{"url_path":"/sec/nus/10-k/2026/item-1c","section_key":"item-1c","section_title":"Item 1C CYBERSECURITY","topic":"sec","document":{"doc_type":"10-K","doc_date":"2026-02-13","source_url":"https://www.sec.gov/Archives/edgar/data/1021561/0001140361-26-005130-index.html","accession_number":"0001140361-26-005130","cik":"0001021561","ticker":"NUS","issuer_name":"NU SKIN ENTERPRISES, INC.","edgar_url":"https://www.sec.gov/Archives/edgar/data/1021561/0001140361-26-005130-index.html","primary_entity_key":"0001021561","primary_entity_name":"NU SKIN ENTERPRISES, INC."},"word_count":528,"has_tables":true,"body_markdown":"ITEM 1C.\n\nCYBERSECURITY\n\nOur company is exposed to a variety of evolving cybersecurity risks. We invest in\nour cybersecurity program to manage and mitigate these risks. On an annual basis, we utilize our Enterprise Risk Management (“ERM”) program to estimate our annual loss potential based on our defined control framework and its overall effectiveness. In conjunction with our ERM program, the cybersecurity program references the CIS Critical Security Controls and the NIST Cybersecurity Framework (CSF) to\nguide our organization’s risk identification and mitigation procedures. In addition, we undergo an annual third-party external PCI penetration test, as well as third-party attack-surface monitoring to understand our\npotential vulnerabilities, threat vectors, and additional impacts to critical assets and operations. Our cybersecurity team also performs procedures to identify risks that inform our annual security roadmap. We also periodically review our\ncybersecurity policies and require cybersecurity training for our employees.\n\nWe periodically engage third-party cybersecurity experts to provide independent assessments of our cybersecurity readiness and control effectiveness. Our goal in collaborating with external cybersecurity firms is to\ngain insights and knowledge into emerging threats and vulnerabilities, industry trends and best practices to inform our risk remediation efforts. Additionally, we engage with our internal teams to perform tabletop exercises that inform our\ncybersecurity response capabilities and resilience.\n\nWe also maintain processes to perform a risk assessment of new third parties, inclusive of new third-party contracts, which provides an additional layer of oversight in identifying material risks associated with the use of particular external service providers.\n\nAt this time, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations or financial condition, but we cannot provide assurance that such risks or future material incidents will not materially affect us in the\nfuture. For more information regarding the risks we face from cybersecurity threats, please see Item 1A. Risk Factors.\n\nOur management plays a pivotal role in assessing and managing material risks from cybersecurity threats. Our management has implemented a broad and continuous process for cyber event\nmonitoring, analysis of emerging threats, and the development and implementation of risk mitigation strategies. Led by our Chief Technology Officer (“CTO”) and Chief Information Security Officer\n(“CISO”), we implement cybersecurity policies, procedures and strategies, including employee training programs, security assessments and attack detection alerts designed to address the\nconstantly evolving threat landscape. Our CTO has over 20 years of technology experience, including roles at Amazon Web Services, Dell EMC, and Ball Aerospace. Our CISO has over 30 years\nof cybersecurity and IT leadership experience.\n\nAt the Board of Directors level, our Audit Committee oversees our risks related to\ninformation security and privacy. To accomplish this responsibility, the Audit Committee meets quarterly with our CTO and CISO to receive and discuss updates on our cybersecurity program. Top risks, key initiatives, any\nmaterial cyber incidents, remediation activity and security metrics are shared to report the overall loss potential, program effectiveness, risk management conditions and current threat landscape.\nOur Board of Directors is committed to maintaining a well-informed and security-aware business by regularly engaging through updates on the organization’s roadmap and evolving threat landscape."}