Old Dominion Freight Line Inc.: 10-K Risk Factor Changes

Provisions of our articles of incorporation, bylaws and the laws of Virginia, the state in which we are incorporated, may discourage, delay or prevent a change in control of us or a change in management that shareholders may consider favorable. These provisions:

limit who may call a special meeting of shareholders;

limit who may call a special meeting of shareholders;

require shareholder action by written consent to be unanimous;

require shareholder action by written consent to be unanimous;

establish advance notice and other substantive and procedural requirements for nominations for election to our Board or for proposing matters that can be acted upon at shareholder meetings;

establish advance notice and other substantive and procedural requirements for nominations for election to our Board or for proposing matters that can be acted upon at shareholder meetings;

may make it difficult to merge with or otherwise absorb a Virginia corporation acquired in a tender offer for the three years after the acquisition; and

may make it difficult to merge with or otherwise absorb a Virginia corporation acquired in a tender offer for the three years after the acquisition; and

may make an unsolicited attempt to gain control of us more difficult by restricting the right of specified shareholders to vote newly acquired large blocks of stock.

may make an unsolicited attempt to gain control of us more difficult by restricting the right of specified shareholders to vote newly acquired large blocks of stock.

ITEM 1B. UNRESOLVED STAFF COMMENTS

None.

The Board, through its Risk Committee, oversees the Company’s risk identification, risk tolerance, and management practices for enterprise risks facing the Company, including, but not limited to, risks associated with technology and operations, such as cybersecurity and cyber incident analysis and assessment. Our cybersecurity policies, standards, processes and practices are fully integrated into our enterprise risk management (“ERM”) program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry best practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on protecting our systems to support our business operations, preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively assessing and, if and as needed, responding to any cybersecurity threats and/or incidents.

Risk Management and Strategy

Key elements of our cybersecurity program include the following:

The Board’s oversight of cybersecurity risk management is supported by the Risk Committee, which regularly interacts with our ERM function, our Director of Information Security, and other members of the OD Technology Department.

The Board, through its Risk Committee, oversees the Company’s risk identification, risk tolerance, and management practices for enterprise risks facing the Company, including, but not limited to, risks associated with technology and operations, such as cybersecurity and cyber incident analysis and assessment. Our cybersecurity policies, standards, processes and practices are fully integrated into our enterprise risk management (“ERM”) program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry best practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on protecting our systems to support our business operations, preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively assessing and, if and as needed, responding to any cybersecurity threats and/or incidents.

The Board, through its Risk Committee, oversees the Company’s risk identification, risk tolerance, and management practices for enterprise risks facing the Company, including, but not limited to, risks associated with technology and operations, such as cybersecurity and cyber incident analysis and assessment. Our cybersecurity policies, standards, processes and practices are fully integrated integrated into our enterprise risk management (“ERM”) program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry best practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on protecting our systems to support our business operations, preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively assessing and, if and as needed, responding to any cybersecurity threats and/or incidents.

Risk Management and Strategy

Key elements of our cybersecurity program include the following:

The Board’s oversight of cybersecurity risk management is supported by the Risk Committee, which regularly interacts with our ERM function, our Director of Information Security, and other members of the OD Technology Department.

The Board’s oversight of cybersecurity risk management is supported by the Risk Committee, which regularly interacts with our ERM function, our Director of Information Security, and other members of the OD Technology Department.

We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and/or incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents as appropriate (including information that is conveyed to the Board under certain circumstances) so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

We have established and maintain comprehensive incident response and recovery plans that are designed to help us to timely and efficiently respond to a cybersecurity incident, and such plans are tested and evaluated on at least an annual basis.

