Company: AIRTP
Filing Date: 2025-06-27
Form Type: 10-K
Source: 0000353184-25-000044
Chunk: 46

Company: AIR T INC
Filing Date: 2025-06-27
Form: 10-K
Item: Item 1A
Chunk 46
---
. Performing these assessments regularly enables the Company to determine key business objectives and the IT assets and capabilities needed to achieve them. In addition, the assessments also provide the executive leadership and the Board of Directors an understanding of the Company’s security landscape and allows it to prepare to respond to threats. Cybersecurity threats continue to be identified as one of the Company’s significant risks, with our Sr Director of Tech assigned as the risk owner. Our Sr Director of Tech has developed expertise in cybersecurity and compliance, enterprise architecture and road mapping, data analytics and customer service through his twenty years of experience in the information technology space. He holds a Bachelor's degree from the University of North Carolina, Charlotte. 

Governance

The Board of Directors has delegated primary responsibility for the oversight of cybersecurity and information technology risks, and the Company’s preparedness for these risks, to the Audit Committee. The Audit Committee serves and functions as the Board of Directors primary oversight body to monitor the Company’s cybersecurity and related information technology risks. The Audit Committee receives periodic updates from the Sr Director of Tech on the Company’s policies, processes, procedures, and any significant development related to the identification, mitigation and remediation of cybersecurity risks. The Audit Committee ensures that the Sr Director of Tech provides to the Board of Directors annual updates on our cybersecurity 

28

and information technology risk. These annual updates include topics related to our cybersecurity programs and mitigation strategies, trends in cybersecurity, and other cybersecurity-related developments.  We may engage third-party advisors to monitor threats and to scan for vulnerabilities. When a cybersecurity threat or incident is identified by our third-party advisor, it is reported directly to our Sr Director of Tech. The Sr Director of Tech in conjunction with professionals throughout the organization, including information technology specialists, accountants, and lawyers, determine severity and response, then manage it to conclusion in accordance with our cybersecurity incident response processes. We may engage third party advisors as part of our incident response processes to assist with digital forensics among other efforts. The Sr Director of Tech, together with the cross-functional team, report material or potentially material incidents to our executive leadership and the Audit Committee. The Sr Director of Tech provides further updates regarding root causes and remediation efforts. In the event the Company determines it has experienced a material cybersecurity incident the Board of Directors is notified. In an effort to deter and detect cyber threats, we engage a third-party service provider to periodically provide all employees with a data protection and cybersecurity awareness training program, which covers timely and relevant topics, including phishing, password protection, confidential data protection,