Company: AIRTP
Filing Date: 2025-06-27
Form Type: 10-K
Source: 0000353184-25-000044
Chunk: 174

Company: AIR T INC
Filing Date: 2025-06-27
Form: 10-K
Item: Item 1C
Chunk 174
---
 policies, processes, procedures, and any significant development related to the identification, mitigation and remediation of cybersecurity risks. The Audit Committee ensures that the Sr Director of Tech provides to the Board of Directors annual updates on our cybersecurity 

28

and information technology risk. These annual updates include topics related to our cybersecurity programs and mitigation strategies, trends in cybersecurity, and other cybersecurity-related developments.  We may engage third-party advisors to monitor threats and to scan for vulnerabilities. When a cybersecurity threat or incident is identified by our third-party advisor, it is reported directly to our Sr Director of Tech. The Sr Director of Tech in conjunction with professionals throughout the organization, including information technology specialists, accountants, and lawyers, determine severity and response, then manage it to conclusion in accordance with our cybersecurity incident response processes. We may engage third party advisors as part of our incident response processes to assist with digital forensics among other efforts. The Sr Director of Tech, together with the cross-functional team, report material or potentially material incidents to our executive leadership and the Audit Committee. The Sr Director of Tech provides further updates regarding root causes and remediation efforts. In the event the Company determines it has experienced a material cybersecurity incident the Board of Directors is notified. In an effort to deter and detect cyber threats, we engage a third-party service provider to periodically provide all employees with a data protection and cybersecurity awareness training program, which covers timely and relevant topics, including phishing, password protection, confidential data protection, asset use and mobile security, and further educates employees on the importance of and process for reporting all potential incidents immediately.

The Company continuously monitors the risk associated with its third-party service providers. The Company mandates that our key third-party service providers undergo an annual SOC 1 audit, which assist in identifying risks from cybersecurity threats. In cases where a waiver is granted, the Company ensures that alternative measures are in place to maintain rigorous oversight. The Company reviews all SOC1 audit reports to ensure our third-party service providers are maintaining adequate IT security and business process controls. This review process is part of our commitment to confirming that these third-party service providers are safeguarding our operations and data integrity.  We have not identified any cybersecurity threats during the last two fiscal years that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Please refer to our Risk Factors in Item 1A for more information on the risks associated with cybersecurity attacks.