersecurity

The Chief Operating Officer and VP of Safety and Risk Management have overseen risk management programs in multiple environments

and the Director of IT has represented companies in IT integration, SaaS businesses, data, application and server security.

Board of Directors Oversight

The Audit Committee is central to the Board’s oversight of cybersecurity

risks and bears the primary responsibility for this domain.

The Audit Committee is composed of board members with diverse expertise including

risk management and finance, equipping them to oversee this scope effectively.

Management’s Role Managing Risk and Reporting to the Board

The Chief Operating Officer has primary interface with the Audit Committee

on cybersecurity risks, supported by management and its contracted experts.

Briefings to the Audit Committee take place on a regular basis,

with a minimum frequency of once per year to cover topics, including:

Board is acutely aware of the critical nature of managing risks associated with cybersecurity threats and recognizes the significance

of these threats to the Company’s operational integrity and stockholder confidence.

Management Personnel

Company’s Chief Operating Officer and Vice President of IT are responsible for developing and implementing the Company’s

information security program.

Additionally, the Vice President of Safety and Risk Management leads ERM for the Company and guides the

handling of all material risks, including cybersecurity.

The Chief Operating Officer and VP of Safety and Risk Management have experience

overseeing risk management programs in multiple environments and the Vice President of IT has experience in IT integration, SaaS businesses,

data, application and server security.

of Directors Oversight

Nominating and Governance Committee is central to the Board’s oversight of cybersecurity risks and bears the primary responsibility

for this domain.

The Nominating and Governance Committee is composed of board members with diverse expertise including risk management

and technology, equipping them to oversee this scope effectively.

Role Managing Risk and Reporting to the Board

Chief Operating Officer has primary interface with the Nominating and Governance Committee on cybersecurity risks, supported by management

and its contracted experts.

Briefings to the Nominating and Governance Committee take place on a regular basis, with a minimum frequency

of once per year to cover topics, including:

Current cybersecurity landscape and emerging threats;

● Actions being taken by the Company to minimize or address such threats;

Actions being taken by the Company to minimize or address

such threats;

Status of ongoing cybersecurity initiatives and strategies;

● Incident reports and learnings from any cybersecurity events, if any;

● Compliance with regulatory requirements and industry standards.

The Audit Committee will conduct an annual review of the Company’s

cybersecurity posture and the effectiveness of its risk management strategies.

This review helps in identifying areas for improvement

and ensuring the alignment of cybersecurity efforts within the overall risk management framework.

Incident reports and learnings from any cybersecurity

events, if any;

Compliance with regulatory requirements and industry

Nominating and Governance Committee conducts an annual review of the Company’s cybersecurity posture and the effectiveness of its

risk management strategies.

This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts

within the overall risk management framework.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments