Item 1C. Cybersecurity

Information technology supports several aspects of our business, including among others, product ordering and fulfillment, pricing, customer service, transaction processing, financial reporting, collections, and cost management. Further, our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data of the Company and third parties.

Risk Management and Strategy

We assess, identify and manage the material risks associated with cybersecurity threats as part of our enterprise risk management (“ERM”) program addressing our strategic, operational, compliance and financial risks across the organization. Our ERM program includes feedback from senior management and certain functional leaders. Each high-level risk is assigned to a member of senior management as the risk owner for oversight, with the risk owner developing a risk mitigation plan that is tracked to completion.

We have prioritized cybersecurity risks and made investments of time and resources in recent years to mitigate this risk area. We have implemented and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data. Our risk mitigation steps include engagements with third-party service providers with expertise in cybersecurity that assist us in assessing risk, including vulnerability assessments and penetration testing, and the implementation of risk mitigation measures. We have implemented firewalls (including encryption of data, network security controls, access controls and physical security) across all of our locations and invested in intrusion detection and protection systems, email filtering and systems to mitigate the risk of phishing attacks. We maintain a managed detection and response system and a security operations center that operates 24 hours per day, 7 days per week. Further, we have prepared an incident response plan to activate in the event of a cybersecurity event, including to respond to any such incident, define and seek to control the extent of the incident (including using an escalation framework based on the materiality of incidents), assess and take reasonable actions intended to remediate any damage caused, and implement measures designed to prevent future reoccurrences. We also have developed a disaster recovery and business continuity plan that provides for reduced downtime and data loss in the event of a security breach. The incident response team also leads simulation exercises to evaluate the effectiveness of such plan.

As we have increased our remote workforce in recent years, our management has focused on the Company enhancing the security of remote access with trusted devices, endpoint security controls and infrastructure resiliency. As part of this process, we enhanced our security incident response procedures to address risks specific to remote working conditions.

Third-party service providers, such as distributors, subcontractors, vendors, and data processors have access to certain portions of our data in supporting various operating business functions. We have an onboarding and periodic security review process of all third party vendors who have or will have access to our confidential information. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.

As with most companies, we have experienced cyber-attacks, attempts to breach our systems and other similar incidents. However, risks from cybersecurity threats, including from prior cyber incidents, have not materially affected, or are not reasonably likely to materially affect, our Company, including our business strategy, results of operations or financial condition in 2023 and recent years We carry cyber risk insurance that provides protection against a breach or other data security incident, but such insurance may not be sufficient, and any related insurance proceeds may not be timely paid to us. See “Risk Factors — Risks Related to Our Operations and Industry — We rely on information technology systems to support our business operations. A significant disturbance or breach of our technological infrastructure could adversely affect our financial condition and results of operations. Additionally, failure to maintain the security of confidential information could damage our reputation and expose us to litigation,” for additional discussion about cybersecurity-related risks.