Item 1C. Cybersecurity

Risk Management and Strategy

The Company maintains robust and comprehensive processes, procedures and controls to protect and secure its information systems and data infrastructure from cybersecurity threats. The Company’s cybersecurity program is led by its Chief Information Security Officer (“CISO”). The Company’s cybersecurity program interfaces with other functional areas within the Company, including but not limited to the Company’s business segments and information technology, legal, risk management, human resources and internal audit departments, as well as external third-party partners, to identify and understand potential cybersecurity threats and risks. The Company regularly assesses and updates its processes, procedures and management techniques in light of ongoing cybersecurity developments.

Internally, the CISO coordinates oversight of reviewing security alerts, identifying and monitoring ongoing and potential cybersecurity threats, evaluating strategic business impacts of cybersecurity threats and developing programs and initiatives to educate the Company’s employees regarding cybersecurity. The CISO also manages the Company’s Security Incident Response Plan (the “Incident Response Plan”), which outlines action steps for the preparation, identification, triage, analysis, containment, eradication, recovery and reflection stages of a cybersecurity incident. The Incident Response Plan serves as the charter for the Company’s Security Incident Response Team (the “Incident Response Team”), which includes a strategic team comprised of executives from various cross-functional management teams, as well as a tactical team comprised of internal technical support roles and external third-party service providers. The Incident Response Plan provides how the Incident Response Team will analyze and, as necessary, escalate cybersecurity incidents both internally and with third-party service providers based on type and severity of the specific incident.

The Company also requires cybersecurity training for all active employees, focusing on the appropriate protection and security of confidential company and third-party information. Additionally, the Company provides quarterly cybersecurity awareness training that covers a broad range of security topics, including secure access practice, phishing schemes, remote work and response to suspicious activities. In addition to online training, employees are educated through several methods, including event-triggered awareness campaigns, recognition programs, security presentations, company intranet articles, videos, system-generated communications, email publications and various simulation exercises.

The Company has engaged a third-party managed detection and response partner to monitor the security of its information systems around-the-clock, including intrusion detection, and to provide instantaneous alerting and triaging should a cybersecurity event occur. The Company also maintains a cybersecurity insurance policy and has engaged a third-party digital forensics and incident response consultant and legal counsel on retainer. Additionally, the Company has established a comprehensive cybersecurity risk management program for third-party service providers and vendors. Our processes include: (i) pre-engagement due diligence to assess cybersecurity maturity and compliance with industry standards; (ii) contractual requirements for security controls, breach notification, and incident response protocols; (iii) ongoing monitoring and periodic security assessments throughout the vendor relationship; and (iv) escalation procedures for identified risks or incidents. Third-party cybersecurity risks are monitored continuously and integrated into the Company's overall enterprise risk management framework, with oversight by the CISO.

In 2025, the Company’s board of directors established a Technology Committee of the board of directors to (i) oversee the Company’s technology strategy, (ii) review the development of impactful technology; (iii) review the Company’s current IT infrastructure and (iv) support the Audit Committee, the board of directors and management in its oversight of the Company’s cybersecurity strategy.

The Company does not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected the Company. However, the sophistication of cyber threats continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company’s business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.

Governance

The Company’s Audit Committee and board of directors provide ultimate oversight of the Company’s cybersecurity risk management. The Audit Committee regularly reviews and discusses with management the strategies, processes, procedures and controls pertaining to the management of the Company’s information technology operations, including cyber risks and cybersecurity. The Company’s CISO and Chief Information Officer (“CIO”) provide quarterly reports to the Audit Committee regarding the evolving cybersecurity risk landscape, including emerging risks, as well as the Company’s processes, program and initiatives for managing these risks.

The Company’s CISO reports directly to the CIO, who in turn reports to the principal executive officer (“CEO”). The CISO has over 20 years of experience in IT and cybersecurity. Under the direction of the CISO, the Company’s cybersecurity department continuously analyzes cybersecurity and resiliency risks to our business, considers industry trends and implements preventive and detective controls, as appropriate, to mitigate these risks. The cybersecurity team consists of cybersecurity professionals holding multiple certifications such as CISSP (Certified Information Systems Security Professional), CEH (Certified Ethical Hacker), GSOM (GIAC Security Operations Manager), CISM (Certified Information Security Manager), CISA (Certified Information Systems Auditor), among others. The cybersecurity team’s analysis drives the Company’s short- and long-term cybersecurity strategies, which are executed through a collaborative effort within the IT department and are communicated to the Audit Committee and the board of directors regularly.