Company: DXPE
Filing Date: 2025-04-30
Form Type: ARS
Source: 0001020710-25-000081
Chunk: 35

Company: DXP ENTERPRISES INC
Filing Date: 2025-04-30
Form: ARS
Chunk 35
---
 of business. Changes to the legal and regulatory environments could increase the cost of doing business and could negatively affect our earnings, and such costs may increase in the future as a result of changes in these laws and regulations or in their interpretation. Our employees, contractors or agents may violate laws and regulations despite our attempts to implement policies and procedures to comply with such laws and regulations. Any such violations could individually or in the aggregate materially adversely affect our financial condition or results of operations. ITEM 1B. Unresolved Staff Comments None. ITEM 1C. Cybersecurity Risk Management and Strategy We have processes in place to identify, assess and manage material risks from cybersecurity threats. These processes are part of our overall enterprise risk management process and have been embedded in our internal controls and information systems. Our cybersecurity and information security framework includes risk assessment and mitigation through a threat intelligence- driven approach, application controls, and enhanced security with ransomware defense. The framework leverages the National Institute of Standards and Technology Cyber Security Framework (“NIST CSF”) for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley for assessment of internal controls. We contract with external firms to assess our cyber security controls relative to our peers using the NIST CSF. We also have a third-party risk management program that assesses risks from vendors and suppliers. In addition, we maintain a Business Continuity and Disaster Recovery Plan as well as a cybersecurity insurance policy. We have established cybersecurity and information security awareness training programs. Formal training on topics relating to our cybersecurity, data privacy and information security policies and procedures is mandatory at least annually for all employees, contractors and third parties with access to our network. Training is administered and tracked through online learning modules. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. Based on role and location, some employees receive additional in-depth training to provide more comprehensive knowledge on potential risks related to their individual job responsibilities. Training is supplemented through regular company-wide communications with frequent updates to educate on the latest adversary trends and social engineering techniques. Additionally, we engage in cyber crisis response simulations to assess our ability to adapt to information and operational technology threats. Improper or illegitimate use of our information system resources or violation of our information security policies and procedures is subject to disciplinary action. Our security posture is supported by a comprehensive defense-in-depth strategy that relies on layers of technology including Multi-Factor Authentication to ensure that access to information and communication is vetted and secure. We also utilize