What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-03-31 compared with 2024-03-28 · 33 added, 20 removed, 12 unchanged (82% of the section changed)

1 unchanged sentence

Cybersecurity.

Risk management and strategy

We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats.

Processes to manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process.

Our cybersecurity risks include theft of business data, fraud or extortion, lack of access to our information systems, harm to employees, harm to business partners, violation of privacy laws, potential reputational damage, and litigation or other legal risk if a cybersecurity incident were to occur.

It is difficult to assign a monetary materiality assessment to these risks or to the impact if we were to sustain a breach of our systems.

management and strategy

understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats.

to manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process.

Our cybersecurity

risks include theft of business data, fraud or extortion, lack of access to our information systems, harm to employees, harm to business

partners, violation of privacy laws, potential reputational damage, and litigation or other legal risk if a cybersecurity incident were

It is difficult to assign a monetary materiality assessment to these risks or to the impact if we were to sustain a breach

of our systems.

Our approach is based on the premise that any cybersecurity incident could result in material harm to our company.

We utilize a seasoned and mature artificial intelligence-based security system that learns and monitors the actions of individuals that have access to our networks and systems, including location of access (notably from international locations), email, and SAAS platforms that we don’t host.

The system not only protects based off of the specific rules implemented, it also takes action based on user activity (including remote access to our systems by our employees) that is outside their normal behavior pattern.

Additionally, our employees go through cybersecurity awareness training as part of their onboarding procedures.

If a threat is detected, our system automatically notifies our internal information systems management (“ISM”) team of all activities and ranks those activities based on their level of threat to the system and/or deviation of behavior from normal.

Severe threats notify the ISM team via text message, regardless of hours of operation.

In addition to the notification, the system will automatically take action to secure the system, up to and including blocking user accounts and access.

The ISM team will then review the notification, assess the action that was taken against the actual threat, and then clear the condition or take further action.

To mitigate risk, we periodically evaluate and assess the threat landscape and our security controls, through assessments, regular network and endpoint monitoring.

We also have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers, including performing diligence on certain third parties that have access to our systems, data or facilities that store such systems or data, continually monitoring cybersecurity threat risks identified through such diligence

Under our framework, cybersecurity

issues, including those involving vulnerabilities introduced by our use of third-party software, are analyzed by subject matter experts

for potential financial, operational, and reputational risks, based on, among other factors, the nature of the matter and breadth of impact.

As of the date of this Report, there

have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations,

or financial condition.

utilize a seasoned and mature artificial intelligence-based security system that learns and monitors the actions of individuals that

have access to our networks and systems, including location of access (notably from international locations), email, and SAAS platforms

that we do not host.

The system not only protects based off of the specific rules implemented, it also takes action based on user activity

(including remote access to our systems by our employees) that is outside their normal behavior pattern.

Additionally, our employees

go through cybersecurity awareness training as part of their onboarding procedures.

a threat is detected, our system automatically notifies our internal information systems management (“ISM”) team of all activities

and ranks those activities based on their level of threat to the system and/or deviation of behavior from normal.

Severe threats notify

the ISM team via text message, regardless of hours of operation.

In addition to the notification, the system will automatically take

action to secure the system, up to and including blocking user accounts and access.

The ISM team will then review the notification, assess

the action that was taken against the actual threat, and then clear the condition or take further action.

mitigate risk, we periodically evaluate and assess the threat landscape and our security controls, through assessments, regular network

and endpoint monitoring.

We also have processes to oversee and identify material cybersecurity risks associated with our use of third-party

service providers, including performing diligence on certain third parties that have access to our systems, data or facilities that store

such systems or data, continually monitoring cybersecurity threat risks identified through such diligence

our framework, cybersecurity issues, including those involving vulnerabilities introduced by our use of third-party software, are analyzed

by subject matter experts for potential financial, operational, and reputational risks, based on, among other factors, the nature of

the matter and breadth of impact.

of the date of this Report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially

affect our business, operations, or financial condition.

determined to present potential material impacts to our financial results, operations, and/or reputation would immediately be reported

8 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments