XML 26 R8.htm IDEA: XBRL DOCUMENT
v3.25.2

Cybersecurity Risk Management, Strategy, and Governance | 12 Months Ended
--- | ---
Apr. 27, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | ITEM 1C. CYBERSECURITY Our Board of Directors (the “Board”) recognizes the importance of cybersecurity and safeguarding our information systems and data assets. It is imperative that we maintain the trust and confidence of our customers, business partners and employees. Protecting our data and the data of our customers, business partners and employees is critical to maintaining that trust. As such, the Board is actively involved in overseeing our cybersecurity risk management program. Risk Management and Strategy We manage cybersecurity risks as part of our broader enterprise risk management framework, which allows us to leverage existing, robust processes for assessing the effectiveness and coverage of our controls. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information we collect and store, including information regarding our customers, suppliers and employees. As part of our enterprise risk management program, we actively work to identify, prevent, and mitigate cybersecurity threats, and take steps to be prepared to effectively respond to cybersecurity incidents when they occur. Our approach includes using select third-party resources, including external cybersecurity consultants, auditors, and technologies, along with our internal staff, to benchmark, measure, and improve our cybersecurity risk management systems and processes, and ensure alignment with industry best practices. We have established a robust cybersecurity governance framework to manage and mitigate risk. Our approach includes: • Security Operations Program - a security operations program to bolster real-time cybersecurity incident detection and response capabilities; • Third-Party Risk Management – regular evaluation and monitoring of our network of external partners, vendors, suppliers and service providers, which includes monitoring of third parties, securing vendor remote access, and implementation of protections against cyber threats that may arise through business-to-business system integrations; • Security Control Framework - a security control framework that aligns with industry accepted best practices and prioritizes implementation of critical cybersecurity controls; • Incident Response Plan - a cybersecurity incident response plan, designed to effectively address cybersecurity incidents while promoting cross-functional coordination across the organization; • Assessments – annual cybersecurity assessments, administered by a third-party specialist, which focus on identifying and remediating vulnerabilities that present the most significant organizational risks; • Training - security awareness training for all salaried personnel that highlights critical organizational risks through monthly phishing simulation campaigns, “lunch and learns,” and annual cybersecurity learning modules; • Insurance - cybersecurity insurance policies and periodic reviews of our policies and coverage levels; and • Monitoring Legal/Regulatory Developments - review of emerging data protection, data privacy, and other relevant cybersecurity laws and regulations to determine appropriate changes to cybersecurity controls and processes. Through the aforementioned processes, we did not identify risks from current or past cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect business strategy, results of operations, or financial condition. See “Risk Factors—Increasing dependence on information technology systems comes with specific risks, including cybersecurity breaches and data leaks, which could have an adverse effect on our business.”
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | We manage cybersecurity risks as part of our broader enterprise risk management framework, which allows us to leverage existing, robust processes for assessing the effectiveness and coverage of our controls. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information we collect and store, including information regarding our customers, suppliers and employees. As part of our enterprise risk management program, we actively work to identify, prevent, and mitigate cybersecurity threats, and take steps to be prepared to effectively respond to cybersecurity incidents when they occur.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Our Board of Directors has delegated to its Audit Committee primary responsibility for overseeing our management of risks arising from cybersecurity threats. The Audit Committee receives quarterly presentations on our cybersecurity program, including regular presentations regarding our cybersecurity risks; our efforts to address evolving standards; vulnerability assessments, including results of third-party penetration testing; and external audits of our cybersecurity IT controls. Management and the Board also receive prompt and timely information regarding any significant or potentially significant cybersecurity incident and our remediation efforts.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our Board of Directors has delegated to its Audit Committee primary responsibility for overseeing our management of risks arising from cybersecurity threats. The Audit Committee receives quarterly presentations on our cybersecurity program, including regular presentations regarding our cybersecurity risks; our efforts to address evolving standards; vulnerability assessments, including results of third-party penetration testing; and external audits of our cybersecurity IT controls. Management and the Board also receive prompt and timely information regarding any significant or potentially significant cybersecurity incident and our remediation efforts.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Audit Committee receives quarterly presentations on our cybersecurity program, including regular presentations regarding our cybersecurity risks
Cybersecurity Risk Role of Management [Text Block] | Our Vice President of Information Technology and our Director of Technical Infrastructure, in coordination with management, work to implement our program to protect the Company’s information systems from cybersecurity threats. These individuals work to promptly evaluate and address any cybersecurity incidents, and work with management to assess the impact and any necessary remediation efforts following a cybersecurity incident. In addition, the Vice President of Information Technology provides updates to the Audit Committee and the Board on a regular basis and as needed in response to specific incidents. To facilitate the success of our cybersecurity risk management program, we have assigned our Director of Technical Infrastructure and his team to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and provide reports to management. Our Vice President of Information Technology and Director of Technical Infrastructure have a combined 65 years of experience designing, implementing, and supporting information technology systems with a security-first mindset. In particular, prior to joining Culp, our Director of Technical Infrastructure gained experience leading cybersecurity teams at a managed security service provider, where he provided cybersecurity support to outside organizations.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Our Vice President of Information Technology and our Director of Technical Infrastructure, in coordination with management, work to implement our program to protect the Company’s information systems from cybersecurity threats. These individuals work to promptly evaluate and address any cybersecurity incidents, and work with management to assess the impact and any necessary remediation efforts following a cybersecurity incident. In addition, the Vice President of Information Technology provides updates to the Audit Committee and the Board on a regular basis and as needed in response to specific incidents.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our Vice President of Information Technology and Director of Technical Infrastructure have a combined 65 years of experience designing, implementing, and supporting information technology systems with a security-first mindset. In particular, prior to joining Culp, our Director of Technical Infrastructure gained experience leading cybersecurity teams at a managed security service provider, where he provided cybersecurity support to outside organizations.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | To facilitate the success of our cybersecurity risk management program, we have assigned our Director of Technical Infrastructure and his team to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration