Company: SENEA
Filing Date: 2025-06-12
Form Type: 10-K
Source: 0001437749-25-020197
Chunk: 183

Company: Seneca Foods Corp
Filing Date: 2025-06-12
Form: 10-K
Item: Item 1C
Chunk 183
---
Risk Management and Strategy

The Company’s cybersecurity risk management program is integrated with its overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across functions to other legal, compliance, strategic, operational, and financial risk areas.

The Company designs and assesses the cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”). The Company uses the NIST CSF as a guide to help identify, assess, and manage cybersecurity risks relevant to its business; this does not imply that the Company’s cybersecurity program meets any particular technical standards, specifications, or requirements.

The cybersecurity risk management program is grounded in a zero-trust framework and employs a multi-layered approach, including:

			●

			Awareness and training for employees, involving phishing campaigns, informational sessions at management meetings, and annual mandatory training with simulations of common cybersecurity threats;

			●

			Security tools and technologies, along with control policies and active review procedures which strengthen authentication and access protection;

			●

			Third-party risk management process and monitoring procedures for service providers, suppliers, and vendors who have access to critical systems and information;

			●

			Risk and vulnerability management encompassing both proactive and predictive defenses which provides opportunities to assess, remediate, and validate; and

			●

			Managed detection and incident response, including advanced endpoint protection and data loss prevention.

In evaluating the risks identified as a part of the annual assessment process, the Company’s information technology team considers the likelihood and severity of the respective risk and the potential impact of the risk on the Company, its customers, and its employees. These risks are then prioritized and monitored by the information technology team.

The Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems to assess its cybersecurity readiness and maturity of the cybersecurity program. Tests are conducted by the information technology team and reputable third-party consultants and auditors. In developing and evaluating the testing procedures, the Company considers both its individual risks and industry standards.

The cybersecurity risk management program includes an incident response plan with a cross-functional team comprised of designated members of the information technology department, senior management, and other appropriate individuals. The team is responsible for assessing and managing the cybersecurity incident response process, as outlined within the incident response plan, and taking necessary corrective actions to mitigate and eliminate the issue.

As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to