Company: JBI
Filing Date: 2025-04-10
Form Type: PRE 14A
Source: 0001140361-25-013248
Chunk: 35

Company: Janus International Group, Inc.
Filing Date: 2025-04-10
Form: PRE 14A
Chunk 35
---
 important part of our Enterprise Risk Management (“ERM”) program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach. The Company’s cybersecurity policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats and responding to cybersecurity incidents are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. The Company has established certain controls and procedures, including an Incident Response Plan, that provide for the identification, analysis, notification, escalation, communication, and remediation of data security incidents at appropriate levels so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In particular, the Company’s Incident Response Plan: (i) is designed to identify and detect information security threats through various mechanisms, such as through security controls and third-party disclosures; and (ii) sets forth a process to (a) analyze any such threats detected within the Company’s IT environment or within a third-party’s IT environment, (b) contain cybersecurity threats under various circumstances, and (c) better ensure the Company can recover from cybersecurity incidents to a normal state of business operations. The Company has established and maintains other incident response and recovery plans that address the Company’s response to a cybersecurity incident. All new hires are required to complete mandatory cybersecurity awareness training upon joining the Company. Follow-on training is then assigned to all employees on a regular basis. Training assignments reinforce the Company’s security and information technology acceptable use policies, while also helping employees identify and properly respond to cybersecurity threats. To help assess and maintain awareness, training is supplemented with simulated phishing e-mails that are sent on a regular basis. We have cybersecurity insurance (subject to specified retentions or deductibles) related to cybersecurity incidents that addresses costs, losses, and expenses related to cybersecurity investigations, crisis management, notification processes and credit monitoring services, public relations, and legal advice. Additionally, this cybersecurity insurance may cover certain physical injury to, loss or destruction of tangible property, including loss of use thereof, or loss of use of tangible property which has not been physically injured or destroyed. However, damages, fines, and claims arising from such incidents may not be covered or may exceed the amount of any insurance available or may not be insurable. As part of its cybersecurity program, the Company deploys comprehensive measures to deter, prevent, detect, respond to and mitigate cybersecurity threats, including firewalls, anti-malware, intrusion prevention and detection systems, identity and