Company: CVCO
Filing Date: 2025-05-23
Form Type: 10-K
Source: 0000278166-25-000057
Chunk: 37

Company: CAVCO INDUSTRIES, INC.
Filing Date: 2025-05-23
Form: 10-K
Item: Item 1C
Chunk 37
---
Table of Contents

ITEM 1C. CYBERSECURITY

Cybersecurity Risk Management and StrategyWe maintain a comprehensive cybersecurity risk management program modeled by relevant standards provided by organizations such as the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization (27001 - Information Security Standard). Our cybersecurity program is part of our enterprise risk management strategy and includes policies and procedures designed to safeguard the confidentiality, integrity, and availability of our information assets. Our cybersecurity program includes an incident response plan. Our incident response plan addresses the detection, reporting, analysis, response, recovery, communication, documentation, and post-incident review of cybersecurity incidents. We test and evaluate this plan on a routine basis. We train our team members on cybersecurity risks and mitigation and retain experienced third-party cybersecurity consultants prepared to assist us in the event of any breach. For material cybersecurity risks, we've developed mitigation measures to reduce each risk's likelihood of occurrence and/or its expected impact. Such mitigation measures have involved, among other things, implementing additional technology controls or policies, increased training for Company personnel, and obtaining additional insurance for the identified risk. Our Information Technology ("IT") team monitors material risks over time and updates the Company's mitigation measures as appropriate. The IT team also regularly reports to the Company's leadership team on the status of material risks, mitigation measures, and incidents related to such risks. In addition to our incident response plan, we perform risk assessments throughout the year to identify and remediate potential cybersecurity threats and vulnerabilities. In connection with our assessment of potential cybersecurity risks, our IT team engages in threat modeling, vulnerability scanning and penetration testing. We have also implemented a process to evaluate and review potential cybersecurity risks arising from our use of third-party vendors. As part of our vendor engagement protocols, we will consider, among other things, each potential vendor's data backup procedures, incident reporting protocols and data privacy and encryption practices. In addition to our internal exercises to test aspects of our cybersecurity program, we engage independent third parties annually to assess the risks associated with our IT resources and information assets. Among other matters, these third parties analyze information on the interactions of users of our information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity systems and processes. Annually, we examine our cybersecurity program with these third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as those set by NIST as guidelines.For a discussion of how risks from cybersecurity threats affect our business, see “Part 1