STRATTEC SECURITY CORP

Governance

The Company conducts regular assessments of cybersecurity risks both internally and with third party assistance Information Technology Director reports on the results of these assessments and corresponding recommendations to the full Board of Directors at least annually. We use the National Institute of Standards and Technology ("NIST") framework to regularly assess the threat landscape and support a cybersecurity strategy based on prevention, detection and mitigation. In general, the Company seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving confidentiality, managing data security and availability and effectively responding to cybersecurity incidents when they occur. Management's philosophy on cybersecurity is to be vigilant in protecting the Company through investments in tools and employee awareness to aid in the prevention, detection and mitigation of cyber threats, while recognizing that not all threats are preventable.

The Company's Information Technology Director and Chief Financial Officer, along with cybersecurity personnel on their respective teams, are responsible for developing cybersecurity programs, as may be required by applicable law or regulation. Our cybersecurity personnel have the appropriate expertise in IT and cybersecurity, which generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience.

Risk Management and Strategy

Among other best practices, we use multi-factor authentication wherever possible for external access to systems, assess and update current versions of security solutions, perform annual cybersecurity training and email phishing campaigns for employees, use third parties to perform external penetration testing, and maintain disaster recovery and incident response plans. We employ a combination of methods to monitor for new or developing cybersecurity risks. Incidents, if any, are escalated to management and the Board according to our incident response policy. Through these processes, we did not identify risks from current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.