Company: JBI
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001839839-25-000032
Chunk: 90

Company: Janus International Group, Inc.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 90
---
 employees identify and properly respond to cybersecurity threats. To help assess and maintain awareness, training is supplemented with simulated phishing e-mails that are sent on a regular basis.We have cybersecurity insurance (subject to specified retentions or deductibles) related to cybersecurity incidents that addresses costs, losses, and expenses related to cybersecurity investigations, crisis management, notification processes and credit monitoring services, public relations, and legal advice. Additionally, this cybersecurity insurance may cover certain physical injury to, loss or destruction of tangible property, including loss of use thereof, or loss of use of tangible property which has not been physically injured or destroyed. However, damages, fines, and claims arising from such incidents may not be covered or may exceed the amount of any insurance available or may not be insurable.As part of its cybersecurity program, the Company deploys comprehensive measures to deter, prevent, detect, respond to and mitigate cybersecurity threats, including firewalls, anti-malware, intrusion prevention and detection systems, identity and access controls, software patching protocols, physical security measures, multi-factor authentication, and other tools to detect data exfiltration. The Company periodically assesses and tests the Company’s policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents by assessing current threat intelligence from various sources, including but not limited to, certain key vendors, the United States Cybersecurity & Infrastructure Security Agency (“CISA”), and the open source threat intelligence community via open-source threat intelligence databases. Furthermore, we conduct periodic table top exercises, vulnerability and security testing, and “lessons learned” reviews from internal and industry related cybersecurity incidents. We have a process to report material results of such testing and assessments to the Board and our Audit Committee, and periodically make adjustments to our cybersecurity program based on these exercises and reviews. The Company engages third parties to conduct certain aspects of such testing and to assist with the Managed Detection and Response (“MDR”) of security events as well as the collection and reporting of data for cybersecurity key performance indicators (i.e., KPIs). The Company seeks to identify and oversee cybersecurity risks presented by third parties and their systems from a risk-based perspective through a vendor management program, including annual reviews of key vendors’ adherence to cybersecurity compliance, the monitoring of alerts from CISA, as well as open-source threat intelligence.

Some of our IT systems and products operate within a hosted architecture or by third-party service providers, and if these third-party IT environments fail to operate properly, our systems and products (including our Nokē Smart Entry System) could stop functioning for