text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive reports of any breaches or developments regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Audit Committee and Board members may also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Information Security, Product Security, Compliance and Legal teams. Key individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report directly or indirectly to the Audit Committee on any appropriate items.

companyName: ACM Research, Inc.

ticker: ACMR

secItem: Item 1C


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes.


text: Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our financial performance and results of operations, under the heading "Breaches of our cybersecurity systems could degrade our ability to conduct our business operations and deliver products to our customers, result in data losses and the theft of our intellectual property, damage our reputation, and require us to incur significant additional costs to maintain the security of our networks and data" in Item 1A, "Risk Factors" of Part I of this report.


text: We have established an Information Security Management System (the "ISMS"), which is integrated into our overall risk management system, to help us achieve our business goals. The ISMS defines our information security risk management approach and specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a risk assessment framework within the context of our overall business risks. The ISMS also specifies the requirements for implementing security controls designed to meet the needs of individual departments or parts thereof.

companyName: ProPetro Holding Corp.

ticker: PUMP


text: Risk Management and Strategy Our cybersecurity strategy focuses on implementing controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. We have processes in place designed to assess, identify, manage, and address material cybersecurity threats and incidents, including: annual security awareness training for employees, mechanisms designed to detect and monitor unusual network activity, and containment and incident response tools. Our ISMS is designed to help us identify and manage material risks from cybersecurity threats, and as part of our ISMS, we engage a range of third-party service providers, including assessors, consultants, and auditors, to assist us in these processes. Our risk assessment framework involves an information security risk assessment procedure that helps us identify potential cybersecurity threats and vulnerabilities (including relating to the use of third-party service providers) and then determine strategies to mitigate or counter the threats. As part of this process, we conduct annual penetration testing utilizing a third-party service provider. We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate. Our Information Technology Director also works with third-party service providers to assess potential cybersecurity threats and determines risk scores based on the likelihood of threats and the potential impacts of the threats, prioritizes risk and determines and recommends to our management controls aimed to counter such threats. We assess third-party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addenda to our contracts where applicable.


text: We also maintain procedures designed to protect the security of personally identifiable information, and our Privacy Policy provides details regarding the collection, storage, usage, and destruction of data. We require all employees to engage in data-security training upon hire and receive ongoing training thereafter. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate.


text: Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our cybersecurity risk management efforts are led by our Information Technology Director, who oversees our cybersecurity activities and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents as part of our ISMS. The Information Technology Director is part of the Company's Security Committee and reports to the Security Committee with respect to emerging cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. Our Security Committee, comprised of the Information Technology Director, the Chief Financial Officer, the Chief Legal Counsel and the Vice President of Human Resources is ultimately responsible for the implementation of our cybersecurity risk management processes. To facilitate effective oversight, our Security Committee holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging cybersecurity risks. The Security Committee has experience managing enterprises relying on technology and business systems with cybersecurity risks and consults with trusted advisors where appropriate.


text: The audit committee of our Board is responsible for oversight of risks from cybersecurity threats. The Information Technology Director presents an update on cybersecurity risk management to the audit committee of our Board during quarterly meetings and the audit committee reports to the Board.


text: Impact of Risks from Cybersecurity Threats As of the date of this report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Part I, "Item 1A. Risk Factors" of this Annual Report for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.


text: Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our cybersecurity risk management efforts are led by our Information Technology Director, who oversees our cybersecurity activities and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents as part of our ISMS. The Information Technology Director reports to the audit committee of our Board with respect to emerging cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. Our Information Technology Director and our Chief Financial Officer are ultimately responsible for the implementation of our cybersecurity risk management processes. To facilitate effective oversight, they hold discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging cybersecurity risks. They have experience managing enterprises relying on technology and business systems with cybersecurity risks and consults with trusted advisors where appropriate.


text: The audit committee of our Board is responsible for oversight of risks from cybersecurity threats. The Information Technology Director presents an update on cybersecurity risk management to the audit committee of our Board during quarterly meetings and the audit committee provides relevant updates to the Board.


text: Cybersecurity Risk Management and Strategy The Company assesses, identifies, and manages cybersecurity risks using a risk management program intended to reduce risks to the Company, its employees, customers and stockholders.

companyName: HF Foods Group Inc.

ticker: HFFG


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall enterprise risk assessment procedures. Our cybersecurity-specific risk assessment and management procedures help identify cybersecurity threat risks. Our cybersecurity risk assessment program includes the following: • Annual cybersecurity vulnerability and maturity assessments based on the Center for Internet Security (CIS) Critical Security Controls framework. • Annual internal/external penetration testing conducted by a third-party offensive security vendor.


text: A significant cybersecurity incident may result from actions by our employees, suppliers, third-party administrators, or unknown third parties or through cyber-attacks and could affect our data framework or cause a failure to protect the personal information of our customers, suppliers or employees, or sensitive and confidential information regarding our business and could give rise to legal liability and regulatory action under data protection and privacy laws. The Company describes whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect the Company under the heading "We rely on technology in our business and any cybersecurity incident, other technology disruption or delay in implementing new technology could negatively affect our business and our relationships with customers," in Item 1A of this Annual Report on Form 10-K. To date, there have not been any cybersecurity threats or incidents that have materially affected, or are reasonably likely to materially affect, the Company, including its financial condition, results of operations, or business strategies.


