What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-03-25 compared with 2024-03-27 · 25 added, 27 removed, 42 unchanged (55% of the section changed)

11 unchanged sentences

As part of our program:

have implemented and maintain our policies, procedures and processes (PPP) related to the functioning of information technology within

The PPP are custom-tailored for the specific needs of the company – such as the nature and scale of the personal information

that we collect and process – and incorporate controls and frameworks set forth by organizations such as the National Institute

of Standards and Technology (NIST) and the International Organization for Standardization (ISO).

● We have implemented and maintain our policies, procedures and processes (PPP) related to the functioning of information technology

within the company.

The PPP are custom-tailored for the specific needs of the company – such as the nature and scale of the personal

information that we collect and process – and incorporate controls and frameworks set forth by organizations such as the National

Institute of Standards and Technology and the International Organization for Standardization.

Our internal Risk Management Committee,

described below, reviews our PPP at least annually to assure continuing relevance and effectiveness.

maintain a dedicated, fully staffed and qualified Information Security team that reports to the office of the Chief Technology Officer

(CTO) and is currently led by the Director of Information Security (InfoSec).

Combined, these individuals have more than 50 years of

experience related to corporate information security governance, data and network security, data governance, risk management, and overall

● We maintain a dedicated, fully staffed and qualified Information Security team that reports to the office of the Chief Technology

Officer (CTO) and is currently led by the Director of Information Security (InfoSec).

Combined, these individuals have more than 50 years

of experience related to corporate information security governance, data and network security, data governance, risk management, and overall

secure practices involved with InfoSec.

have implemented a risk management process and formed a Risk Management Committee, which consists of members of our management team,

including members with technical expertise, to identify, evaluate and categorize any potential InfoSec risks.

perform vulnerability testing and penetration testing at routine intervals to assure that our InfoSec posture remains vigilant.

utilize and maintain third-party security vendors, as necessary, to provide assistance with a variety of security efforts.

are reviewing our security training protocols to ensure all employees received annual security training for all employees.

This security

training will be focused on overall InfoSec, privacy best practices, and review of company policies.

have formed and maintain 24/7 Security Operations Center (SOC)/Network Operations Center (NOC) that continually monitors our key systems

have an Incident Response (IR) and escalation process that is designed to detect cyber incidents and react in an appropriate manner to

reduce any related damage.

● We conduct tabletop exercises related to Business Continuity Planning (BCP)

and Disaster Recovery (DR), as well as Incident Response (IR) for our SOC/NOC Operations team

Board of Directors (the “Board”) is regularly updated regarding the current state of InfoSec, its future roadmap, and any

significant or material cybersecurity incidents.

● We have implemented a risk management process and formed a Risk Management Committee, which consists of members of our management

team, including members with technical expertise, to identify, evaluate and categorize any potential InfoSec risks.

● We perform vulnerability testing and penetration testing at routine intervals to assure that our InfoSec posture remains vigilant.

● We utilize and maintain third-party security vendors, as necessary, to provide assistance with a variety of security efforts.

● We are reviewing our security training protocols to ensure all employees received annual security training for all employees.

security training will be focused on overall InfoSec, privacy best practices, and review of company policies.

● We have formed and maintain a 24/7 Security Operations Center (SOC)/Network Operations Center (NOC) that continually monitors our

key systems and logs.

● We have an incident response and escalation process that is designed to detect cyber incidents and react in an appropriate manner

to reduce any related damage.

● We conduct tabletop exercises related to business continuity planning and disaster recovery, as well as incident responses for our

SOC/NOC Operations team

● Our Board is regularly updated regarding the current state of InfoSec, its future roadmap, and any significant or material cybersecurity

Cybersecurity Governance

21 unchanged sentences

responsibility for managing our cybersecurity program and efforts.

They are advised by our General Counsel, who has extensive government

experience with cybersecurity issues and regulations.

We perform internal audits of our internal information technology controls and implementation,

and we carry out a tabletop exercise at least once each year to determine our ability to respond to cybersecurity incidents in an effective

and efficient manner.

We perform internal audits of our internal information technology controls

and implementation, and we carry out a tabletop exercise at least once each year to determine our ability to respond to cybersecurity

incidents in an effective and efficient manner.

Our information technology

3 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments