Company: CODI-PB
Filing Date: 2025-12-08
Form Type: 10-K/A
Source: 0001345126-25-000078
Chunk: 125

Company: Compass Diversified Holdings
Filing Date: 2025-12-08
Form: 10-K/A
Chunk 125
---
 regulations, including but not limited to those related to safety, employment, discrimination, harassment, whistle-blowing, privacy, corporate citizenship or improper business practices. Additionally, the value of our businesses’ brands may be harmed if our businesses fail to protect their intellectual property. Any harm to the brand or reputation of our subsidiaries could have a material adverse effect on our profitability and financial condition.

## ITEM 1B. UNRESOLVED STAFF COMMENTS
NONE

<div align='center'>76</div>

## ITEM 1C. CYBERSECURITY

### Risk Management and Strategy
Cybersecurity risk management and strategy is overseen both as a critical component of our overall risk management program and as a standalone program. We have implemented a risk-based, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity program is designed to leverage people, processes, and technology to identify and respond to cybersecurity threats. We also engage external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes. We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which may include risk assessments using applicable industry specific cybersecurity frameworks, control gap analyses, penetration testing, vulnerability scanning, cyber insurance that aligns with our subsidiaries' risk profiles and internal or third-party assessments.

We are committed to protecting the security and integrity of our systems, networks, databases and applications. We routinely invest to develop and implement cybersecurity programs and processes, including risk management and assessment programs, security and event monitoring capabilities, and prevention and protection capabilities. Our employees undergo annual security awareness training to enhance their understanding of cybersecurity threats and their ability to identify and escalate potential cybersecurity events. We regularly assess cybersecurity risks to identify and enumerate threats to us and vulnerabilities these threats can exploit to adversely impact our business operations.

We also apply a risk-based approach to mitigate cybersecurity risks associated with our use of third-party service providers, including those in our supply chain that have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk process. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers.

Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they