Company: CVCO
Filing Date: 2025-05-23
Form Type: 10-K
Source: 0000278166-25-000057
Chunk: 38

Company: CAVCO INDUSTRIES, INC.
Filing Date: 2025-05-23
Form: 10-K
Item: Item 1C
Chunk 38
---
. Item 1A. Risk Factors – Risk Related to our Business – Information technology failures or cyber incidents could harm the Company's business” in this Annual Report. As of the date of this Annual Report, we do not believe that any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to have a material adverse effect on us, our business strategy, results of operations, or financial condition.

Cybersecurity Governance

Our Board has overall responsibility for risk oversight, with its committees assisting the Board in performing this function based on their respective areas of expertise. Our Board has delegated oversight of risks related to cybersecurity to the Legal and Compliance Oversight ("LCO") Committee and the review of materiality determinations of cybersecurity incidents to the Audit Committee. 

27

Table of Contents

The LCO Committee is charged with, among other responsibilities, reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. Further, the LCO Committee receives periodic reports on cybersecurity risks and management of those risks from our Senior Director of IT Governance, Risk and Compliance (“Senior Director”). The Senior Director's presentations to the LCO Committee include assessments of cyber risks, the threat landscape, updates on incidents, and reports on our investments in cybersecurity risk mitigation and governance.The Chair of the Audit Committee is regularly informed by our CFO of both material and non-material cybersecurity risks and incidents. The full Audit Committee must be notified any time our incident response program has determined that a cybersecurity incident is material or requires reporting to a regulatory body.Our cybersecurity team is led by our Senior Director who reports directly to our Chief Financial Officer and is responsible for assessing and managing cybersecurity risks. The Senior Director is a Certified Information Security Professional and a Certified Information Systems Auditor with over 20 years of experience evaluating and remediating IT risk and leads security control implementation, risk and compliance monitoring, security tool management, and incident response planning. Reporting to the Senior Director, the Director of Information Security possesses expert knowledge in threat modeling and vulnerability testing methodologies. The Director of Information Security leads efforts to build security into all IT processes and procedures to protect against risks related to data leakage, broken authentication, injection flaws, improper encryption, and attacks on other application vulnerabilities.

28