What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-12-17 compared with 2024-12-19 · 16 added, 67 removed, 6 unchanged (93% of the section changed)

3 unchanged sentences

Securing the Company’s business information, customer, supplier, and employee data and information technology systems is an important part of our overall risk management framework.

We rely on certain key information

technology systems, some of which are dependent on services provided by third parties, including cloud vendors, for various business functions necessary to operate and manage our business.

We select key third-party service providers based on

several factors, including the type of data processed and the nature of services offered, and we oversee such key third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring, including a review of SOC-1

reports on an annual basis.

We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats.

Those processes include response to and an assessment of internal and external threats to the security,

confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations.

In addition, we have implemented procedures over certain areas such as access on/off boarding and account

management to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities.

Although, to date, we have not experienced a material cybersecurity incident resulting in a

significant interruption of our operations, the scope of any future incident cannot be predicted with any meaningful accuracy.

We rely on certain key information technology systems, some of which are dependent on services provided by third parties, including cloud vendors, for various business functions necessary to operate and manage our business.

We select key third-party service providers based on several factors, including the type of data processed and the nature of services offered, and we oversee such key third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring, including a review of SOC-1 reports on an annual basis.

We have adopted processes, guided by the Center for Internet Security (CIS) Cybersecurity Framework, designed to identify, assess and manage material risks from cybersecurity threats.

Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations.

We have implemented controls, such as Multi-Factor Authentication (MFA) and endpoint detection and response (EDR) solutions, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities.

Furthermore, we maintain a formal, Incident Response Plan (IRP) and conduct mandatory, ongoing security awareness training for all employees.

Although, to date, we have not experienced a material cybersecurity incident resulting in a significant interruption of our operations, the scope of any future incident cannot be predicted with any meaningful accuracy.

See “Item 1A.

Risk Factors” for more information.

Management is responsible for the day-to-day management of the risks we face, while our Board

of Directors has responsibility for the oversight of risk management, including risks from cybersecurity threats.

The cybersecurity program is led by the Company’s

Global VP of Data Operations and Information Technology, who provides periodic updates to the Cyber Security Risk Management Committee of our Board of Directors about the program, including information about cyber risk management governance

and the status of ongoing efforts to strengthen cybersecurity effectiveness.

Our Board of Directors engages in ad hoc conversations with management on cybersecurity-related news events and discuss any significant updates to our

cybersecurity risk management and initiatives.

The Cyber Security Risk Management Committee regularly reports on its activities to the full Board to promote effective coordination and to ensure that the entire Board remains apprised of the

effectiveness of the cybersecurity risk management and the cybersecurity risk landscape, and also assesses how management is managing these risks.

The following table presents certain information about the Company’s photomask manufacturing facilities:

Brookfield, Connecticut

Bridgend, Wales

Cheonan, Korea

Dresden, Germany

Hsinchu, Taiwan

Taichung, Taiwan

Xiamen, China

(1) We own our manufacturing facilities in Hefei, Taichung, Xiamen, and one of our manufacturing facilities in Hsinchu.

However, we lease the related land at these sites.

We believe our facilities, with planned expansions, are adequate to

support our current and near-term requirements.

LEGAL PROCEEDINGS

Please refer to Note 16 – Commitments and Contingencies to our consolidated financial statements in Part II, Item 8 of this report for information on legal proceedings

involving the Company.

MINE SAFETY DISCLOSURES

Not applicable.

MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES

(a) Market Information

Our common stock is traded on the NASDAQ Global Select Market (“NASDAQ”) under the symbol PLAB.

On December 12, 2024, the closing sale price of our common stock, per the NASDAQ Global Select

Market, was $26.27.

(b) Approximate Number of Holders of Common Stock

Based on available information, we have 215 registered shareholders.

To date, we have not paid any cash dividends on Photronics shares, and, for the foreseeable future, we anticipate that earnings will continue to be retained for use in our business.

(d) Securities Authorized for Issuance Under Equity Compensation Plans

The information regarding our equity compensation required to be disclosed by Item 201(d) of Regulation S-K is incorporated by reference from the Photronics, Inc.

2025 Definitive Proxy Statement in Item 12 of Part

III of this report.

The 2025 Definitive Proxy Statement will be filed within 120 days after our fiscal year ended October 31, 2024.

(e) Stock Price Performance Graph

(f) Purchase of Equity Securities by Registrant and Affiliated Purchasers

In September 2020, the Company’s Board of Directors authorized the repurchase of up to $100 million of its common stock, pursuant to a repurchase plan under

Rule 10b5-1 of the Securities Act.

The repurchase authorization by the Board of Directors has no expiration date, does not obligate us to acquire any common stock, and is subject to market conditions.

Share repurchases under this

authorization commenced on September 16, 2020.

The most recent 10b5-1 plan expired on September 15, 2022, and has not been renewed.

In 2022, we repurchased 0.2 million shares at a cost of $2.5 million (an average of $13.43 per share) and,

since the program’s inception, we have repurchased 5.8 million shares at a cost of $68.3 million (an average of $11.70 per share).

All shares repurchased under the program have been retired.

On August 28, 2024, the Board of Directors authorized an increase to the Company’s existing share repurchase program from the remaining $31.7

million up to $100 million under the Board of Director authorization.

In 2024, we did not repurchase any further shares as part of this program.

Management is responsible for the day-to-day management of the risks we face, while our Board of Directors has ultimate responsibility for the oversight of risk management, including risks from cybersecurity threats.

The Board of Directors has delegated primary oversight of cybersecurity risk to the Cyber Security Risk Management Committee.

The Committee, in turn, ensures its members either possess or have access to relevant cybersecurity and risk management expertise to effectively challenge and guide management's program.

The Committee regularly assesses how management is managing these risks and reports on its activities to the full Board of Directors at least quarterly to promote effective coordination and ensure the entire Board remains apprised of the cybersecurity risk landscape and the program's effectiveness.

The day-to-day cybersecurity program is led by the Company’s Vice President, IT Infrastructure & Information Security.

This role is supported by a dedicated security team and reports directly to the Chief Executive Officer.

The Vice President, IT Infrastructure & Information Security provides formal, quarterly updates to the Cyber Security Risk Management Committee.

These updates cover cyber risk management governance, the status of ongoing efforts to strengthen cybersecurity effectiveness, key risk metrics and the material outcomes of risk assessments, and significant cybersecurity-related news events impacting the industry.

In addition to scheduled reports, the Board of Directors engages in ad hoc conversations with management to discuss any significant updates to our cybersecurity risk management and initiatives, particularly in response to emerging threats.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments