Lakeland Industries Inc 10-K cybersecurity disclosure (Item 1C), fiscal 2025

ITEM 1C: CYBERSECURITY

Cybersecurity Risk Management and Strategy

We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, and penetration testing, to inform our professionals' risk identification and assessment.

We also have a cybersecurity-specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our program to best practices, as well as by engaging experts to attempt to infiltrate our information systems (as such term is defined in Item 106(a) of Regulation S-K). We engage third-party partners to conduct two-phase penetration testing simulating external and internal cybersecurity breach situations. We test and review the result on an annual basis. To monitor risk levels, we have engaged a third-party vendor to manage our security operations center (the "SOC"), which provides automatic alerts in response to certain occurrences and triggers automatic rules-based responses. Additionally, our annual external Sarbanes-Oxley audit process reviews all account privileges associated with our enterprise resource planning software and other systems supporting the financial function of the Company.

Our cybersecurity program includes controls designed to prevent, identify, protect against, detect, respond to and recover from cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K), and to provide for the availability of critical data and systems and to maintain regulatory compliance. These controls include the following activities:

·

monitor emerging data protection laws and implement changes to our processes designed to comply,

·

conduct regular cybersecurity management and incident training for all employees,

·

conduct regular phishing email simulations for all employees with access to corporate email systems to enhance awareness and responsiveness to such possible threats. Any employee who fails a phishing test is automatically enrolled in additional cyber training,

·

through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care,

·

maintain multiple layers of controls, including embedding technological and administrative security features into our technology investments, multi-factor authentication tools, system access policies and privileges, and network configuration,

·

perform annual system access audit with all departments and personnel,

·

review access logs and continually monitor detection alerts,

·

conduct annual tabletop exercises to simulate cyber incidents to refine cyber security policies, further,

·

implement a remote disaster recovery backup site and fail over testing.

We perform periodic internal assessments to test our cybersecurity controls and regularly evaluate our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity or personal data breaches and to help us identify areas for continued focus, improvement, and/or compliance.

We have established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our board when found. In addition, our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents. These include processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as comply with potentially applicable legal obligations and mitigate brand and reputational damage.

Our processes also address cybersecurity threat risks associated with our use of third-party service providers , including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers.

We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " Cybersecurity incidents could disrupt business operations, result in the loss of critical and confidential information and adversely impact our reputation and results of operations " included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K which disclosures are incorporated by reference herein.

In the last two fiscal years, we have not experienced any material cybersecurity incidents and have not incurred any material expenses relating to cybersecurity incidents. This includes penalties and settlements, of which there were none.

Cybersecurity Governance

Cybersecurity is an important part of our enterprise risk management program and an area of increasing focus for our Board and management. In late 2024, we established a Technology Committee of the Board, the purpose of which includes oversight of the Company's cybersecurity program. The Technology Committee consists of three independent directors and is responsible for overseeing the Company's efforts to monitor cybersecurity risks and management efforts to mitigate such risks. Management is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of and participation in the cybersecurity risk management process described above, including the operation of our incident response plan. The Technology Committee receives and reviews reports from management and the Company's internal audit function concerning cybersecurity incidents, business continuity, data security posture, disaster recovery preparedness, results from security assessments, progress toward pre-determined risk mitigation-related goals, our incident response plan, internal audit results pertaining to technology and cybersecurity controls, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Technology Committee reports to the full Board on major items covered at meetings of the Technology Committee.

Members of the Technology Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management process. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters. Any potential threat or incident is reported to the Technology Committee based on the severity and potential risk based on the escalation procedure as defined by the Incident Response Plan.

Our cybersecurity risk management process, which is discussed in greater detail above, is led by our Vice President of Information Technology. This individual has over thirty years of prior work experience in various Information Technology roles including managing information systems and security.

Our Vice President of Information Technology and technology professionals have deep experience and skills in developing, implementing and monitoring cyber technology assets. Our technology staff and partners have a strong track record of working with major vendors' security, firewall, identity management, and other platforms.