Company: NC
Filing Date: 2025-04-07
Form Type: ARS
Source: 0000789933-25-000013
Chunk: 68

Company: NACCO INDUSTRIES INC
Filing Date: 2025-04-07
Form: ARS
Chunk 68
---
, financial condition and results of operations. Security breaches, cyber incidents or cyber attacks could include, among other things, computer viruses, malicious or destructive code, ransomware, social engineering attacks (including phishing and impersonation), hacking, denial of service attacks and other attacks. Cybersecurity threats to, and incidents involving, vendors and other third-parties who support our activities could impact the business. We are continuously installing new and upgrading existing information technology systems. We use employee awareness training around phishing, malware, and other cyber risks. We believe these incidents are likely to continue and are unable to predict the direct or indirect impact of future attacks or breaches to business operations. Our operations could be disrupted by natural or human causes beyond our control. Our operations are subject to disruption from natural or human causes beyond our control, including physical risks from hurricanes, severe storms, floods and other forms of severe weather, accidents, fires, earthquakes, terrorist acts and epidemic or pandemic diseases, any of which could result in suspension of operations or harm to people or the environment. While all of our operations are located in the United States, we participate in a global supply chain, and if governments regulate or restrict the flow of labor or products or impede the travel of our personnel, our ability to conduct normal business operations could be impacted which could adversely affect our results of operations and liquidity. Item 1B. UNRESOLVED STAFF COMMENTS None. 27

Item 1C. CYBERSECURITY Cybersecurity continues to be a key governance priority for us. NACCO maintains a cybersecurity program that is aligned with our business and has established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, which have been integrated into our overall risk management processes and governance structure. We have implemented and invested in, and will continue to implement and invest in, controls, technologies, and resources (both internal and external) that are designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with frameworks established by the National Institute of Standards and Technology. These include, but are not limited to, internal reporting mechanisms, monitoring and detection tools, threat intelligence, and general and role-based training. NACCO's commitment to cybersecurity emphasizes cultivating a security-minded culture through education and training that reflect best practices and improved cybersecurity awareness. We also maintain third party management processes to identify and manage the cybersecurity risks associated with third party service providers. We periodically evaluate our cybersecurity program internally and by engaging with consultants to conduct reviews and assessments of the program. Such