Cybersecurity and Information Technology
Our Board of Directors considers cybersecurity risk to be an important potential risk to our business. The Board of Directors has delegated to the Audit Committee oversight of cybersecurity and other information technology risks affecting the Company. The Audit Committee periodically evaluates our cybersecurity strategy to ensure its effectiveness. Management provides regular reports to the Audit Committee and the Board of Directors regarding cybersecurity and other information technology risks.
Our Chief Information Officer oversees our information security program. His teams are responsible for leading enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes. We devote significant resources to protecting and continuing to improve the security of our computer systems, software, networks, and other technology assets. Our security efforts are designed to preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, the Company and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt, or degrade service, sabotage systems, or cause other damage.
We identify and address information security risks by employing a defense-in-depth methodology that provides multiple, redundant defensive measures and prescribes actions to take in case a security control fails or a vulnerability is exploited. We leverage internal resources, along with strategic external partnerships, to mitigate cybersecurity threats to the Company. We have partnerships for Security Operations Center (SOC) services, and various third-party assessments. We deploy both commercially available solutions and proprietary systems to manage threats to our information technology environment actively.
Certain of our information technology applications are externally audited as part of our Sarbanes-Oxley audit program and our controls include information security standards. We follow industry best practices and the National Institute of Standards and Technology (NIST) Cyber Security Framework. We regularly engage appropriate external resources regarding emerging threats to navigate the diverse cybersecurity landscape.
In addition to ensuring adequate safeguards are in place to minimize the chance of a successful cyber-attack, the Company has established well-defined response procedures to effectively address cyber events that may occur despite these robust safeguards. These response procedures are designed to identify, analyze, contain, and remediate such cyber incidents to ensure a timely, consistent, and compliant response to actual or attempted data incidents impacting the Company. The Company devotes appropriate resources and enlists partners to adapt to the evolving threat landscape.
The Company takes data protection seriously and ensures employees understand their role in keeping the Company safe from cyber-attacks. We employ a robust information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to complete a Cybersecurity Awareness eCourse and acknowledge our Information Security policies. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.
We have experienced no material information security breaches in the last three years. As such, we have not spent any material amount of capital on addressing information security breaches in the last three years, nor have we incurred any material expenses from penalties and settlements related to a material breach during this same time. We also carry third-party cybersecurity insurance.
Corporate Governance Guidelines
Our Board of Directors is governed by our Corporate Governance Guidelines which are reviewed annually and amended from time to time to incorporate certain current best practices or as otherwise may be advisable. Our Corporate Governance Guidelines may be found on our website at www.missionproduce.com and are available in print upon written request to the Company’s Secretary at our principal executive offices at 2710 Camino Del Sol, Oxnard, California 93030.
Code of Ethics and Conduct
We have adopted a written code of ethics and conduct that applies to our directors, officers, and employees, including our principal executive officer, principal financial officer, principal accounting officer or controller, or persons performing similar functions. Our Board of Directors reviews the Code of Ethics and Conduct on an annual basis and makes changes if and when appropriate. We have posted the Code of Ethics and Conduct on our website, www.missionproduce.com. In addition, we will post on our website all disclosures that are required by law or Nasdaq listing standards concerning any amendments to, or waivers from, any provision of the codes.