We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

We provide regular, mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

Our Internal Audit Department, as part of its audit plan that is approved by the Audit Committee of the Board, conducts information technology audits as well as periodically engages third parties to perform cybersecurity attack and penetration assessments. We also use third parties to periodically benchmark and assess our cybersecurity readiness and to assess how any known vulnerabilities might impact our Company as well as the sufficiency of our response. The results generated from these activities are reported to management and are used to develop action plans to address any identified opportunities for risk mitigation and overall improvement. The Risk Committee of our Board is apprised by management of the results of the third-party analysis, any related action plans, and progress against those plans. Management, together with members of our OD Technology Department, brief the Board directly, or through their communications with the Risk Committee, on information security matters on at least a quarterly basis. After gathering and assessing information about our risk exposure, the Risk Committee reports the results of its review to the Board on a regular basis.

Please refer to “Risks Related to Cybersecurity and Technology Matters” under Item 1A, “Risk Factors” above for a discussion of the risks from cybersecurity threats and the potential impact to our strategy, results of operations and financial condition.

Governance

The Board and the Risk Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident.

Our Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to any cybersecurity incidents. Through ongoing communications and collaboration with these teams, including members of our senior management team, as appropriate, our Director of Information Security monitors the prevention, detection, mitigation and remediation of any cybersecurity threats and incidents in real time, and reports any such threats and incidents to the Risk Committee when appropriate.

We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and/or incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents as appropriate (including information that is conveyed to the Board under certain circumstances) so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

We have established and maintain comprehensive incident response and recovery plans that are designed to help us to timely and efficiently respond to a cybersecurity incident, and such plans are tested and evaluated on at least an annual basis.

We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

We provide regular, mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

Our Internal Audit Department, as part of its audit plan that is approved by the Audit Committee of the Board, conducts information technology audits as well as periodically engages third parties to perform cybersecurity attack and penetration assessments. We also use third parties to periodically benchmark and assess our cybersecurity readiness and to assess how any known vulnerabilities might impact our Company as well as the sufficiency of our response. The results generated from these activities are reported to management and are used to develop action plans to address any identified opportunities for risk mitigation and overall improvement. The Risk Committee of our Board is apprised by management of the results of the third-party analysis, any related action plans, and progress against those plans. Management, together with members of our OD Technology Department, brief the Board directly, or through their communications with the Risk Committee, on information security matters on at least a quarterly basis. After gathering and assessing information about our risk exposure, the Risk Committee reports the results of its review to the Board on a regular basis.

Please refer to “Risks Related to Cybersecurity and Technology Matters” under Item 1A, “Risk Factors” above for a discussion of the risks from cybersecurity threats and the potential impact to our strategy, results of operations and financial condition.

Governance

The Board and the Risk Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident.

Our Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to any cybersecurity incidents. Through ongoing communications and collaboration with these teams, including members of our senior management team, as appropriate, our Director of Information Security monitors the prevention, detection, mitigation and remediation of any cybersecurity threats and incidents in real time, and reports any such threats and incidents to the Risk Committee when appropriate.

We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and/or incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents as appropriate (including information that is conveyed to the Board under certain circumstances) so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and/or incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents as appropriate (including information that is conveyed to the Board under certain circumstances) so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

We have established and maintain comprehensive incident response and recovery plans that are designed to help us to timely and efficiently respond to a cybersecurity incident, and such plans are tested and evaluated on at least an annual basis.

We have established and maintain comprehensive incident response and recovery plans that are designed to help us to timely and efficiently respond to a cybersecurity incident, and such plans are tested and evaluated on at least an annual basis.

We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks

We provide regular, mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

We provide regular, mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

Our Internal Audit Department, as part of its audit plan that is approved by the Audit Committee of the Board, conducts information technology audits as well as periodically engages third parties to perform cybersecurity attack and penetration assessments. We also use third parties to periodically benchmark and assess our cybersecurity readiness and to assess how any known vulnerabilities might impact our Company as well as the sufficiency of our response. The results generated from these activities are reported to management and are used to develop action plans to address any identified opportunities for risk mitigation and overall improvement. The Risk Committee of our Board is apprised by management of the results of the third-party analysis, any related action plans, and progress against those plans. Management, together with members of our OD Technology Department, brief the Board directly, or through their communications with the Risk Committee, on information security matters on at least a quarterly basis. After gathering and assessing information about our risk exposure, the Risk Committee reports the results of its review to the Board on a regular basis.

engages

Please refer to “Risks Related to Cybersecurity and Technology Matters” under Item 1A, “Risk Factors” above for a discussion of the risks from cybersecurity threats and the potential impact to our strategy, results of operations and financial condition.

