Governance

Board of Directors

TOPIC	PRACTICE
INDEPENDENCE	8 out of 9 directors are independent Board committees are composed entirely of independent directors
DIVERSITY	Five out of nine directors are female or racially/ethnically diverse
EXECUTIVE SESSIONS	Non-management directors meet regularly without management
MAJORITY VOTING	Majority of votes cast is required for the election of directors
DIRECTOR EVALUATIONS	Evaluations of the full board and each committee are conducted annually
OVERBOARDING	Directors may not serve on more than four public company boards, including Kirby
STOCK OWNERSHIP	Stock ownership guidelines established for directors and executives
SINGLE VOTING CLASS	Kirby has a single class of voting stock
HEDGING & PLEDGING OF STOCK	Hedging and pledging of company stock by directors, officers, and employees is prohibited
BUSINESS ETHICS GUIDELINES	Ethics guidelines apply to all our directors, officers, and employees
CLAWBACK POLICY	We have a clawback policy in place for executive officers
INSIDER TRADING POLICY	Our insider trading policy applies to all our directors, officers, and employees, with a supplemental policy applicable to directors, executive officers and certain key employees
BOARD OVERSIGHT	The ESG and Nominating Committee oversees the Company’s corporate governance framework, Board composition and succession planning, and ESG matters. The Committee provides oversight of certain environmental risks, including climate-related risks, and reviews the Company’s ESG/Sustainability programs on a quarterly basis. In addition, the Committee assists the Board in overseeing risks that may arise in connection with the Company’s governance and social practices and processes and considers risk management in the context of general governance matters, including Board succession planning to help ensure that the Board maintains an appropriate mix of skills, experience and attributes. The Audit Committee oversees the Company’s risk management framework, employee hotline and whistleblower programs, and cybersecurity and information technology matters and reviews material legal matters on a quarterly basis to assess the Company’s risk exposure and risk tolerance. The Compensation Committee assists the Board in fulfilling its oversight of risks that may arise with the Company’s compensation programs and practices, and reviews executive compensation arrangements designed to promote accountability to maximize stockholder value over the long term.

Ethics, Policies, and Practices

Kirby is committed to the highest ethical standards across the company and its supply chain.

Business Ethics

9

Kirby is committed to doing business the right way or “The Kirby Way” which promotes standards of integrity, honesty, trust respect, fair play and teamwork for all employees

9

All Kirby directors, executives, and employees are required to sign and uphold the Business Ethics Guidelines

9

Guideline topics include but are not limited to Equal Opportunity, Discrimination and Sexual Harassment, Respecting Human Rights, Anti-Corruption, Financial Accountability, Political Activities, and Social Media.

9

Kirby does not tolerate any retaliation against employees for reporting a violation of law, rule, regulation, or the Guidelines

9

More than 5000 training courses were completed on Business Ethics and Foreign Corrupt Practices Act in 2025

Vendor Code of Conduct

9

Kirby implemented stronger guidelines for our suppliers which were designed to help ensure responsible product sourcing and the safety and well-being of workers across the global supply chain

9

Guidelines establish the minimum standards that must be met by any supplier that sells goods to or does business with Kirby regarding:

– Treatment of workers
– Workplace safety
– Impact on the environment
– Ethical business practices

Respecting Human Rights

Our Guidelines, along with other Kirby policies, establish practices and standards that address a broad range of human rights and workplace issues.

9

Kirby is committed to ensuring a work environment free from:

– Human Trafficking
– Forced Labor
– Child Labor
– Discrimination and Harassment

9

Employees are expected to consistently demonstrate respect and uphold the dignity of others

9

Employees are to encourage partners, suppliers, and other third parties to adopt similar standards with respect to human rights

Target Accomplished:
Company-wide training complete in 2025

Kirby’s position on Human Rights is outlined in its Business Ethics Guidelines, Vendor Code of Conduct, and Human Trafficking Policy. In addition to other training Kirby provides to its employees, Kirby has implemented targeted human rights training for its employees.

The Company achieved its goal to train all employees in 2025. Violations or concerns may be communicated via the Company Hotline and may result in termination of employment or the relationship with the supplier.

Cybersecurity and Data Privacy

Governance

9

Kirby’s cybersecurity programs align with the National Institute on Standards and Technology Cybersecurity Framework 2.0

9

Kirby senior management briefs the Board quarterly on information security matters

– Steering Committee: Meets at a minimum quarterly to discuss overall approach, manage priorities and ensure progress

– Audit Committee: Receives a cybersecurity update quarterly

Proactive Defense

9

Managed Detection and Response: Monitor the network for threat intelligence feeds from security experts to raise awareness and respond to mitigate risk on 24/7 basis

9

Multifactor Authentication

9

Monthly vulnerability management program for critical and high security patching

9

Anti-phishing solution for emails

9

Sophisticated backup and recovery solutions

9

Geofencing

9

Preparedness: A robust and practiced Incident Response Plan and Business Continuity plan

Employee Education & Training – Cybersecurity Awareness Campaign

9

Training: Security awareness program on a range of topics utilizing weekly tips and training

‒ All employees are required to complete annual cybersecurity training

‒ Additional targeted training with high-risk users and executives

9

Testing: Perform monthly phishing scam tests with associated real-time training

– Employees who fail a phishing test are required to take remedial training

9

Education: Cybersecurity Director speaks at operations meetings to raise awareness and educate on current topics