UNIVERSAL LOGISTICS HOLDINGS, INC.

Cybersecurity Risk Management and Strategy

We maintain a cybersecurity risk management program intended to identify, assess, and manage risks to the confidentiality, integrity, and availability of our information technology systems and data that support our operations and financial reporting. Our operations depend on a combination of proprietary and third-party systems, including transportation management, warehouse management, dispatch, billing, and customer-facing platforms.

Our cybersecurity risk management program is informed by, but does not purport to fully comply with, the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the NIST AI Risk Management Framework. These frameworks are used as reference points to help identify and manage cybersecurity risks relevant to our business and operating environment. Use of these frameworks does not imply that we meet any particular technical standards, specifications, or requirements.

Cybersecurity risks and related risk management activities are evaluated as part of our broader enterprise risk management processes and are considered alongside other operational, financial, and compliance risks. Given the evolving nature of cybersecurity threats, the complexity of our information technology environment, and our reliance on third-party service providers, we face ongoing cybersecurity risks that may not be fully preventable.

Key components of our cybersecurity risk management program include:

•

periodic risk assessments designed to identify cybersecurity risks to our systems, data, and operations;

•

a dedicated security team responsible for cybersecurity risk assessment, security architecture, control implementation, monitoring, and incident response activities;

•

the use of third-party service providers, where appropriate, to assist with security assessments, testing, monitoring, or advisory services;

•

cybersecurity awareness and training programs for employees, including personnel involved in incident response and financial reporting processes; and

•

an incident response plan that outlines procedures for detecting, responding to, mitigating, and remediating cybersecurity incidents.

While we have not experienced a cybersecurity incident that has had amaterial impact on our business, operations, or financial condition, we have experienced, and may continue to experience, technology-related disruptions or challenges. Cybersecurity incidents, including those resulting from ransomware, data breaches, system failures, or third-party vulnerabilities, could occur in the future and could adversely affect our operations, financial reporting, customer relationships, or reputation. For additional discussion of cybersecurity-related risks, see Item 1A, “Risk Factors.”

Cybersecurity Governance

Our Board of Directors oversees cybersecurity risk as part of its overall risk oversight responsibilities and has delegated primary oversight of cybersecurity and information technology risks to the Audit Committee. The Audit Committee receives periodic updates from management regarding cybersecurity risks, program initiatives, and, as appropriate, significant incidents or emerging threat developments. The Audit Committee reports to the full Board on matters within its oversight scope, and the full Board may also receive periodic briefings from management on cybersecurity and technology risks.

Management is responsible for the day-to-day management of cybersecurity risks. Our cybersecurity risk management program is led by our Chief Technology Officer, who is supported by internal personnel and, as appropriate, external advisors. Our Chief Technology Officer has over 20 years of cybersecurity experience. Collectively, members of the cybersecurity leadership team have experience in information technology, cybersecurity, and risk management across multiple industries. The Chief Technology Officer has primary responsibility for implementing and maintaining our cybersecurity risk management program and for coordinating incident response activities.

Management monitors cybersecurity risks and incidents through a combination of internal reporting, security tools deployed across our information technology environment, threat intelligence, and information obtained from governmental, public, and private sources, including third-party service providers. Despite these efforts, no cybersecurity risk management program can eliminate all risks, and we may not be able to prevent or timely detect all cybersecurity incidents.