EVI INDUSTRIES INC

The Company has established security practices and safeguards designed to help identify and protect against intentional and unintentional misappropriation or corruption of its information technology systems, data, and operational continuity. The Company conducts risk assessments to identify potential cybersecurity threats, which include evaluating the likelihood and potential impact of these threats, identifying system and network vulnerabilities, and assessing the effectiveness of the Company’s existing controls. Upon identification and assessment of risks, the Company develops and implements what

management believes to be appropriate measures in order to manage these risks, which may involve enhancing security controls, implementing new technologies, training employees, or changing business processes. The Company maintains change management processes, monitoring practices, and data protection measures designed to mitigate cybersecurity risks and regularly test its systems for potential threats. Such processes and practices to assess, identify, and manage cybersecurity incidents are integrated into the Company’s overall enterprise risk assessment process.

The Company’s information security team, which is led by the Company’s Director of Information Technology and also includes the Company’s Chief Financial Officer and other members of the Company’s internal audit and finance departments, is responsible for assessing and managing the Company’s cybersecurity risks and data protection practices. The Company’s Director of Information Technology has over 10 years of experience in managing cybersecurity risks and advising on cybersecurity matters.

The Company's Board of Directors is responsible for the oversight of management’s efforts to address cybersecurity risks. The Board of Directors has designated the Audit Committee with the responsibility of overseeing and reporting to the Board on management's handling of cybersecurity risk management and on the adequacy and effectiveness of the Company’s cybersecurity risk management strategy. Management also updates the Audit Committee and the Board on an on-going basis concerning any significant cybersecurity incidents or risk exposures that have come to management’s attention during the conduct of their assessments, the steps management has taken to mitigate such exposures, and any changes to the processes of identifying, assessing, and monitoring cybersecurity threats.

During the fiscal year ended June 30, 2024, the Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.