Company: OFIX
Filing Date: 2025-04-30
Form Type: DEF 14A
Source: 0000950170-25-061062
Chunk: 23

Company: Orthofix Medical Inc.
Filing Date: 2025-04-30
Form: DEF 14A
Chunk 23
---
 including in connection with material litigation and legal compliance matters. The Board also receives updates at quarterly in-person or virtual Board meetings on committee activities from each committee Chair. In addition, the senior executive of each Company division or business unit periodically reviews and assesses the most significant risks associated with his division or unit. These assessments are then aggregated by our management team and presented to the Board. The Board regularly discusses with management these risk assessments and includes risk management and risk mitigation as part of its oversight of the enterprise risk management program and its ongoing strategic planning process.

<div align='center'>15</div>

Cybersecurity Risk Management

We have implemented cybersecurity programs designed to maintain and protect our information technology systems and the confidentiality, integrity, and availability of our data. These programs serve to maintain compliance with applicable laws and regulations governing ethical business practices, including our relationships with suppliers, customers, and business partners. We engage third parties as part of our cyber program, including external security firms that provide security technology, conduct regular security audits, and conduct penetration testing. We also engage third parties to conduct regular drills, such as tabletop exercises, to help with our overall preparedness. Our employees are responsible for complying with our data security standards and are required to complete annual training to understand the behaviors and technical requirements necessary to keep data secure. We also require that cybersecurity training be part of the onboarding process for new hires. Cybersecurity is an important component of our enterprise risk management program. The Board of Directors Audit and Finance Committee has oversight over and regularly reviews our cybersecurity, including IT risks, controls, procedures, and plans to mitigate cybersecurity risks and respond to security incidents. The Audit and Finance Committee receives reports on at least a quarterly basis on, among other issues, our cyber risks and threats, the status of projects, management’s strategies to strengthen our IT systems, assessments of our security program, third-party assessments and testing, our emerging threat landscape, and the review of our cybersecurity insurance policy. Pursuant to our incident response procedures, material cyber incidents will be reported to the Chair of the Audit and Finance Committee upon a determination of material status. Due to the importance of cybersecurity, the full Board also receives updates on cybersecurity matters from management at least annually.

Corporate Code of Conduct

We maintain a corporate code of conduct (“Code of Conduct”) that is applicable to our directors and all employees worldwide, inclusive of executive officers. The Code of Conduct is available for review under the “Investors > Governance > Governance Documents” section of our website at www.orthofix.com.

The