Company: DXPE
Filing Date: 2025-05-01
Form Type: DEF 14A
Source: 0001020710-25-000087
Chunk: 22

Company: DXP ENTERPRISES INC
Filing Date: 2025-05-01
Form: DEF 14A
Chunk 22
---
 to risk management in the areas of financial reporting, internal controls and compliance with legal and regulatory requirements.

• The Compensation Committee assists with respect to management of risks related to executive succession and retention and arising from our executive compensation policies and programs.

• The IT and Cybersecurity Committee assists with respect to management of risks related to the cybersecurity program and information security framework, including: (i) strategy and governance; (ii) operations; and (iii) risk management.

• The Nominating and Governance Committee assists with respect to management of risks associated with Board organization and membership, and other corporate governance matters, as well as company culture and ethical compliance.

#### DXP ENTERPRISES, INC. 2025 PROXY STATEMENT25
We have assessed the risks arising from DXP's compensation policies and practices for employees, including the executive officers. The findings were reviewed with the Compensation Committee. Based on the assessment, we believe our compensation policies and practices do not encourage excessive risk-taking and are not reasonably likely to have a material adverse effect on DXP.

| SPOTLIGHT: OVERSIGHT OF CYBERSECURITY RISK                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| DXP's cybersecurity strategy and risk management program focuses on maintaining a secure environment for our data that complies with applicable legal requirements and effectively supports our business objectives and customer needs. Our commitment to cybersecurity emphasizes cultivation of a security-minded culture through education and training, and a programmatic and layered approach to prevention and detection of, and response to, cybersecurity threats. Key elements of our program include:                                                                                                                                                                                                                                                                                                                                                                                                                                                      
 •cybersecurity policies that articulate our expectations and requirements with respect to topics such as acceptable use of technology and data, data privacy, risk management, education and awareness and event and incident management;                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             
 •regular education of and sharing best practices with our associates to raise awareness of cybersecurity threats;                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     
 •assessment of information technology/cybersecurity risks as part of DXP’s annual Enterprise Risk Management program;                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 
 •maintenance of cyber insurance in amounts and subject to coverage terms that are typical for companies of our type and size (however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches); and                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 
 •periodic engagement of external consultants to assess our cybersecurity program.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     
 We also strive to implement and maintain layered controls designed