Company: NGVC
Filing Date: 2025-12-11
Form Type: 10-K
Source: 0001437749-25-037556
Chunk: 39

Company: Natural Grocers by Vitamin Cottage, Inc.
Filing Date: 2025-12-11
Form: 10-K
Item: Item 1A
Chunk 39
---
 independent directors with a written charter addressing the nominations process; and

			●

			that the compensation of our executive officers be determined, or recommended to the Board for determination, by a majority of independent directors in a vote by independent directors, or a compensation committee composed solely of independent directors.

Accordingly, for so long as we are a “controlled company,” stockholders will not have the same protections afforded to stockholders of companies that are subject to all of the NYSE corporate governance requirements.

Item 1B. Unresolved Staff Comments.

None.

Item 1C. Cybersecurity.

Risk Management and Strategy

We rely on computer systems and information technology to conduct our business, including to securely transmit data associated with cashless payments. These systems and technology are increasingly complex and vital to our operations, which has resulted in an expansion of our technological presence and corresponding risk exposure. In addition, these systems are inherently vulnerable to disruption or failure, as well as internal and external security breaches, denial of service attacks and other disruptive problems caused by cybersecurity threat actors. We have not experienced any cybersecurity incidents that have materially impacted or are likely to materially impact our business strategy, results of operations or financial condition based on information known to us as of the date of this report. Under the oversight of our Board, our management has developed a cybersecurity risk management program based on the Center for Internet Security Critical Security Controls framework that is integrated with our overall risk management program and is designed to assess, identify, manage and mitigate material cybersecurity risks. Our cybersecurity program includes policies and procedures that govern how security measures and controls are implemented and maintained. We identify and implement security controls to address cybersecurity risks based on an annual risk assessment and our evaluation of relevant factors, including the likelihood of risk, the potential impact and severity of the risk, the feasibility and expense of potential controls, and the impact of controls on our operations. Our cybersecurity program includes regular security assessments and testing, regular employee trainings, third-party security audits, and solutions designed to detect and mitigate cybersecurity threats, including data breaches, malware, ransomware and phishing attacks.

We utilizethird party security firms and consultants to test our cybersecurity control environment and to provide certain security measures that we use to protect our information technology environment, including to detect and filter external phishing and malware threats, to provide enhanced endpoint protection and to protect our data through data classification. We have developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.

We have prepared a written incident response plan and crisis