Company: ASTE
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000792987-25-000013
Chunk: 52

Company: ASTEC INDUSTRIES INC
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 52
---
 people, products and processes. An implementation of this scale is a major financial undertaking and has, and will continue to, require substantial time and attention of management and key employees. We may not be able to successfully implement our ERP system without delays related to resource constraints or challenges with the critical design phases of the implementation. Inefficiencies in our financial reporting processes due to the conversion to our new ERP could adversely affect our ability to produce accurate financial statements on a timely basis until the new ERP and processes have matured. Furthermore, we may incur higher than anticipated costs in connection with our ERP implementation, which could adversely impact our results of operations and financial condition. Additionally, the effectiveness of our internal control over financial reporting could be adversely affected if the new ERP is not successfully implemented.

ITEM 1B. UNRESOLVED STAFF COMMENTS

None.

18

Table of Contents

ITEM 1C. CYBERSECURITY

Risk Management and Strategy

We have developed and implemented a comprehensive cybersecurity strategy and risk management program that is informed by the following key elements:•Periodic cybersecurity program maturity assessments to evaluate the overall controls, processes, skills and platforms leveraged to assess, identify and manage material risks from cybersecurity threats.•Periodic business impact assessments of key business processes and services that enable us to identify sensitive and critical aspects of the business, the impact of operational disruptions to those processes and services and the sensitivity of the data leveraged in those processes and services.•An external assessment of the cybersecurity risks associated with our operations.•Periodic penetration testing of our internal and external IT environment to validate the real-world efficacy of our cybersecurity program and mitigate the risks of new cybersecurity vulnerabilities.We utilize internal information technology resources for the primary aspects of our cybersecurity program. Our internal team is supported by external service providers and consultants as needed.We utilize third-party service providers to manage portions of our business operations. We have established processes to review, identify and manage cybersecurity risks associated with the use of service providers. Prior to engaging these providers, we review the providers' SOC 2 Type II or other relevant security audit reports to ensure proper security controls are in place. We evaluate the service providers' controls for incident response strategy to identify any significant risks and adapt accordingly. We systematically review these assessments for any significant change throughout the relationship. Our risk management program consistently monitors for risk to our systems and services presented by these service providers and promotes strategies to address any threats identified.To reduce the risk that we are materially impacted by a cybersecurity incident, we employ a multi-layered defense approach to cybersecurity leveraging our