Governance

The Board and the Risk Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident.

Our Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to any cybersecurity incidents. Through ongoing communications and collaboration with these teams, including members of our senior management team, as appropriate, our Director of Information Security monitors the prevention, detection, mitigation and remediation of any cybersecurity threats and incidents in real time, and reports any such threats and incidents to the Risk Committee when appropriate.

The Board and the Risk Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident.

The Board and the Risk Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident.

Our Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to any cybersecurity incidents. Through ongoing communications and collaboration with these teams, including members of our senior management team, as appropriate, our Director of Information Security monitors the prevention, detection, mitigation and remediation of any cybersecurity threats and incidents in real time, and reports any such threats and incidents to the Risk Committee when appropriate.

Our Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to any cybersecurity incidents. Through ongoing communications and collaboration with these teams, including members of our senior management team, as appropriate, our Director of Information Security monitors the prevention, detection, mitigation and remediation of any cybersecurity threats and incidents in real time, and reports any such threats and incidents to the Risk Committee when appropriate.

Our Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). Our Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. reports

We own our principal executive office located in Thomasville, North Carolina, and 240 of the 260 service centers we operated as of December 31, 2025. Our facilities are strategically dispersed over the states in which we operate. Our owned service centers include most of our larger facilities and account for approximately 96% of the total door capacity in our network. At December 31, 2025, the terms of our leased properties ranged from month-to-month to a lease that expires in 2039.

We believe that all of our properties are in good repair and are capable of providing the level of service required by current business levels and customer demands. In addition, we believe we have sufficient capacity in our service center network to accommodate increased demand for our services.

We are involved in or addressing various legal proceedings and claims, governmental inquiries, notices and investigations that have arisen in the ordinary course of our business and have not been fully adjudicated, some of which may be covered in whole or in part by insurance. Certain of these matters include collective and/or class-action allegations. We do not believe that the resolution of any of these matters will have a material adverse effect upon our financial position, results of operations or cash flows.

Consistent with SEC Regulation S-K Item 103, we have elected to disclose those environmental legal proceedings with a governmental authority if management reasonably believes that the proceedings may involve potential monetary sanctions of $1.0 million or more. Applying this threshold, there are no such unresolved proceedings to disclose as of December 31, 2025.

Not applicable.

We own our principal executive office located in Thomasville, North Carolina, and 240 of the 260 service centers we operated as of December 31, 2025. Our facilities are strategically dispersed over the states in which we operate. Our owned service centers include most of our larger facilities and account for approximately 96% of the total door capacity in our network. At December 31, 2025, the terms of our leased properties ranged from month-to-month to a lease that expires in 2039.

We believe that all of our properties are in good repair and are capable of providing the level of service required by current business levels and customer demands. In addition, we believe we have sufficient capacity in our service center network to accommodate increased demand for our services.

We are involved in or addressing various legal proceedings and claims, governmental inquiries, notices and investigations that have arisen in the ordinary course of our business and have not been fully adjudicated, some of which may be covered in whole or in part by insurance. Certain of these matters include collective and/or class-action allegations. We do not believe that the resolution of any of these matters will have a material adverse effect upon our financial position, results of operations or cash flows.

Consistent with SEC Regulation S-K Item 103, we have elected to disclose those environmental legal proceedings with a governmental authority if management reasonably believes that the proceedings may involve potential monetary sanctions of $1.0 million or more. Applying this threshold, there are no such unresolved proceedings to disclose as of December 31, 2025.

Not applicable.

ITEM 5. MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES