Company: CAPL
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-028082
Chunk: 105

Company: CrossAmerica Partners LP
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1B
Chunk 105
---
 other members of our senior management team and other internal stakeholders. This plan is designed to provide our executive officers and other members of our senior management team with the information needed to assess the materiality of a cybersecurity incident and the need for public disclosure. Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties and Topper Group employees) and other data, confidential information or intellectual property. To date, these incidents have not had a material impact on our service, systems or business and we do not believe cybersecurity risks from these prior incidents are reasonably likely to materially affect our operations. For further information on cybersecurity risks and potential related impacts on us, see "Risk Factors – Our business and our reputation could be adversely affected by the failure to protect sensitive customer, Topper Group employee or the Partnership's vendor data, whether as a result of cyber security attacks or otherwise, or to comply with applicable regulations relating to data security and privacy." The Director of Technology Services is responsible for overseeing the information security program as well as members of the Information Technology department that execute our program with oversight by members of our senior leadership team. These members of our Information Technology department have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance and systems. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Board on any appropriate items. The Board oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Board receives regular reports from our Director of Technology Services on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.

ITEM 2. PROPERTIES

The following table shows the aggregate number of sites we owned or leased by customer group at December 31, 2024:

    OwnedSites

    LeasedSites

    TotalSites

    Lessee dealers

    267

    227

    494

    Company operated

    213

    152

    365

    Commission agents

    166

    55

    221

    Total

    646

    434

    1