Cybersecurity Risk Management and Strategy

We face significant and persistent cybersecurity risks due to the global nature of our business, the use of information technology systems, infrastructure and data in our business operations and our reliance on third-party vendors, suppliers, customers and business partners. We defend our systems against cybersecurity attacks on a daily basis and rely heavily on the reliability, security and efficiency of our information technology systems and ongoing employee training to face these threats. We maintain a cyber risk management program designed to assess, identify and manage cybersecurity threats. Our cyber risk management program has been integrated into our overall risk management program. The Audit Committee of our Board of Directors and our management are involved in the oversight of our risk management program, of which cybersecurity represents an important component.

We rely on a multidisciplinary team, including our information security function, outside legal counsel, management, and third-party service providers, as described further below, to identify, assess, and manage cybersecurity threats and risks. These processes include, among other things, quarterly security awareness training for employees, instituting programs to increase awareness of phishing attempts, multi-layered tools to detect and monitor unusual network activity, and processes to contain, escalate and respond to incidents. In addition, we have an enterprise Information Security Policy describing our cybersecurity program and governance structure and the processes and procedures in place to identify, mitigate and remediate cybersecurity threats and risks.

We have an incident response plan for managing cybersecurity incidents and associated crisis communication procedures designed to facilitate coordination across the Company and with our partners, customers, the public and others.

To further protect our business, we partner with a third-party vendor to provide cybersecurity and risk management as a managed service offering. They provide cybersecurity risk assessment and threat intelligence to the Company, in addition to acting as a managed service provider for our information technology program. While third-party providers contribute specialized resources and around-the-clock monitoring capabilities, responsibility for the Company’s cybersecurity strategy, risk management and decision-making remains with the internal IT team. Led by our Vice President of Information Technology, who has extensive experience in information security and technology risk management, the internal team works closely with these partners to evaluate cybersecurity risks, review testing and assessment results, prioritize remediation efforts and implement security improvements to lessen cybersecurity risk. This cost-effective partnership model enables the Company to leverage external expertise while maintaining strong internal oversight, accountability and alignment with business objectives. By combining internal knowledge of the Company’s operations with specialized third-part capabilities, the Company has established a comprehensive cybersecurity program designed to identify, assess, manage and mitigate cybersecurity risk.

Third Party Risk Management

We also monitor and manage cybersecurity risks associated with our third-party service providers, including our managed security service provider, system support vendors and other critical relationships, among other things, the processes set forth in our policies and procedures, due diligence processes, regular oversight, monitoring and auditing of our relationships by internal staff, supplier codes of conduct and escalation practices for reporting issues. We require our third-party providers to meet appropriate security requirements and controls prior to providing access to our internal systems, and investigate and report any security incidents, as appropriate.

Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information, see "Risk Factors—Risks Related to “Cybersecurity incidents and other disruptions to our information and technology systems, or the information systems of third parties whom we do business" in Part I, Item IA of this Annual Report on Form 10-K.

We rely on a multidisciplinary team, including our information security function, outside legal counsel, management, and third-party service providers, as described further below, to identify, assess, and manage cybersecurity threats and risks. These processes include, among other things, quarterly security awareness training for employees, instituting programs to increase awareness of phishing attempts, multi-layered tools to detect and monitor unusual network activity, and processes to contain, escalate and respond to incidents. In addition, we have an enterprise Information Security Policy describing our cybersecurity program and governance structure and the processes and procedures in place to identify, mitigate and remediate cybersecurity threats and risks.

We have an incident response plan for managing cybersecurity incidents and associated crisis communication procedures designed to facilitate coordination across the Company and with our partners, customers, the public and others.

Risk assessment and oversight are an integral part of our governance and management processes. The Audit Committee of our Board of Directors (the "AC") has ultimate oversight of the Company's risk management. The AC is responsible for overseeing our enterprise risk management program, including material risks related to cybersecurity threats. The AC receives quarterly reports from management, including the information technology and legal teams, on cybersecurity risk resulting from risk assessments and reviews any information on relevant internal and industry cybersecurity incidents and is notified between such updates relative to any incidents which could materially affect the Company. Based on this information, our AC monitors the Company's cybersecurity program, including potential threats, weaknesses and vulnerabilities, the policies and procedures in place to prevent, detect and respond to cybersecurity threats and unauthorized access to our information security systems. Significant findings related to cybersecurity, data and technology risks or incidents are at least annually reported to and discussed with the Board of Directors.