PURE CYCLE CORP

We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to safeguard our information assets and operations from internal and external cyber threats, including protecting employee information from unauthorized access to or attacks on our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

We have engaged external parties, including risk management consultants and computer security firms, to enhance our cybersecurity oversight. In an effort to deter and detect cyber threats, we periodically provide training programs to our employees on issues related to privacy and data protection, cybersecurity risks, and the importance of reporting all incidents immediately. Topics include identifying phishing, password protection, securing confidential data, and mobile security. In addition, we use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We also perform annual vulnerability assessments, conducted by independent, third-party cybersecurity firms.

Additionally, as part of our overall risk mitigation strategy, the Company obtains certain insurance policies. However, such insurance may not be sufficient in type or amount to cover us fully against claims related to security breaches, cyber-attacks and other related breaches.

The Audit Committee of our Board of Directors provides direct cybersecurity risk oversight. Our management provides timely disclosure and related updates to the Audit Committee regarding potential cybersecurity threats, incidents and general risks.

Ourmanagement periodically evaluates information provided by its consultants on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we have not had a material cybersecurity incidents in fiscal 2025 or 2026 through the date of filing of this Form 10-K.