{"url_path":"/sec/seneb/10-k/2026/item-1c","section_key":"item-1c","section_title":"Item 1C Cybersecurity**","topic":"sec","document":{"doc_type":"10-K","doc_date":"2026-06-11","source_url":"https://www.sec.gov/Archives/edgar/data/88948/0001437749-26-020290-index.html","accession_number":"0001437749-26-020290","cik":"0000088948","ticker":"SENEB","issuer_name":"Seneca Foods Corp","edgar_url":"https://www.sec.gov/Archives/edgar/data/88948/0001437749-26-020290-index.html","primary_entity_key":"0000088948","primary_entity_name":"Seneca Foods Corp"},"word_count":589,"has_tables":true,"body_markdown":"**Item 1C. Cybersecurity**\n\n \n\n**Risk Management and Strategy**\n\n \n\nThe Company’s cybersecurity risk management program is integrated with its overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across functions to other legal, compliance, strategic, operational, and financial risk areas.\n\n \n\nThe Company designs and assesses the cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”). The Company uses the NIST CSF as a guide to help identify, assess, and manage cybersecurity risks relevant to its business; this does not imply that the Company’s cybersecurity program meets any particular technical standards, specifications, or requirements.\n\n \n\nThe cybersecurity risk management program is grounded in a zero-trust framework and employs a multi-layered approach, including:\n\n \n\n \n\n●\n\nAwareness and training for employees, involving phishing campaigns, informational sessions at management meetings, and annual mandatory training with simulations of common cybersecurity threats;\n\n \n \n\n \n\n \n\n●\n\nSecurity tools and technologies, along with control policies and active review procedures which strengthen authentication and access protection;\n\n \n \n\n \n\n \n\n●\n\nThird-party risk management process and monitoring procedures for service providers, suppliers, and vendors who have access to critical systems and information;\n\n \n \n\n \n\n \n\n●\n\nRisk and vulnerability management encompassing both proactive and predictive defenses which provides opportunities to assess, remediate, and validate; and\n\n \n \n\n \n\n \n\n●\n\nManaged detection and incident response, including advanced endpoint protection and data loss prevention.\n\n \n\nIn evaluating the risks identified as a part of the annual assessment process, the Company’s information technology team considers the likelihood and severity of the respective risk and the potential impact of the risk on the Company, its customers, and its employees. These risks are then prioritized and monitored by the information technology team.\n\n \n\nThe Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems to assess its cybersecurity readiness and maturity of the cybersecurity program. Tests are conducted by the information technology team and reputable third-party consultants and auditors. In developing and evaluating the testing procedures, the Company considers both its individual risks and industry standards.\n\n \n\n14\n\n[Table of Contents](#toc)\n\n \n\nThe cybersecurity risk management program includes an incident response plan with a cross-functional team comprised of designated members of the information technology department, senior management, and other appropriate individuals. The team is responsible for assessing and managing the cybersecurity incident response process, as outlined within the incident response plan, and taking necessary corrective actions to mitigate and eliminate the issue.\n\n \n\nAs of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents and potential impact to the Company, see the cybersecurity risk factor within “Item 1A. Risk Factors” in this Form 10-K.\n\n \n\n**Governance**\n\n \n\nThe information technology department, led by the Senior Vice President of Technology, Chief Information Officer (“CIO”), is responsible for the Company’s cybersecurity program. The CIO, along with the certified Information Security Officer, have significant experience spanning over 20 years in information security, infrastructure, and compliance.\n\n \n\nThe Board of Directors considers cybersecurity risk as part of its overall risk oversight function. The Board of Directors receives briefings from the CIO regarding the Company’s cybersecurity risk management program at least annually. These briefings include updates on the Company’s cybersecurity risks and threats, the status of projects to strengthen the information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape."}