HOOKER FURNISHINGS Corp

Risk Management and Strategy

The Company’s cybersecurity risk management program is integrated into the overall risk management framework, including risk identification, assessment, and mitigation across all business areas. We have collaborated with third-party consultants and built a cybersecurity program designed to protect and safeguard the confidentiality, integrity and availability of our information systems, which aligns with industry standards and regulatory requirements. Key components of our cybersecurity risk management and strategy include:

We have previously experienced actual or attempted cyber-attacks on our information systems or networks; to date, none of these incidents had amaterial impact on our operations or financial condition. However, cybersecurity threats continue to evolve, and future incidents could have a material impact. For additional information on the impact of cyber risks, refer to Part I, Item 1A. Risk Factors on page 14.

Governance

The board of directors oversees the Company’s practice for assessing, identifying and managing material risks from cybersecurity threats. The Audit Committee, consisting of all of the board’s independent directors, with one member holding the CERT Certificate in Cybersecurity Oversight, reviews and discusses with management and the independent auditor on the Company’s significant financial risk exposures for matters related to cybersecurity risk, including the steps management has taken to monitor and manage such exposures.

Management is responsible for the day-to-day oversight and management of cybersecurity risks. The Company’s VP of Enterprise Systems and Applications leads the overall cybersecurity strategy and risk management program. This role oversees development and execution of risk assessments, implementation of security policies and procedures, regular cybersecurity training for our employees, and leadership of the IT security team and coordination with third-party consultants.

The VP of Enterprise Systems and Applications has over 30 years of experience in information technology, enterprise systems, and operational risk management, including responsibility for infrastructure and operations in complex, multi-site environments. This experience includes the implementation and oversight of IT governance and control frameworks aligned with recognized standards, including ITIL and ISO/IEC 20000, as well as the establishment of processes related to service continuity, supplier management, configuration management, and operational controls. In addition, the VP’s experience also includes leading enterprise technology initiatives, including system implementations, data center migrations, business continuity planning, and vendor and third-party risk management.

Senior executives, including the Company’s CEO and CFO, integrate cybersecurity risks into the overall business strategy and financial planning. The VP and IT security team provide regular updates to senior management on the Company’s identified vulnerabilities, progress on cybersecurity initiatives and remediation efforts, and details of ongoing incidents. Management notifies theboard of directors when significant incidents occur and provides the Audit Committee with quarterly updates on the Company’s cybersecurity practices.