J B Hunt Transport Services JBHT · USD

IT Risk Management The Company maintains an information technology (IT) risk identification process that encompasses risks associated with enterprise solutions and products and services provided by third-party service providers. Cybersecurity risks are considered a subcategory of IT risks and are therefore part of this process. The Company maintains a risk register to document and track IT risks, including factors such as: ● Categories (including but not limited to cybersecurity, data privacy, governance, application development, and AI) ● Likelihood and impact ● Initial risk score ● Mitigating controls and/or remediations ● Residual risk score ● Plan for remediation ● Risk stage ● Reviewers/owners ● Approvals/exceptions The Company’s Governance, Risk, and Compliance (GRC) team maintains the IT risk register and reports updates to the IT Risk Council, which meets regularly. The IT Risk Council is made up of members representing the Company’s cybersecurity, network, server, client, database, and software teams. Cybersecurity Operations and Incident Response Capabilities The Company maintains a Cybersecurity Operations Center (CSOC) comprised of in-house employees, contracted personnel, and other third-party security service providers. Our CSOC provides constant monitoring, assessment, and defense of all enterprise information systems (including web sites, applications, databases, servers, clients, and data centers) as well as service provider connections and provides incident reporting as needed. The Company also maintains a Security Incident Response Team (SIRT) that responds to high-risk security incidents on a 24-hour basis. Members of this team include representatives of our CSOC and Networking Operations Center, as well as cloud/server engineering, network engineering, enterprise data, identity and access management, GRC, end-user computing, application development, and IT leadership teams. Assessments and Audits The Company uses various methods to assess our cybersecurity maturity and IT risk management program, including periodic self-assessments and engagements of independent third-party assessors and consultants. We engaged third-party experts for the initial development of the IT risk management program, including preparation of the program charter, IT risk register, and responsibility assignment matrix.

Revenue Recognition We record revenues on the gross basis at amounts charged to our customers because we control and are primarily responsible for the fulfillment of promised services. Accordingly, we serve as a principal in the transaction. We invoice our customers, and we maintain discretion over pricing. Additionally, we are responsible for selection of third-party transportation providers to the extent used to satisfy customer freight requirements. Our revenue is earned through the service offerings of our five reportable business segments. See Note 13, Segment Information, for revenue reported by segment. All revenue transactions between reporting segments are eliminated in consolidation. Intermodal (JBI) - JBI segment includes freight that is transported by rail over at least some portion of the movement and also includes certain repositioning truck freight moved by JBI equipment or third-party carriers, when such highway movement is intended to direct JBI equipment back toward intermodal operations. JBI performs these services primarily through contractual rate quotes with customers that are held static for a period of time, usually one year. Dedicated Contract Services® (DCS®) - DCS segment business includes company-owned and customer-owned, DCS-operated revenue equipment and employee drivers assigned to a specific customer, traffic lane, or service. DCS operations usually include formal, written longer-term agreements or contracts that govern services performed and applicable rates. Integrated Capacity Solutions (ICS) - ICS provides non-asset and asset-light transportation solutions to customers through relationships with third-party carriers and integration with company-owned equipment. ICS services include flatbed, refrigerated, and expedited, as well as a variety of dry-van and intermodal solutions. ICS performs these services through customer contractual rate quotes as well as spot quotes that are one-time rate quotes issued for a single transaction or group of transactions. ICS further offers these services through an online multimodal marketplace via J.B. Hunt 360 that matches the right load with the right carrier and the best mode. Final Mile Services® (FMS) - FMS provides last-mile delivery services to customers through a nationwide network of cross-dock and other delivery system network locations.