Company: SDSYA
Filing Date: 2025-03-28
Form Type: 10-K
Source: 0001163609-25-000010
Chunk: 16

Company: SOUTH DAKOTA SOYBEAN PROCESSORS LLC
Filing Date: 2025-03-28
Form: 10-K
Item: Item 1C
Chunk 16
---
Item 1C. Cybersecurity.

Risk Management and Strategy

We recognize the importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information and operational technologies and protect our data's confidentiality, integrity, and availability. Our business is dependent upon our computer systems, devices, software, and networks (operational and information technology) to collect, process, and store the data necessary to conduct almost all aspects of our business, including the evaluation of acquisition and development opportunities, the monitoring and evaluation of our existing properties, the performance of any data from our operators, and the recording and reporting of financial information.

Assessing, Identifying, and Managing Material Cybersecurity Risks & Integrated Overall Risk Management. We have processes to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things, ongoing security awareness training for employees, mechanisms to detect and monitor unusual network activity, and containment and incident response tools. We regularly assess risks from cybersecurity 

12

and technology threats and monitor our information systems for potential vulnerabilities. We monitor issues that are internally discovered or externally reported that may affect our systems and have processes to assess those issues for potential cybersecurity impact or risk.

We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration is designed to include cybersecurity considerations in our decision-making processes at every level. Our IT Security Program ("ITSP") Group and third-party service providers seek to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs and coordinate with our overall risk management framework.

In the event of a cybersecurity incident, we maintain an incident response plan. This plan sets forth immediate actions to mitigate the impact of cybersecurity incidents, including referring certain matters to the our chief executive officer for additional evaluation and oversight, as well as long-term strategies for remediation and prevention of future cybersecurity incidents.

Engaging Third Parties on Cybersecurity Risk Management. Recognizing the complexity and evolving nature of cybersecurity threats, we engage with third-party service providers, including cybersecurity assessors, and consultants, to evaluate and test our cybersecurity risk management systems. This enables us to leverage knowledge and insights to align our cybersecurity strategies and processes with best practices for our industry and size. Accordingly, we engage third-party service providers for regular cybersecurity-related audits, threat assessments, and consultation on security enhancements.

Overseeing Third-Party Risk. Because we know the risks associated with engaging third-party service providers, we have implemented processes designed to oversee and manage these risks. It is our policy to