CAL-MAINE FOODS INC

Risk Management and Strategy

We

understand the importance of

cybersecurity and its role

in the success of

our Company.

Our business operations depend on

the effective use of our information systems in order

to properly serve our customers, manage our business and track and report

our financial results. Our technology

operations consider risks from cybersecurity

threats in the implementation and

execution of

our business processes. We consider and assess the risks

from cybersecurity threats as part

of our overall risk assessment

process

using the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework.

In order to

identify, assess and

manage material

risks arising

from cybersecurity threats,

we maintain internal

resources to monitor

and quickly respond to such threats. We

perform vulnerability scans and penetration testing designed to test the effectiveness of

our

security

practices.

We

engage

third

-party

service

providers

to

assist

in

the

of

our

over

our

information systems through

audit and

consulting services to

test the design

and operational effectiveness

of security controls.

We continually monitor our systems to

detect and identify cybersecurity

threats. Prior to contracting

with third-party vendors, we

perform risk assessments of the vendors

and require the vendors to manage

cybersecurity risks to our business operations

as well

as

notify us

of

any

potential or

known

cybersecurity risks.

We

also require

our

to

complete training

programs to

increase their

awareness of

and sensitivity

to cybersecurity

threats. These

training programs

include the

identification of

such

threats and the proper responses to a potential cybersecurity beach that aligns with our adopted processes.

The Company has implemented

a response process in

the event of a

cybersecurity incident through its crisis

management plan.

The

process

includes

the

cooperation

of

the

technology

team

and

our

team

to

properly

detect

and

respond to these

incidents. These responses

include determination of

the potential impact

and materiality of

the incident, potential

disclosure

and

litigation

matters,

and

mitigation

of

actual

or

damage

to

our

systems

or

reputation

arising

from

the

incident. An action plan is implemented to

respond to any potential cybersecurity breach in

order to continue to effectively serve

our customers and conduct our operations with as little interruption as practicable. The information technology team

reviews the

response process on

a regular basis

to ensure that

it is designed

to be effective

and to encompass

current or new

threats.

As of July

22, 2025,

we are

no

t aware

of any

risks from

cybersecurity threats,

including as

of prior

cybersecurity incidents,

that have

materially affected

or that

we believe

are reasonably likely

to materially affect

the Company,

including our business

strategy,

results

of

or

condition.

See

for

further

discussion

about

risks

from

cybersecurity threats.

Governance

The Board is responsible for the oversight of management’s

process for identifying and mitigating risks related to cybersecurity

threats.

On a quarterly

basis, the Director

of Information Technology provides

a report to

the Audit Committee

regarding ongoing

processes to improve and update

our current cybersecurity protocols, new

cybersecurity threats, results of internal

assessments,

and any recent cybersecurity incidents.

The

Audit

Committee will make the Board aware of any information it deems necessary

or appropriate in order for the Board to effectively oversee the Company’s cybersecurity risk management and strategy.

The Director

of

Information Technology

and the

team he

manages

are responsible

for the

operation and

maintenance of

our

information systems, including the assessment, identification and management of risks from cybersecurity threats.

Together,

the

Director of Information Technology

and his team have over 150 years of experience

in the information technology and security

environment.

Our

Chief Financial Officer

, to

whom the

Director of

Information Technology reports,

has served

as Chief

Officer and a Board member since 2018 and has over 40 years of risk management experience.