Manage We apply a multi-layered defense strategy to maintain our ability to access or utilize an asset or its value and prevent threat actors from gaining or increasing their access to an asset or its value. We prioritize our defensive mechanisms, including administrative, procedural, and technical controls, based on their cost-effectiveness and their ability to reduce risk.

Periodically, we engage consultants and other third parties to assist in the continued improvement of our cybersecurity program. These engagements are designed to enhance our cybersecurity posture, and we work closely with these experts to help us identify and address vulnerabilities. Examples of these engagements include penetration testing, risk assessments, and cybersecurity control audits.

We maintain policies and procedures to oversee and identify cybersecurity risks associated with our third-party service providers, especially those with access to customer and employee data. Our selection and oversight of these providers incorporate cybersecurity considerations, including contractual and other mechanisms to mitigate and continually monitor risks.

We undertake proactive activities to prevent, detect, and minimize the impact of cybersecurity incidents. We maintain an incident response plan to respond to breaches and minimize disruption to our operations swiftly. The incident response process is consistently tested and reviewed through simulated incidents. To bolster the incident response process, we have business continuity, contingency, and recovery plans to ensure operational resilience during a cybersecurity incident. Previous cybersecurity incidents guide continuous improvements in our governance, policies, procedures, and technology. We use these lessons to strengthen our cybersecurity defenses.

Cybersecurity threats and risks, to include any previous cybersecurity incidents, have not materially affected, or are not reasonably likely to materially affect, our business strategy, results of operations, or financial condition. We have not, as of the date of this filing, experienced a cybersecurity breach that has materially affected our business or financial condition. However, because our business involves the collection, transmission, and storage of certain customer and employee data, it is possible that we could be susceptible to various cybersecurity threats, including cyberattacks, unauthorized access, and similar events.

We are committed to the ongoing identification and management of cybersecurity risks as part of our business strategy, financial planning, and capital allocation. We strive to incorporate cybersecurity considerations into all aspects of our operations. As the cybersecurity landscape evolves, so does our strategy to identify and mitigate these risks. We continuously work towards enhancing our processes to ensure an effective cybersecurity posture.

Board of Directors and Management Governance.

Board of Directors Oversight. We recognize the critical importance of cybersecurity and data protection and understand the potential harm to our business from cybersecurity incidents. Accordingly, we place a high priority on mitigating risks associated with cybersecurity threats and any cybersecurity incidents.

Company management maintains primary responsibility for the risk management of the Company, including cybersecurity risks. The Board’s Audit Committee is responsible for the oversight of risks associated with cybersecurity threats. The Audit Committee Charter provides that the Committee is responsible for reviewing management’s assessment of the Company’s information technology process framework and practices and the controls implemented to monitor and mitigate information technology risks. In addition, as part of the Audit Committee’s quarterly meetings and as provided for in its Charter, the Committee receives reports and briefings from the Company’s Chief Information Officer (CIO), Director of Cybersecurity, and management’s cybersecurity team. Those reports and briefings include management’s review of emerging cybersecurity developments and threats, the Company’s risk relating to cybersecurity, and the Company’s strategy to mitigate data protection and cybersecurity risks. The Audit Committee has the authority to obtain advice and input from external cybersecurity resources to assist in its oversight functions.

Management’s Role. Our management team is actively engaged in assessing and managing material risks from cybersecurity threats. We have established a robust framework for identifying, evaluating, and mitigating these risks.

11

Responsibility for Cybersecurity Risks. Our CIO has developed expertise in cybersecurity, compliance, enterprise architecture and design, data analytics, digital transformation, and customer service through years of experience in the information technology space. Our Director of Cybersecurity is designated as the senior executive responsible for cybersecurity and reports directly to our CIO. He has a comprehensive information technology background with 30 years of information technology experience, to include 10 years of systems architecture and design, 12 years of management, and 14 years of service in managing, or assisting in managing, cybersecurity related risks.

To support the CIO and Director of Cybersecurity in managing cybersecurity risks, we established a cross-functional cybersecurity team that includes experts in various aspects of information security. Combined, this team of employees includes individuals with over 85 years of prior work experience in cybersecurity and data protection. These individuals are responsible for the day-to-day implementation of our cybersecurity program.

Additionally, the cybersecurity management team regularly consults with additional resources, to include attorneys, accountants, human resources personnel, and other information technology specialists, to determine materiality for cybersecurity related risks and incidents. There is an established Incident Response Plan that clearly identifies escalation measures based on the impact to our organization.

Processes for Monitoring and Mitigating Risks and Incidents. We employ a comprehensive set of processes to monitor and mitigate cybersecurity risks. These processes include:

These processes are designed to prevent cybersecurity incidents, but also allows our organization to quickly detect and respond to incidents if they do occur. They are regularly reviewed and updated to adapt to evolving cybersecurity threats.

If any incidents occur, we have a comprehensive Incident Response Plan in place. The Plan includes materiality qualifiers based on the size and scope of the incident. Furthermore, there is an escalation matrix that identifies who is directly involved with managing the incident based on the severity. An Incident Report is compiled for all incidents, regardless of materiality. Management reviews the incident reports and ensures all incidents are mitigated and remediated effectively. These reports are shared with the CIO, CFO, and Audit Committee so they can effectively manage resources to reduce risk and prevent future incidents.

Reporting to the Board. As noted above, our CIO, Director of Cybersecurity, and cybersecurity team provide quarterly updates and reports to our Audit Committee on cybersecurity risks as well as a review of the processes described above. Our management personnel are also required to provide more frequent updates to the Audit Committee on major developments regarding cybersecurity matters. The Committee, in turn, provides regular updates to the Board on these matters.

12