Company: SPH
Filing Date: 2025-11-26
Form Type: 10-K
Source: 0001193125-25-298630
Chunk: 17

Company: SUBURBAN PROPANE PARTNERS LP
Filing Date: 2025-11-26
Form: 10-K
Item: Item 1B
Chunk 17
---
 to enhance our cybersecurity posture, assist us in evaluating risks, conduct security assessments and provide guidance so we can maintain a posture of continual enhancement of our cybersecurity risk management program and strategy;•continuous and updated cybersecurity awareness training for our employees, incident response personnel and senior management; and•a risk management process for critical third-party service providers and vendors that includes due diligence in the selection of third-parties and vendors and the periodic monitoring thereof to ensure that they adhere to applicable cybersecurity standards.Cybersecurity GovernanceOur Board of Supervisors is responsible for overseeing our enterprise risk relative to cybersecurity governance through the Audit Committee of the Board, with specific responsibility for overseeing cybersecurity threats, among other things.  Our CRT is led by the Senior Vice President of Information Services (“SVP, Information Services”), who reports to the Partnership’s CEO and is responsible for assessing and managing material cybersecurity risks and threats, in coordination with the ISBRT and the IMT, and regularly reports to the Audit Committee with regard to the Partnership’s cybersecurity governance efforts.  The SVP, Information Services has served in this role since 2014, and has more than 28 years of experience in various roles involving managing cybersecurity functions, developing cybersecurity strategies to protect privacy, customer safety and intellectual property, and developing key capabilities such as product security engineering, risk management and cybersecurity governance. The ISBRT, CRT, IMT and the Audit Committee of the Board all play a role in the monitoring, prevention, mitigation, detection and remediation of cybersecurity incidents through their management and oversight of, and participation in, the cybersecurity risk management and strategy processes described above. As of the date of this Annual Report, we are not aware of any risks of, or actual, cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition and that are required to be reported in this Annual Report.  For further discussion of the risks