Company: HOVVB
Filing Date: 2025-12-22
Form Type: 10-K
Source: 0001753926-25-001938
Chunk: 33

Company: HOVNANIAN ENTERPRISES INC
Filing Date: 2025-12-22
Form: 10-K
Item: Item 1C
Chunk 33
---
Risk Management and Strategy
As part of our Enterprise Risk Management function, which is led by our Chief Financial Officer, we have implemented processes to assess, identify and manage material risks facing the Company, including cyber threats. In fulfilling his Enterprise Risk Management responsibilities, our Chief Financial Officer collaborates closely with members of senior management and others, including outside experts. Our cybersecurity program maps to standards published by The National Institute of Standards and Technology. We believe that our processes provide us with a comprehensive assessment of potential cyber threats. On a regular basis, we conduct scans, penetration tests and vulnerability assessments of our systems. Our processes to assess, identify and manage the material risks from cyber threats includes risks arising from threats associated with third-party service providers, including cloud-based platforms.
We have developed a robust Cybersecurity Incident Response Plan which provides a documented framework for assessing cyber threats, managing high severity security incidents and facilitating coordination across multiple platforms throughout the Company and with outside agencies like the Federal Bureau of Investigation. Our cybersecurity team uses advanced tools to constantly monitor emerging threats and respond to potential cybersecurity incidents. In addition, we periodically perform simulations and drills, including tabletop exercises, aimed at evaluating the Company’s cybersecurity preparedness. 
Internally, we have a Cybersecurity Awareness Program which includes annual training that reinforces our information technology and security policies, standards and practices. Our annual training includes education on how to identify potential cybersecurity risks and ways to protect our resources and information. This training is mandatory for all associates on an annual basis, and it is supplemented by testing initiatives, including periodic phishing tests. In addition, we distribute ongoing educational communications, such as newsletters on cybersecurity awareness and hot topics, throughout the year. We also provide additional specialized security training for our cybersecurity operations team, including attendance at cybersecurity conferences and training seminars, breach simulation exercises and personal accreditation training.
From time to time, we engage third-party vendors or service providers to enhance our risk mitigation efforts. For instance, we have periodically engaged an independent cybersecurity advisor to lead a live cybersecurity crisis simulation exercise with our senior management to prepare for a possible cybersecurity incident. In addition, we have engaged other outside assessors, consultants and third parties in connection with enhancing our cybersecurity program. We purchase insurance to protect us against the risk of cybersecurity breaches. Our Enterprise Risk Management function, along with our insurance broker, are responsible for our insurance programs and on a consistent basis our cybersecurity insurance policies are reviewed to assess whether we have appropriate coverage. Enterprise Risk Management also presents updates on our cybersecurity liability insurance to our Board of Directors, including industry