What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-09-29 compared with 2025-09-24 · 35 added, 29 removed, 17 unchanged (79% of the section changed)

Unresolved Staff Comments

Not applicable

Cybersecurity

Globally, organizations are encountering cybersecurity incidents with growing frequency, and the nature of these threats is becoming more sophisticated and constantly changing.

Globally, organizations are encountering cybersecurity incidents with growing frequency, and the nature of these threats, including through the use of AI, is becoming more sophisticated and constantly changing.

We recognize the importance of developing, implementing and maintaining strong cybersecurity policies and processes to protect our information systems and the confidentiality, integrity and accessibility and availability of our data.

Risk Management and Strategy

Managing Material Risks & Integrated Overall Risk Management

We have developed and maintained policies, procedures and controls that seek to mitigate material risks from cybersecurity threats, and assess and disclose information to investors concerning material cybersecurity incidents.

Further, we have strategically integrated cybersecurity risk management into our broader risk management framework to promote awareness and attention to cybersecurity risk management Company wide.

These risks are evaluated on an ongoing basis as part of our overall risk management strategy that is generally overseen by our Audit Committee.

The lead information technology (“ IT ”) manager (the “ IT Manager ”) of the Company evaluates the effectiveness of the data and information systems, which is to protect the data and information systems from security threats.

We have developed and maintained policies, procedures and controls that seek to assess, identify and manage material risks from cybersecurity threats, and assess and disclose information to investors concerning material cybersecurity incidents.

Further, we have strategically integrated cybersecurity risk management into our broader risk management framework to promote awareness and attention to cybersecurity risk management across our business.

These risks are evaluated on an ongoing basis as part of our overall risk management strategy that is generally overseen by the Audit Committee (the “ Audit Committee ”) of our Board of Directors (the “ Board ”).

Our Chief Executive Officer and our Chief Financial Officer oversee the details of our information security risk management approach.

Under the direction of our Chief Financial Officer, our lead IT manager (the “ IT Manager ”) evaluates the effectiveness of the data and information systems in protecting our data and information systems from security threats.

The evaluation stratifies IT systems based on the risk and severity of potential security breaches related to the data handled and assesses the effectiveness of the systems in safeguarding against cyber threats.

The evaluation includes attributes such as physical security, network security, host security, application security and data security.

Our Security Operations Center continuously monitors for security events and threats, responding and escalating when appropriate.

The IT Manager reports directly to the Audit Committee to review the Company’s information security and cybersecurity risks.

Despite these efforts, no system is impenetrable, and we cannot provide assurances that we will prevent every attack or timely detect every incident.

Engage Third Parties on Cyber-Risk Management

The evaluation reviews, among other things, physical security, network security, host security, application security, data security and AI usage.

Our Security Operations Center, which consists of a team provided by our third party managed service provider, continuously monitors for security events and threats, responding and escalating when appropriate.

All of our employees, consultants and contractors are encouraged to exercise professional judgement in using computing devices and network resources connected to the information technology network and infrastructure, and are strictly prohibited from certain acts enumerated in our cybersecurity policy including, among other things, accessing such devices or resources for non-business purposes, disabling our security features and requirements and exporting information or technologies without consent and password sharing.

Violations or breaches of our cybersecurity policy or the associated schedules, standards or guidelines may result in suspension and/or discipline up to and including termination, in addition to administrative sanctions or legal actions.

Despite these efforts, no system is impenetrable.

In addition, new technology that could result in greater operational efficiency such as use of AI may further expose our operations and computer systems to risk of cybersecurity incidents.

We cannot provide assurances that we will prevent every attack or timely detect every incident.

Engagement of Third Parties for Cybersecurity Risk Management

When appropriate, we use external subject matter specialists, including assessors, consultants or other third parties, to assess our cybersecurity risk management processes.

We will consider resource and capital constraints when determining the nature and timing of enhancing our cybersecurity infrastructure.

Overseeing Risks Stemming from Third-Party Service Providers

We maintain comprehensive internal protocols to mitigate cybersecurity threats associated with our use of third -party service providers.

