INSTEEL INDUSTRIES INC

Risk Management and Strategy

As a component of and integrated into our overall risk management framework, we maintain a cybersecurity risk management program designed to assess, identify and manage material risks from cybersecurity threats and to protect our information systems and data from unauthorized access, use, disclosure, disruption, modification or destruction. Our program incorporates applicable industry frameworks and standards, including guidance provided by the National Institute of Standards and Technology and the Information Technology Infrastructure Library, and is comprised of core functions to identify, protect, detect, respond to and recover from cybersecurity threats and events.

We monitor cybersecurity threats and periodically evaluate the design and effectiveness of our cybersecurity program, including through assessments conducted with the assistance of third-party experts. We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring designed to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments.

As described in “Item 1A. Risk Factors” in this Form 10-K, cybersecurity threats could materially and adversely affect our business and financial results. As of the date of this report, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, results of operations, financial condition and cash flows.

Governance

Our Information Services Department manages our cybersecurity risk management program under the direction of our Chief Information Officer. The Chief Information Officer holds a master’s degree in business administration with a concentration in technology and has decades of professional experience in cybersecurity threat assessments and detection, applicable technologies, incident response and employee training. Our Information Services Department includes a team of experienced professionals responsible for maintaining our Incident Response Policy, which is regularly reviewed and updated. The policy establishes the required steps to assess, respond to, limit the impact of and recover from events and details tactical and strategic team membership and points of contact related to the response process. The policy also provides for escalating notifications to senior executives, including the Chairman of the Board and Chief Executive Officer, depending on the severity of the threat.

The Board of Directors, having ultimate oversight of the company’s cybersecurity risk, receives annual and periodic updates on the cybersecurity program, including those related to material risks and incidents, from the Chief Information Officer and participates in discussions regarding cybersecurity risks. Cybersecurity information provided to the Board comprises a broad range of topics including, but not limited to, emerging cybersecurity threats, ongoing cybersecurity initiatives, incident reports and compliance with regulatory requirements, industry standards and relevant benchmarking. In addition to Board oversight, we provide mandatory quarterly employee training on how to identify, assess and manage risks from cybersecurity threats.