SUPERIOR GROUP OF COMPANIES, INC. 10-K Cybersecurity GRC - 2024-03-13

Page last updated on April 11, 2024

SUPERIOR GROUP OF COMPANIES, INC. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-03-13 18:01:13 EDT.

Filings

10-K filed on 2024-03-13

SUPERIOR GROUP OF COMPANIES, INC. filed an 10-K at 2024-03-13 18:01:13 EDT
Accession Number: 0001437749-24-007685

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity Cybersecurity Risk Management and Strategy We recognize the increasing volume and sophistication of cyber threats and take our responsibility to protect the information and systems under our purview seriously. We consider cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. Our cybersecurity processes aim to provide a comprehensive approach to assess, identify, manage, mitigate, and respond to cybersecurity threats. We maintain a cybersecurity risk program predicated on a risk-based approach. We use cost-effective controls that are commensurate with the risk and sensitivity of our specific information systems, control systems and enterprise data. Our cybersecurity program incorporates best practices and industry standards from multiple sources and is designed to comply with applicable regulations. The cybersecurity program includes, but is not limited to, the following elements: risk assessment, policies and procedures, training and awareness, auditing, log collection and analysis, threat hunting and intelligence surveillance, compliance monitoring and testing, and incident response. Our internal professionals collaborate with external subject matter specialists, as necessary. All third parties engaged for such matters are subjected to scrutiny to ensure they satisfy our security standards. We periodically review our third party engagements to ensure that the providers maintain the necessary levels of protection and competency, as well as to oversee and identify potential cybersecurity risks and/or threats from such engagements. We describe how risks from cybersecurity threats could materially affect us, including our business strategy, results of operations, or financial condition, as part of our risk factor disclosures at Part I, Item 1A, Risk Factors of this Annual Report on Form 10-K. Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Board and its Corporate Governance, Nominating and Ethics Committee are responsible for oversight of our cybersecurity risk, including the effectiveness of cybersecurity risk management policies and protocols, while our Chief Information Officer (CIO) is responsible for our cybersecurity strategy and execution. As part of the Board s oversight, its Corporate Governance, Nominating and Ethics Committee, which is comprised entirely of independent directors, receives quarterly reports from executive management about the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Board receives at least an annual report from executive management. Additionally, we have processes by which a cybersecurity incident would be escalated internally and, when appropriate, reported to the Board (or appropriate committee), as well as for updating the Board regarding such incident until it has been resolved. Our CIO has more than 25 years of technology and information systems leadership experience, including as CIO of multiple consumer-focused companies. Our CIO reports to our chief executive officer. 17 Table of Contents

Company Information