Worthington Steel Inc

Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for assessing, identifying and managing cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and to facilitate coordination across different departments of our company. Our processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and the Board of material cybersecurity threats and incidents. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all appropriate employees.

The Board has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee also reports material cybersecurity risks to the Board. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Vice President of Transformation and Chief Information Officer (“CIO”) who receives reports from our Senior Cybersecurity manager who monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. The dedicated personnel of information system security professionals are overseen by an information security manager with 15 years of experience in cybersecurity. Management, including the CIO and our cybersecurity manager, regularly update the Audit Committee on our cybersecurity programs, which includes cybersecurity risks and mitigation strategies, a third-party risk program, vulnerability management, and on-going cybersecurity projects.

In fiscal 2024, we did not identify any cybersecurity incidents that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon. For more information about these risks, please see "Risk Factors– Risks Related to our Business" in Item 1A of this Form10-K.