Company: NC
Filing Date: 2025-03-05
Form Type: 10-K
Source: 0000789933-25-000006
Chunk: 90

Company: NACCO INDUSTRIES INC
Filing Date: 2025-03-05
Form: 10-K
Item: Item 1C
Chunk 90
---
Table of Contents

Item 1C. CYBERSECURITY

Cybersecurity continues to be a key governance priority for us. NACCO maintains a cybersecurity program that is aligned with our business and has established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, which have been integrated into our overall risk management processes and governance structure. 

We have implemented and invested in, and will continue to implement and invest in, controls, technologies, and resources (both internal and external) that are designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with frameworks established by the National Institute of Standards and Technology. These include, but are not limited to, internal reporting mechanisms, monitoring and detection tools, threat intelligence, and general and role-based training. NACCO's commitment to cybersecurity emphasizes cultivating a security-minded culture through education and training that reflect best practices and improved cybersecurity awareness. We also maintain third party management processes to identify and manage the cybersecurity risks associated with third party service providers. We periodically evaluate our cybersecurity program internally and by engaging with consultants to conduct reviews and assessments of the program. Such reviews and assessments may include penetration testing, maturity assessments as well as table-top and other exercises with subsequent remediation of key findings. Additionally, we have a Cybersecurity Task Force in place that is comprised of individuals across various departments within our organization including information systems, legal, finance, human resources and internal audit which meets regularly to further advance our cybersecurity strategy.

Our Board of Directors (Board) oversees NACCO's risk management. Our full Board regularly reviews information provided by management to oversee risk identification, risk management and risk mitigation strategies. The Audit Review Committee assists the Board with cybersecurity risk oversight. The Audit Review Committee is responsible for regularly reviewing and discussing with management risk exposure relating to cybersecurity, which includes reviewing the state of our cybersecurity program and emerging cybersecurity developments and threats, as well as the steps management has taken to monitor and mitigate such exposure. In 2024, our Board and the Audit Review Committee received periodic updates throughout the year on cybersecurity matters and these updates are part of their standing agendas.

Our Chief Information Security Officer (CISO) leads NACCO's cybersecurity program and is responsible for the management of our cybersecurity risks. The CISO has extensive cybersecurity knowledge and skills gained from over 30 years of technical and business experience, including as General Manager & President of MLMC, Vice President of Mississippi Operations and Vice President of Innovation & Technology. The CISO holds a bachelor’s degree in engineering