Company: CVCO
Filing Date: 2025-06-16
Form Type: DEF 14A
Source: 0000278166-25-000097
Chunk: 29

Company: CAVCO INDUSTRIES, INC.
Filing Date: 2025-06-16
Form: DEF 14A
Chunk 29
---
, one of which is from an underrepresented group. The Board, our management team, and all of our employees are subject to a formal Code of Conduct and business ethics. Our Board is also governed by Corporate Governance Guidelines which, along with the charters of each Board committee and numerous additional policies, are reviewed periodically by our Board.

We are subject to rigorous controls, quarterly financial reviews, and annual audits. The Board oversees our audit, compliance, and enterprise risk management practices. Further, our compliance and risk management teams engage regularly with subject-matter experts to identify, monitor, and mitigate material risks.

We protect the voting rights of all of our shareholders by having one class of stock that entitles each shareholder to one vote per share of common stock owned. Our Directors and employees are subject to an insider trading policy to ensure compliance with federal and state securities laws. Our Directors and senior management team are also subject to Stock Ownership Guidelines which align their interests with the long-term performance of the Company and the interests of our shareholders.

### IT Security and Cybersecurity Risk Management
As we disclosed in our 2025 Annual Report on Form 10-K, we maintain a comprehensive cybersecurity risk management program modeled by standards provided by organizations such as the National Institute of Standards and Technology and the International Organization for Standardization. Our cybersecurity program includes an incident response plan that addresses the detection, reporting, analysis, response, recovery, communication, documentation, and post-incident review of cybersecurity incidents. We test and evaluate this plan on a routine basis. For material cybersecurity risks, we’ve developed mitigation measures to reduce the risk’s likelihood of occurrence and/or its expected impact. We perform risk assessments throughout the year to identify and remediate potential cybersecurity threats and vulnerabilities. Our Board has delegated oversight of risks related to cybersecurity to the Legal and Compliance Oversight Committee and the review of materiality determinations of cyber incidents to the Audit Committee.

We also maintain an information security program to protect our information assets, including customer and consumer data. Our IT team works 24/7 and uses a combination of industry-leading tools and in-house innovative technologies to help protect our data. Our team members are responsible for complying with our data security standards and completing mandatory annual training to understand the behaviors and technical requirements necessary to keep customer information secure. We also provide ongoing education for team members to recognize and report suspicious activity. The primary goal of our data security program is to maintain defenses consistent with sound industry practices.

We believe these elements combined with a strategically selected Board and senior management team committed to a strong corporate governance culture