What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-19 compared with 2025-05-14 · 39 added, 39 removed, 2 unchanged (98% of the section changed)

1 unchanged sentence

CYBERSECURITY

Our Board recognizes the importance of maintaining the trust and confidence of our customers, suppliers, business partners and employees.

Our Board, through the Audit Committee, oversees our cybersecurity program as part of our enterprise-wide approach to risk management.

Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards.

In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

Risk Management and Strategy

As one of the critical elements of enterprise-wide approach to risk management, our cybersecurity program is focused on the following key areas:

As discussed in more detail under the heading “Governance” below, our cybersecurity program is led by our Director of Cybersecurity, who reports to our Chief Information Officer, and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance.

Our Chief Information Officer leads our cybersecurity team and regularly reports to our Audit Committee.

Collaboration :

We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and

procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

We work with third-party firms to monitor our cybersecurity environment and report findings to executive leadership, internal audit and the Audit Committee regularly.

Technical Safeguards :

We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware functionality and access controls, which are evaluated and improved through vulnerability assessments, audits and cybersecurity threat intelligence.

Incident Response and Recovery Planning :

We have established and maintained comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

Third-Party Risk Management :

We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

Additionally, we have in place insurance coverage designed to provide coverage in connection with cybersecurity breaches, provided, however, that such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.

Education and Awareness :

We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents.

These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.

We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.

The results of such assessments, audits and reviews are reported to our Board and Audit Committee by our Chief Information Officer based on materiality.

We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

Our Board, through the Audit Committee, oversees our enterprise-wide approach to risk management, including the risks arising from cybersecurity threa ts.

Our Audit Committee regularly receives presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties.

Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

On an annual basis, our Audit Committee discusses our Company’s approach to cybersecurity risk management with management.

Our Audit Committee, in connection with management led by our Chief Information Officer and Director of Cybersecurity, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans.

To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents .

Through ongoing communications with these teams, our Audit Committee monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and

incidents in real-time and report such threats and incidents to management when appropriate.

Our Director of Cybersecurity has served in various roles in technology leadership and cybersecurity for over 20 years.

Our Chief Information Officer has served in various roles in technology and business leadership for more than 40 years.

Our Chief Executive Officer, Chief Financial Officer and Chief Information Officer each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies including risks arising from cybersecurity threats.

Cybersecurity Threats

As of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats , including as a result of previous cybersecurity incidents, are reasonably likely to have a material effect on us, our business strategy, results of operations, cash flows or financial condition.

The safety and security of our customers and team members is our top priority.

Republic is committed to safeguarding our information and our information systems from unauthorized access, use, disclosure, disruption, modification or destruction.

Our cybersecurity program is designed to protect our information assets and the management of risks to those assets supports the confidentiality, integrity, and availability of the information necessary to our long-term business success.

This includes appropriate administrative, physical, and technical safeguards to protect the assets that keep our operation running and securely store the information in our care.

Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee.

The Audit Committee oversees management’s design, implementation and enforcement of our cybersecurity risk management program.

Our Board and our Audit Committee receive quarterly reports from management on our cybersecurity risks.

In addition, management updates the Audit Committee, as necessary, regarding cybersecurity incidents it considers to be material or potentially material.

Audit Committee members also receive presentations on cybersecurity topics from our Chief Information Officer and Chief Financial Officer, supported by our internal security staff, or external experts as part of the Board’s continuing education on topics that impact public companies and update the full Board as necessary.

Our management team, including our Chief Financial Officer and Chief Information Officer , is responsible for assessing and managing our material risks from cybersecurity threats.

The team has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers.

Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

Cybersecurity Risk Management and Strategy

Republic employs a risk-based strategy informed by guiding principles from industry standard cybersecurity and risk management frameworks, such as those published by the National Institute of Standards and Technology (“NIST”), as well as industry guidelines and best practices.

This is not intended to imply that we meet any particular technical standards, specifications, or requirements;

only that we use various NIST security standards, guidelines and best practices to identify, assess, and manage cybersecurity risks relevant to our business.

As part of our risk-based strategy, Republic maintains appropriate technical and organizational measures and regularly reviews the appropriateness of those controls based on changes to the technical or regulatory environment.

Republic also regularly incorporates cybersecurity awareness training into employee communications, engagement and training activities.

Republic participates in various information-sharing organizations to timely share and receive threat information, thereby improving the collective defense of the aviation sector.

Republic regularly seeks opportunities to improve its capabilities, including through cybersecurity trainings and skill development programs.

Republic utilizes a variety of third parties in connection with its cybersecurity risk management and also utilizes third-party cybersecurity companies to add capacity or expertise when necessary.

Additionally, assessments of Republic’s cybersecurity program are periodically conducted by independent third-party assessors.

Republic is subject to cybersecurity risks related to its business partners and third-party service providers.

In addition, cybersecurity considerations affect the selection and oversight of third-party service providers.

We perform diligence on third parties, particularly those that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.

A significant data breach may adversely affect Republic’s business.

To manage these risks, we conduct evaluations of key suppliers based on risk and seek to incorporate appropriate security standards to manage the risk.

Republic also regularly monitors the external cybersecurity posture of select third parties through various service providers.

Republic and its suppliers strive to design and implement technical and organizational controls comprehensively, consistently, and effectively as intended to protect the confidentiality, integrity or availability of systems and data.

However, because Republic utilizes a risk-based strategy, based on professional judgment and analysis of the risks, it is possible that Republic may underappreciate or not recognize a specific risk.

Moreover, even the best designed and implemented security controls may not eliminate the occurrence of cybersecurity incidents.

Our processes for assessing, identifying and managing material risks from cybersecurity threats is incorporated into our Enterprise Risk Management (“ERM”) framework.

Our information security and ERM teams coordinate to regularly review and assess these risks using a wide range of tools and services.

Enterprise-wide training is a vital component to reducing risk and protecting customers, employees and company information.

We expect all employees and third-party contractors to adhere to information security and privacy policies as they handle corporate and customer information in their daily jobs.

To support this expectation, we require all employees and contractors with access to Republic information to complete annual training, which is updated as new technology, security and privacy issues emerge.

We regularly test our incident response processes through table-top exercises to ensure they continue to be effective as our business and the cybersecurity threat landscape evolve.

Our incident response processes are designed to guide the actions we take to prepare for, detect, respond to and recover from cybersecurity incidents.

In the last three years at the time of this filing, we have not experienced any material cybersecurity incidents nor have we identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, financial condition, or the price of our common stock .

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments