Cybersecurity Governance

The Board of Directors (the “Board”) of the Company is responsible for the oversight of the Company’s cybersecurity program and recognizes the risks that cybersecurity threats may impose on the Company, its business partners, employees and investors. The Company's IT Director is responsible for overall IT governance, risk and compliance including the Company’s cybersecurity program. The Audit Committee of the Board collaborates with the full Board and the IT Director to facilitate alignment of overall IT related controls and processes. We have a formalized IT Security Incident Report process which provides a method to document and communicate details of security incidents to appropriate stakeholders. The Board and the Audit Committee receive periodic briefings on cybersecurity and help set priorities and strategic direction. As part of continuous improvement, our cybersecurity program is being aligned with the NIST Cybersecurity Framework 2.0 to help ensure comprehensive controls and oversight.

Cybersecurity Controls

We have controls specifically focused on E-mail phishing including impersonation attempts. Although our automated controls prevent most phishing attempts, some can be delivered to employees. To mitigate this risk, we provide training to employees using various methods including E-mail phishing campaigns which send phishing-style E-mails, monitors user responses and automatically assigns further training as appropriate. Employees have been trained to send any suspicious activity to a central IT Service Desk for evaluation and appropriate timely action.

All critical systems have rigorous data backups and are designed for disaster recovery, ensuring business continuity in the event of a catastrophic incident. As part of continuous improvement, disaster recovery testing is being conducted and documented.

We are not aware of any unmitigated risk or any prior incident that may have materially affected the Company’s data integrity, confidentiality, operations, business strategy or financial reporting. Given our reliance on modern systems, we are aware a significant incident could impact the Company’s overall goals so we strive to provide modern counter measures to manage this risk.