Company: JBI
Filing Date: 2025-04-25
Form Type: DEF 14A
Source: 0001140361-25-015724
Chunk: 36

Company: Janus International Group, Inc.
Filing Date: 2025-04-25
Form: DEF 14A
Chunk 36
---
 by assessing current threat intelligence from various sources, including but not limited to, certain key vendors, the United States Cybersecurity & Infrastructure Security Agency (“CISA”), and the open source threat intelligence community via open-source threat intelligence databases. Furthermore, we conduct periodic table top exercises, vulnerability and security testing, and “lessons learned” reviews from internal and industry related cybersecurity incidents. We have a process to report material results of such testing and assessments to the Board and our Audit Committee, and periodically make adjustments to our cybersecurity program based on these exercises and reviews. The Company engages third parties to conduct certain aspects of such testing and to assist with the Managed Detection and Response (“MDR”) of security events as well as the collection and 22 TABLE OF CONTENTS reporting of data for cybersecurity key performance indicators (i.e., KPIs). The Company seeks to identify and oversee cybersecurity risks presented by third parties and their systems from a risk-based perspective through a vendor management program, including annual reviews of key vendors’ adherence to cybersecurity compliance, the monitoring of alerts from CISA, as well as open-source threat intelligence. Some of our IT systems and products operate within a hosted architecture or by third-party service providers, and if these third-party IT environments fail to operate properly, our systems and products (including our Nokē Smart Entry System) could stop functioning for a period of time, which could put our users at risk. Accordingly, our ability to keep our business operating is highly dependent on the proper and efficient operation of IT service providers, and our vendor management process is an important part of our risk mitigation strategy. In particular, we review Service Organization Controls (“SOC”) reports describing vendors’ compliance with cybersecurity best practices when they are available or an appropriate subset of those controls for vendors who do not have a SOC report. Notwithstanding, if there is a catastrophic event, such as an adverse weather condition, natural disaster, terrorist attack, security breach, or other extraordinary event, we, and our service providers, may be unable to provide our services and products for the duration of the event and/or a time thereafter. Cybersecurity Governance In light of the pervasive and increasing threat from cyberattacks, the Board and the Audit Committee, with input from management, assess the Company’s cybersecurity threats and the measures implemented by the Company in an effort to mitigate and prevent cyberattacks. The Audit Committee consults with management regarding ongoing cybersecurity initiatives, and requests that management to report to the Audit Committee or the full Board regularly on their assessment of the Company’s cybersecurity program and risks. Both the