PHOTRONICS INC

Risk Management Strategy

Securing the Company’s business information, customer, supplier, and employee data and information technology systems is an important part of our overall risk management framework. We rely on certain key information technology systems, some of which are dependent on services provided by third parties, including cloud vendors, for various business functions necessary to operate and manage our business. We select key third-party service providers based on several factors, including the type of data processed and the nature of services offered, and we oversee such key third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring, including a review of SOC-1 reports on an annual basis.

We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. In addition, we have implemented procedures over certain areas such as access on/off boarding and account management to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. Although, to date, we have not experienced a material cybersecurity incident resulting in a significant interruption of our operations, the scope of any future incident cannot be predicted with any meaningful accuracy. See “Item 1A. Risk Factors” for more information.

Governance

Management is responsible for the day-to-day management of the risks we face, while our Board of Directors has responsibility for the oversight of risk management, including risks from cybersecurity threats. The cybersecurity program is led by the Company’s Global VP of Data Operations and Information Technology, who provides periodic updates to the Cyber Security Risk Management Committee of our Board of Directors about the program, including information about cyber risk management governance and the status of ongoing efforts to strengthen cybersecurity effectiveness. Our Board of Directors engages in ad hoc conversations with management on cybersecurity-related news events and discuss any significant updates to our cybersecurity risk management and initiatives. The Cyber Security Risk Management Committee regularly reports on its activities to the full Board to promote effective coordination and to ensure that the entire Board remains apprised of the effectiveness of the cybersecurity risk management and the cybersecurity risk landscape, and also assesses how management is managing these risks.