Company: GEF
Filing Date: 2025-11-19
Form Type: 10-KT
Source: 0001628280-25-053146
Chunk: 35

Company: GREIF, INC
Filing Date: 2025-11-19
Form: 10-KT
Chunk 35
---
 and in other jurisdictions, could lead to substantial civil or criminal monetary and non-monetary penalties against us or our subsidiaries, and could damage our reputation. Even the allegation or appearance of our employees, agents or business partners acting improperly or illegally could damage our reputation and result in significant expenditures in investigating and responding to such actions.

## ITEM 1B. UNRESOLVED STAFF COMMENTS
None.

## ITEM 1C. CYBERSECURITY

#### Risk Management and Strategy
We recognize the importance of effective cybersecurity risk management to our operations and interests. Our cybersecurity program is designed to protect our employees, our customers and our assets through the effective identification and mitigation of cyber risks. The program, led by the Chief Information Security Officer (“CISO”) under the oversight of the Chief Information and Digital Officer (“CIDO”), encompasses a broad range of preventative, detective and responsive measures relevant to our business needs and designed to reduce our specific risks.

The cybersecurity program is modeled after and assessed against the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”). The NIST CSF is not a certification program and our use does not imply compliance with specific, related standards – the NIST CSF is used as a guide for designing and managing cybersecurity programs.

Risks and exposures associated with our cybersecurity program are integrated into our overall enterprise risk management program and share common methodologies, reporting channels and governance processes.These processes and the governance for identifying and managing risks apply across our enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.

Core elements of our cyber program include, but are not limited to:

• Risk assessments to identify cybersecurity risks that may impact us in material ways, including risks associated with our use of third-party service providers;

• Cybersecurity awareness training for our employees and ongoing technical training for cybersecurity personnel;

• Procedural and technical security controls implemented and managed by cross-functional teams;

<div align='center'>19</div>

#### Table of Contents
• An incident response plan that includes procedures for responding to cybersecurity events, including those arising from our use of third-party service providers or partners;

• Periodic evaluation of security controls through system assessments and vulnerability scanning;

• Partnerships with external providers where appropriate to supplement our internal expertise, perform security assessments and penetration testing, consult on best-practices and support incident response activities with forensic analysis.

As of September 30, 2025, we were not aware of any cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact, our operations or