We have engaged third parties that supply IT services or have access to our systems or data to adhere to our security policies.

1 unchanged sentence

Specific certification may be required of critical third -party IT service providers.

The Company will consider resource and capital constraints when determining the nature and timing of enhancing our cybersecurity infrastructure.

Overseeing Risks stemming from Third-Party Service Providers

We maintain comprehensive internal protocols to mitigate cybersecurity threats associated with our use of third -party service providers.

We are currently enhancing these protocols to further strengthen our defenses and reduce potential vulnerabilities.

Risks from Cybersecurity Threats

We do not currently identify any major cybersecurity threats that have materially affected or are reasonably likely to materially affect us (including our business strategy, results of operations or financial condition).

Material Risks from Cybersecurity Threats

We are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

Although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cybersecurity threat would not materially affect our business strategy, results of operations or financial condition.

See “ We are dependent on information technology systems, which are subject to certain risks, including cybersecurity risks and data leakage risks associated with implementation and integration ” in “Item 1A.

Risk Factors” in this Annual Report.

Board of Directors Oversight

Our Board of Directors recognizes the importance of information security and mitigating cybersecurity and other data security threats and risks as part of our efforts to protect and maintain the confidentiality and security of our employees, service providers, consultants and business associates, as well as non-public information about our Company.

Although our Board of Directors has ultimate responsibility with respect to risk management oversight, the Audit Committee of our Board of Directors is charged with and bears primary responsibility for, among other matters, overseeing risks specific to the identification and mitigation of cybersecurity risks.

Management ’ s Role Managing Risk

The IT Manager plays a pivotal role in informing the Audit Committee on cybersecurity risks.

Management will immediately notify the Audit Committee and Board of Directors of any cybersecurity incident that is determined to be material.

Management delivers updates to the Audit Committee annually, or more frequently as needed, in response to specific incidents or emerging threats.

Our Board recognizes the importance of information security and mitigating cybersecurity and other data security threats and risks as part of our efforts to protect and maintain the confidentiality and security of our employees, service providers, consultants and business associates, as well as non-public information about us.

Although our Board has ultimate responsibility with respect to risk management oversight, the Audit Committee is charged with and bears primary responsibility for, among other matters, overseeing risks specific to the identification and mitigation of cybersecurity threats.

The Audit Committee is informed of the status of our cybersecurity risk management processes by management at least annually, and more frequently as needed.

These briefings encompass a broad range of topics, including:

current cybersecurity landscape and emerging threats;

Status of ongoing cybersecurity initiatives, strategies, and best practices;

the status of ongoing cybersecurity initiatives, strategies, and best practices;

incident reports and learnings from any cybersecurity events.

Management ’ s Role in Managing Risk

Our Chief Executive Officer and Chief Financial Officer oversee the details of our information security risk management approach and may appoint team leads from various departments from time to time to assist with certain aspects of our cybersecurity risk mitigation strategy.

Our IT Manager , under the direction of our Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats.

The IT Manager has approximately eight years of experience in corporate IT management, cybersecurity and digital transformations.

The IT Manager is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through management of and participation in the cybersecurity risk management processes described above, and regularly reports to our Chief Financial Officer.

Our Chief Financial Officer will immediately notify the Audit Committee and the Board of any cybersecurity incident that is determined to be material.

Our Chief Financial Officer delivers updates to the Audit Committee and to the Board annually, or more frequently as needed, in response to specific incidents or emerging threats.

As we progress in the assessment and enhancement of our cybersecurity program, we plan to consider the following areas for enhancement and incorporation into the cybersecurity risk management and governance program in the future:

2 unchanged sentences

monitoring system/procedures for cybersecurity incidents;

Reporting to Board of Directors regarding cybersecurity risks and incidents.

Risk Management Personnel

All of our employees, consultants and contractors are encouraged to exercise professional judgement in using computing devices and network resources connected to the information technology network and infrastructure, and are strictly prohibited from certain acts enumerated in our cybersecurity policy including, among other things, access for non-business purposes, disabling our security features and requirement, exporting information or technologies without consent and password sharing.

reporting to the Board regarding cybersecurity risks and incidents.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments