What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-05 compared with 2025-03-25 · 37 added, 35 removed, 32 unchanged (69% of the section changed)

11 unchanged sentences

As part of our program:

● We have implemented and maintain our policies, procedures and processes (PPP) related to the functioning of information technology

within the company.

The PPP are custom-tailored for the specific needs of the company – such as the nature and scale of the personal

information that we collect and process – and incorporate controls and frameworks set forth by organizations such as the National

Institute of Standards and Technology and the International Organization for Standardization.

Our internal Risk Management Committee,

described below, reviews our PPP at least annually to assure continuing relevance and effectiveness.

● We maintain a dedicated, fully staffed and qualified Information Security team that reports to the office of the Chief Technology

Officer (CTO) and is currently led by the Director of Information Security (InfoSec).

Combined, these individuals have more than 50 years

of experience related to corporate information security governance, data and network security, data governance, risk management, and overall

secure practices involved with InfoSec.

● We have implemented a risk management process and formed a Risk Management Committee, which consists of members of our management

team, including members with technical expertise, to identify, evaluate and categorize any potential InfoSec risks.

● We perform vulnerability testing and penetration testing at routine intervals to assure that our InfoSec posture remains vigilant.

● We utilize and maintain third-party security vendors, as necessary, to provide assistance with a variety of security efforts.

● We are reviewing our security training protocols to ensure all employees received annual security training for all employees.

security training will be focused on overall InfoSec, privacy best practices, and review of company policies.

● We have formed and maintain a 24/7 Security Operations Center (SOC)/Network Operations Center (NOC) that continually monitors our

key systems and logs.

● We have an incident response and escalation process that is designed to detect cyber incidents and react in an appropriate manner

to reduce any related damage.

● We conduct tabletop exercises related to business continuity planning and disaster recovery, as well as incident responses for our

SOC/NOC Operations team

● Our Board is regularly updated regarding the current state of InfoSec, its future roadmap, and any significant or material cybersecurity

● We have implemented and maintain our policies, procedures and processes (PPP) related to the functioning

of information technology within the company.

The PPP are custom-tailored for the specific needs of the company – such as the nature

and scale of the personal information that we collect and process – and incorporate controls and frameworks set forth by organizations

such as the National Institute of Standards and Technology and the International Organization for Standardization.

Our internal Risk Management

Committee, described below, reviews our PPP at least annually to assure continuing relevance and effectiveness.

● We maintain a dedicated, fully staffed and qualified Information Security team that reports to the office

of the Chief Technology Officer (CTO) and is currently led by the Chief Information Security Officer (CISO).

● We have implemented a risk management process and formed a Risk Management Committee, which consists of

members of our management team, including members with technical expertise, to identify, evaluate and categorize any potential InfoSec

● We perform vulnerability testing and penetration testing at routine intervals to assure that our InfoSec

posture remains vigilant.

● We utilize and maintain third-party security vendors, as necessary, to provide assistance with a variety

of security efforts.

● We are reviewing our security training protocols to ensure all employees received annual security training

for all employees.

This security training will be focused on overall InfoSec, privacy best practices, and review of company policies.

● We have formed and maintain a 24/7 Security Operations Center (SOC)/Network Operations Center (NOC) that

continually monitors our key systems and logs.

● We have an incident response and escalation process that is designed to detect cyber incidents and react

in an appropriate manner to reduce any related damage.

● We conduct tabletop exercises related to business continuity planning and disaster recovery, as well as

incident responses for our SOC/NOC Operations team

● Our Board is regularly updated regarding the current state of InfoSec, its future roadmap, and any significant

or material cybersecurity incidents.

Cybersecurity Governance

6 unchanged sentences

As appropriate, our CTO and

Director of InfoSec report to the Board on a broad range of topics, including any significant cybersecurity risks, the status of ongoing

projects, future roadmap planning, updates to the company’s PPP, and other relevant updates to our InfoSec operations and stance.

In addition, our Incident Response process is designed to ensure that the Board receives timely notifications and reports, particularly

with respect to any material cybersecurity incident , so that they are aware of any material incident and can provide oversight and direction

as part of the response and remediation process.

CISO report to the Board on a broad range of topics, including any significant cybersecurity risks, the status of ongoing projects, future

roadmap planning, updates to the company’s PPP, and other relevant updates to our InfoSec operations and stance.

In addition, our

Incident Response process is designed to ensure that the Board receives timely notifications and reports, particularly with respect to

any material cybersecurity incident , so that they are aware of any material incident and can provide oversight and direction as part of

the response and remediation process.

Our senior management is responsible

6 unchanged sentences

management for appropriate disposition (such as avoidance, acceptance, mitigation, etc.).

Our CTO and Director of InfoSec have the primary

responsibility for managing our cybersecurity program and efforts.

We perform internal audits of our internal information technology controls

and implementation, and we carry out a tabletop exercise at least once each year to determine our ability to respond to cybersecurity

incidents in an effective and efficient manner.

Our CTO and CISO have the primary responsibility

for managing our cybersecurity program and efforts.

We perform internal audits of our internal information technology controls and implementation,

and we carry out a tabletop exercise at least once each year to determine our ability to respond to cybersecurity incidents in an effective

and efficient manner.

Our information technology

3 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments