KIRBY CORP

The Company is committed to maintaining appropriate governance and oversight of cybersecurity risks and to implementing processes, controls and technologies designed to help assess, identify, and manage material risks from cybersecurity threats. The Company’s Board of Directors has ultimate oversight of cybersecurity risks, which it manages as part of the Company’s enterprise risk management program. The Audit Committee assists the Board in its oversight by reviewing the Company’s information security programs, including review of cybersecurity processes, procedures and safeguards. To more effectively prevent, detect and respond to information security threats, the Company maintains a cyber risk management program, which is aligned with the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework. The Cyber Risk Management program is overseen by the Company’s executive officer, the Vice President and Chief Information Officer, who is responsible for leading the Company’s cybersecurity strategy, policies, standards, and processes. The Vice President and Chief Information Officer has relevant experience assessing and managing cybersecurity programs and risks and has served in this position since 2019. The Vice President and Chief Information Officer is supported by the Director of IT Operations & Security, who reports directly to the Vice President and Chief Information Officer. The Audit Committee receives regular reports from the Vice President and Chief Information Officer on, among other things, the Company’s cybersecurity risks and threats, assessments of the Company’s cybersecurity program and developments in the threat landscape. Additionally, the Vice President and Chief Information Officer chairs the Company’s Cybersecurity Governance Committee, which is intended to promote coordination, awareness, accountability and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management and reporting. The Company maintains a documented incident response process, pursuant to which cybersecurity incidents are escalated to the Company’s senior management, including the CEO and Board, as appropriate. As part of its incident response plan, the Company has preidentified consultants and advisors to assist with any potential response.

The Company annually engages third parties such as assessors, consultants and auditors (as well as its internal audit department) to evaluate the Company’s information security programs, whose findings are reported to the Audit Committee. The Company also engages with key vendors, industry participants, and the U.S. Coast Guard as part of its efforts, which are reported to the Audit Committee.

The Company’s approach to cybersecurity risk management includes, among other things, the following key elements:

•

Continuous monitoring – The Company monitors for cybersecurity threats, including those risks associated with its use of third-party vendors using a combination of internal processes and threat intelligence.

•

Third party risk assessments – The Company periodically engages third party consultants or other advisors to assist in assessing vulnerabilities in its information security environment.

•

Internal threats – The Company maintains programs designed to monitor and address cybersecurity risk arising from within the Company.

•

Vendor risk management – The Company assesses cybersecurity risks associated with vendors who are critical digital partners in order and seeks to include risk appropriate terms and conditions in its vendor contracts.

•

Training and Awareness – The Company has various information technology policies, that relate to cybersecurity. The Company provides employee education and training that reinforces its information technology policies, standards and practices, as well as the expectation that employees comply with these policies. This training empowers employees to identify and report potential cybersecurity risks and protect the Company’s resources and information. This training is mandatory for all employees globally and is administered on an annual basis, and it is supplemented by Company-wide testing initiatives, including periodic phishing tests. Further education is provided at operations meetings to raise awareness and educate on current topics. The Company provides specialized security training for certain employee roles. The Company also requires employees to sign confidentiality agreements, where appropriate to their role. The Company has also adopted an Artificial Intelligence Use Policy to mitigate cybersecurity and other risks associated with use of artificial intelligence technology.

The Company continues to enhance its cybersecurity controls and processes. While the Company has not, as of the date of this Form 10-K, identified a cybersecurity threat or incident that resulted in a material adverse impact to its business, results of operations or financial condition, there can be no assurance that the Company will not experience a cybersecurity incident in the future or that its response to any such incident would be sufficient to prevent material adverse effects. For more information regarding the risks the Company faces from cybersecurity threats, please see Item 1A-Risk Factors.