ARGAN INC

We manage cybersecurity risk through programs implemented across our subsidiaries and corporate headquarters. The programs are designed to identify and address entity-specific risks related to our digital and physical assets and to protect our infrastructure, systems, data, customers, business partners and financial information from cybersecurity incidents. Corporate management provides oversight of the cybersecurity risk management programs across the organization.

Our cybersecurity programs are administered by information security, information technology and compliance professionals and managed by senior management at each subsidiary. The programs areintegrated into our enterprise risk management process and are designed to align with recognized frameworks and industry standards, as applicable, and to comply with applicable legal and regulatory requirements. The audit committee of our board of directors oversees management’s cybersecurity programs and thereporting of cybersecurity incidents.

Risk Management and Strategy

Our cybersecurity professionals evaluate and refine cybersecurity measures as our business and operational needs evolve. Depending on each subsidiary’s environment, our controls include network and endpoint security tools, encryption, access

• 19 -

controls (including multi-factor authentication), and patch and configuration management. We use managed endpoint detection and response tools to monitor, detect and respond to threats across desktops, laptops and mobile devices.

We maintain business continuity and disaster recovery plans intended to support the restoration of critical systems and operations following disruptions, including cybersecurity incidents. We also engage external specialists from time to time to assess our cybersecurity programs through activities such as audits, risk assessments and penetration testing. Such engagements differ across our subsidiaries, as they are tailored to the specific risk profile of each subsidiary, ensuring that each entity works with experts most suited to their specific cybersecurity needs. Management reports significant results and recommendations to the audit committee and, as appropriate, the board of directors.

We provide regular cybersecurity awareness training to employees, including training on phishing, social engineering and sensitive data handling, and we conduct periodic simulated phishing exercises. We also evaluate cybersecurity risks associated with third-party service providers that require access to our systems and, where appropriate, conduct ongoing reviews of vendor security practices. In addition, we maintain cybersecurity insurance obtained from industry-leading underwriters.

Our strategy for responding to cybersecurity incidents involves a well-defined plan at each subsidiary that prescribes dedicated cross-functional personnel to each response team, ensuring a coordinated and predefined response. These plans, which undergo regular review, assert the ability of system recovery processes and provide response frameworks for escalating issues. The plans are designed to minimize the impacts on our operations and stakeholders, initiate appropriate communications both within and outside of the organization, and identify recommendations for improvement.

Governance and Oversight

While our management team is tasked with the day-to-day handling of risks facing our organization, ouraudit committee, as delegated by the board of directors and documented in its charter, oversees cybersecurity risk and governance. Management provides theaudit committee periodic updates regarding information security matters, including cybersecurity initiatives, vulnerability and risk assessments, third-party evaluations, and emerging threats. The audit committee also consults with internal audit and external specialists as needed. Our audit committee or the board of directors ensures that cybersecurity is seamlessly integrated into our strategic planning, aligning with our broader organizational goals.

Additionally, we have established across-organizational IT steering committee, comprising senior and executive leadership, enterprise risk management representatives, and IT management. To build a comprehensive cybersecurity strategy across the organization, this committee convenes as needed to discuss ongoing cybersecurity initiatives, emerging regulatory requirements and industry standards, and results of risk assessments.

Cybersecurity incidents, if any, are regularly reported to cross-functional teams at each subsidiary through the dedicated means we have in place, and events deemed critical are reported to the chief executive officer and chief financial officer. Moreover, the audit committee and the board of directors are promptly informed of any significant cybersecurity incident, along with continuous updates until resolution.

Cybersecurity Risks, Threats and Material Incidents

Cybersecurity threats are continually evolving, and no controls can provide absolute assurance against a cybersecurity incident. A successful breach or disruption could adversely affect our operations, financial condition or results of operations. Refer to “Our failure to protect our management information systems against security breaches could adversely affect our business and results of operations” in Item 1A. Risk Factors.

As previously disclosed, we were targeted by a complex criminal scheme early in Fiscal 2024 that resulted in fraudulently-induced outbound wire transfers to a third-party account (see Note 17 to the accompanying consolidated financial statements). We promptly discovered the fraudulent activity and contacted the remitting and receiving banks, dispute resolution experts, and federal and local law enforcement authorities. We also informed the audit committee and provided regular updates during investigation and recovery efforts. As a result of the fraud loss, net of funds recovered, and professional fees incurred related to an independent forensic investigation and recovery efforts, we recognized $2.7 million of loss in Fiscal 2024. We are unaware of any other significant security breaches at any of our business locations.

• 20 -