Generac Holdings GNRC · USD

Item 1C. Cybersecurity The Company’s management and Board recognize the importance of strong oversight of cybersecurity risk, information security and technology in maintaining the trust and confidence of our customers, partners, employees and stockholders. Our processes for assessing, identifying and managing material risks from cybersecurity threats is incorporated into our Enterprise Risk Management (ERM) program in a similar fashion to other legal, compliance, operational, and financial risk areas. The Company maintains cybersecurity measures aligned with the National Institute of Standards and Technology Cybersecurity Framework (Framework) which organizes cybersecurity risks into six categories: govern, identify, protect, detect, respond and recover, and looks to other standards as well to help identify, assess, and manage cybersecurity risks relevant to our business. Our Chief Information Officer (CIO) oversees our information systems and cybersecurity function and reports to our Chief Executive Officer (CEO). He has over 20 years of experience in leading information systems management, strategy, and operational execution, including incident prevention, management, and response. Our Company’s Chief Information Security Officer (CISO) is responsible for developing and implementing our information security program and reports to our CIO. The CISO has over 25 years of experience supporting cybersecurity and information technology. They are supported by a direct and cross-functional team of professionals with expertise and experience in threat assessment and detection, mitigation strategies, incident response, training, and regulatory compliance. In addition, we have established a Cybersecurity Steering Committee comprised of members of executive leadership. The Steering Committee, in which our CIO and CISO participate, meets regularly and has established Company-wide policies and standards concerning cybersecurity matters. These policies cover areas such as threat protection, access controls, multifactor authentication, containment of confidential information and the use of the internet, email and wireless devices. We have an established incident response plan led by our CIO and CISO and depending on the nature and severity of the incident, requires escalating notifications up to our CEO and Board. Our Board oversees our enterprise risk management activities.

Revenue Recognition The Company recognizes revenue as products are transferred to, or services are performed for, customers in an amount reflecting the consideration which we expect to receive in return for those products and services. The Company’s revenues primarily consist of product sales including residential and commercial & industrial generators, energy storage systems, smart thermostats and home monitoring products, and other power products including light towers and a broad line of outdoor power equipment. The Company also offers various services and solutions, including extended warranties, remote monitoring offered through SaaS arrangements, installation, maintenance, data center and telecom design and build, and customer support and software maintenance. We use executed sales agreements and purchase orders to determine the existence of a customer contract. For each customer contract, we determine if the products and services promised to the customer are distinct performance obligations. A product or service is distinct if both the following criteria are met at contract inception: (1) The customer can benefit from the product or service on its own or with other readily available resources, and (2) our promise to transfer the product or perform the service is separately identifiable from other promises in the contract. For each performance obligation in a contract, we first determine whether the performance obligation is satisfied over time. A performance obligation is satisfied over time if it meets any of the following criteria: ● The customer simultaneously receives and consumes the benefits provided by our performance as we perform; ● Our performance creates or enhances an asset that the customer controls as the asset is created or enhanced; ● Our performance does not create an asset for which we have an alternative use and we have an enforceable right to payment for performance completed to date. If one or more of these criteria are met, then we recognize revenue over time using a method that reflects performance under the contract. If none of these criteria are met, then we recognize revenue at a point in time, when control transfers to the customer. For the majority of our product sales, the Company considers the commitment to transfer products, each of which is distinct, to be the identified performance obligations.