9 unchanged sentences
For these highest priority risks, including cybersecurity risks, the RMC designates risk owners, sets common reporting processes, and monitors risk mitigation and treatment strategies to support business continuity.
−Removed: The Company’s cybersecurity risk management program leverages the National Institute of Standards and Technology Cybersecurity Framework for identifying, assessing, and managing material risks from cybersecurity threats.
+Added: The Company’s cybersecurity risk management program leverages the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework for identifying, assessing, and managing material risks from cybersecurity threats.
This approach combines prevention and detection techniques, informed by internal and external sources, to identify and analyze potential threat activities.
2 unchanged sentences
The Company’s cybersecurity risk management program focuses on vulnerability management, access management, and user awareness training.
−Removed: Among other things, the Company implements scheduled patching and system updates, proactively scans for vulnerabilities, and engages qualified third-party experts to assess the Company’s information technology infrastructure and identify vulnerabilities and opportunities for continued focus and improvement.
−Removed: When vulnerabilities are identified, the Company’s information technology (“IT”) management team receives reports that assess each vulnerability and track progress in remediating that vulnerability.
+Added: Among other things, the Company implements scheduled patching and system updates, proactively scans for vulnerabilities, and engages qualified third-party experts to assess the Company’s IT infrastructure and identify vulnerabilities and opportunities for continued focus and improvement.
+Added: When vulnerabilities are identified, the Company’s IT management team receives reports that assess each vulnerability and track progress in remediating that vulnerability.
The IT management team also collaborates with supply chain management and the Company’s third party risk management program to onboard and monitor key third-party service providers to address the potential risk of cybersecurity threats through the use of such third parties.
−Removed: Annual cybersecurity training is mandatory for all users with access to the Company’s IT systems, and the Company conducts monthly tests to promote phishing awareness.
+Added: Annual cybersecurity training is mandatory for all users with access to the Company’s IT systems, and the Company conducts targeted monthly tests to promote phishing awareness.
In addition to these prevention methods, the Company seeks to detect potential threats through external intelligence and monitoring solutions.
−Removed: External commercial or governmental agencies are also engaged to assess potential threat activity relevant to the Company.
+Added: External commercial or governmental agencies are also engaged to assess potential threat activity relevant to the Company where appropriate.
The Company also monitors server and endpoint devices across the organization to detect signs of a cyberattack.
2 unchanged sentences
A technical incident response team is responsible for technical response activities, including information gathering and forensic analysis, containment, and remediation efforts.
−Removed: The Company’s Crisis Management Team drives the Company’s enterprise-level crisis response process, leads decisions around response strategies, coordinates resources required to execute such strategies, and oversees all cybersecurity incidents categorized as Critical and High.
+Added: The Company’s Crisis
+Added: 22 FORM 10-K SONOCO 2025 ANNUAL REPORT
+Added: Management Team drives the Company’s enterprise-level crisis response process, leads decisions around response strategies, coordinates resources required to execute such strategies, and oversees all cybersecurity incidents categorized as Critical and High.
Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2025, the scope and impact of any future incident cannot be predicted .
8 unchanged sentences
The Company’s Crisis Management Team has relevant expertise and experience to assess and remediate cyber threats.
−Removed: The CIO has over 18 years of experience in information technology and security, and the CISO has 32 years of information technology experience and 12 years of information security experience .
−Removed: 21 FORM 10-K SONOCO 2024 ANNUAL REPORT
+Added: The CIO has over 18 years o f experience in IT and security, and the CISO has ov er 30 years of IT experience and over 12 years of information security experience .
As part of its broader oversight activities, the Board oversees risks from information security threats and other risks identified by the RMC, both directly and by way of delegation to the Audit Committee.
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.