Company: DXPE
Filing Date: 2025-03-10
Form Type: 10-K
Source: 0001020710-25-000036
Chunk: 137

Company: DXP ENTERPRISES INC
Filing Date: 2025-03-10
Form: 10-K
Item: Item 1C
Chunk 137
---
 responsibilities include:•reviewing our enterprise cybersecurity strategy and framework, including our assessment of cybersecurity threats and risk, data security programs, and our management and mitigation of cybersecurity and information technology risks and potential breach incidents;•reviewing any significant cybersecurity incident that has occurred, reports to or from regulators with respect thereto, and steps that have been taken to mitigate against reoccurrence;•evaluating the effectiveness of our cyber risk management and data security programs measured against our cybersecurity threat landscape;•assessing the effectiveness of our data breach incident response plan;•reviewing and assessing our information technology disaster recovery capabilities; and•reviewing our assessment of cybersecurity threats and risk associated with our supply chain and actions we are taking to address such threats and risks.The Cybersecurity Committee receives reports and updates at committee meetings from our Chief Information Officer (“CIO”) and other executives and cybersecurity specialists. Following each committee meeting, the chair of the Cybersecurity Committee briefs the full board of directors on matters covered at the prior Cybersecurity Committee meeting. The board also receives periodic briefings on emerging trends in order to enhance its literacy on cybersecurity issues. At least annually, the Cybersecurity Committee receives updates about the results of the Cybersecurity Program reviews.The Cybersecurity Committee participates with management periodically in “tabletop” exercises to evaluate our data breach incident response plan.

Management’s Role and Expertise in Assessing and Managing Cybersecurity

Our Cybersecurity and Information Technology organization is led by our CIO, who is responsible for cybersecurity risk management. Our CIO has more than 27 years of experience in the IT industry. Since 2006, he has held multiple roles at the Company and most recently as Vice President of IT Strategic Solutions.Our cybersecurity incident response framework is governed by a corporate Cybersecurity Incident Response Plan (the “IRP”), which sets out our approach for categorizing, responding to, and mitigating cybersecurity incidents. The IRP provides definitions of key terms, stakeholder roles and responsibilities, and a response governance and escalation process.We have an incident response team comprised of our CIO, executive leaders, management, and internal and external legal counsel, whose primary responsibilities include:•evaluating and validating the impact of an incident;•approving certain incident response countermeasures and remediation actions;•escalating incidents and response countermeasures for approval; and•acting in an advisory capacity in support of cybersecurity incident remediation, as appropriate.We maintain a Business Continuity and Disaster Recovery Plan that addresses our preparation for, management, recovery from, and ultimate res