Managing Material Risks & Integrated Overall Risk Management

We have implemented tools and strategies to promote a company-wide culture of cybersecurity risk management. This ensures that cybersecurity considerations are an integral part of our decision-making process. Our IT Department works closely with our leadership and key operating personnel to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

Our information security function and our Vice President of Information Technology help identify, assess and manage the Company’s cybersecurity threats and risks. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company’s risk profile using various methods in certain contexts, including, for example, manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threat actors, conducting scans of certain environments, evaluating certain threats reported to us, conducting threat and vulnerability assessments, using external intelligence feeds, and using third parties to conduct tabletop incident response exercises and other tests.

Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including, for example: incident detection and response, disaster recovery/business continuity policies, encryption of certain data, network security controls and data segmentation for certain systems, access controls, physical security, asset management and tracking, systems monitoring, annual mandated employee training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.

Because we are aware of the risks associated with third-party service providers, we conduct thorough security assessments of all determined high-risk third-party providers as deemed necessary, before engagement to ensure compliance with industry cybersecurity standards and frameworks. This includes assessments performed by our Vice President of IT, who oversees the Company's cybersecurity function.

Governance

We have implemented standard operating procedures to define the channels by which cybersecurity threats are communicated to the Company's Board of Directors (the “Board”). This ensures that The Board has oversight and effective governance in managing risks associated with cybersecurity threats.

Board of Directors Oversight

members with diverse expertise including, risk management, and finance, equipping them to oversee cybersecurity risks effectively. The Audit Committee receives briefings on cybersecurity risks from the Vice President of IT or the Chief Legal Officer as described below in “Management’s Role Managing Risk.”

Management’s Role Managing Risk

Monitor Cybersecurity Incidents

The Vice President of IT is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. In cooperation with the Vice President of IT, the Director of IT Infrastructure and Security implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Vice President of IT is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

See Item 1A “Risk Factors” – “Risks Related to Business Operations and Industry.”

The Audit Committee of the Board (the “Audit Committee”) is central to the Board’s oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board

The Vice President of IT and the Director of IT Infrastructure and Security, in their respective capacity, inform the Chief Financial Officer (CFO) and Chief Legal Officer (CLO) of cybersecurity risks and incidents. Furthermore, significant cybersecurity matters, and strategic risk management decisions are required to be escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.