text: Our Board of Directors oversees our overall risk management strategy. Our information security program is managed by a dedicated Head of Information Technology, who has over twenty years of experience in IT application management, infrastructure and security across a variety of industries including Financial Services, Defense Contracting, Manufacturing and Distribution, whose team is responsible for maintaining our enterprise-wide cybersecurity strategy, policies, standards, architecture and processes. Our program is assessed both internally and externally by third parties, including our virtual Chief Information Security Officer ("vCISO") partner. Our Head of Information Technology provides reports at least quarterly to our Audit Committee, as well as our Disclosure Committee, which comprises senior management and key stakeholders, as appropriate. The reports provided include updates on our cyber risks and threats, key updates to our information security systems and programs as well as the current threat environment.


text: Our Board of Directors oversees our overall risk management strategy. Our information security program is managed by our Senior Vice President of People and Technology, who has twenty-five years of experience in IT leadership across a variety of industries including manufacturing, distribution, defense, and financial services, whose team is responsible for maintaining our enterprise-wide cybersecurity strategy, policies, standards, architecture and processes. Our program is assessed both internally and externally by third parties, including our virtual Chief Information Security Officer ("vCISO") partner. Our Senior Vice President of People and Technology provides reports at least quarterly to our Audit Committee, as well as our Disclosure Committee, which comprises senior management and key stakeholders, as appropriate. The reports provided include updates on our cyber risks and threats, and key updates to our information security systems and programs as well as the current threat environment.


text: We also have processes in place to stay informed of and monitor prevention, detection, mitigation, and remediation of cybersecurity risks, including: • Any cybersecurity breach, unauthorized access, data loss, or ransomware attack must be immediately escalated to the Disclosure Committee, General Counsel, Internal Audit, and Audit Committee. • On a quarterly basis, the Disclosure Committee, in coordination with the SVP of People and Technology, Internal Audit, and vCISO, shall assess the Company's cybersecurity risk exposure, including potential vulnerabilities in IT systems and data security.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: TechnipFMC plc

ticker: FTI


text: We design and assess our information security program with reference to the ISO 27001:2022 standard. For interoperability, our controls leverage the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use ISO 27001:2022 and NIST CSF as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and services; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We face continuing and ongoing material risks from cybersecurity threats, which the U.S. Securities and Exchange Commission defines as any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. See "Risk Factors—A failure or breach of our IT infrastructure or that of our subcontractors, suppliers or joint venture partners, including as a result of cyber-attacks, could adversely impact our business and results of operations." Otherwise, however, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.


text: The Audit Committee reviews and considers our risks relating to cybersecurity and receives and reviews from our Information Security Steering Committee ("ISSC") regular reports on our cyber readiness, adversary assessment, risk profile status, and any countermeasures undertaken or considered by us. Our ISSC also updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Board receives regular updates from the Audit Committee on cybersecurity risks, often with the participation of the Chief Information Security Officer ("CISO") to report on our information security activities. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our CISO or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our ISSC, including the Chief Technology Officer, Chief Legal Officer, Chief Information Officer and CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The ISSC receives monthly reports and updates from the CISO on our cybersecurity risks and cybersecurity incidents. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our ISSC includes team members who have previously completed ISO 27001 certification for international companies as well as individuals with professional cybersecurity relevant certifications such as CISSP and CCISO.


text: Our ISSC assists our management team to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and services; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We face continuing and ongoing material risks from cybersecurity threats, which the U.S. Securities and Exchange Commission defines as any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. See "Risk Factors—A failure or breach of our IT infrastructure or that of our subcontractors, suppliers, or joint venture partners, including as a result of cyber-attacks, could adversely impact our business and results of operations." Otherwise, however, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: The Audit Committee reviews and considers our risks relating to cybersecurity and receives and reviews from our Information Security Steering Committee ("ISSC") regular reports on our cyber readiness, adversary assessment, risk profile status, and any countermeasures undertaken or considered by us. Our ISSC also updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our ISSC, including the Chief Technology Officer, Chief Legal Officer, Chief Information Officer, and CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The ISSC receives monthly reports and updates from the CISO on our cybersecurity risks and cybersecurity incidents. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our ISSC includes team members who have previously completed ISO 27001 certification for international companies as well as individuals with professional cybersecurity relevant certifications such as CISSP and CCISO.


text: Cybersecurity Risk Management and Strategy We depend on information systems and technology in many aspects of our business, including running our manufacturing operations and communicating among our employees, suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including risk of system disruption, security breach, ransomware, theft, and inadvertent release of information. We have a risk-based cybersecurity program and a dedicated team of cybersecurity professionals focused on protecting our data and information systems. These cybersecurity threats and related risks make it necessary for us to stay apprised of developments in the information security field, and dedicate resources on cybersecurity. With Board of Directors and Audit Committee oversight, as part of our annual enterprise-wide risk management process, we assess and manage the material risks associated with cybersecurity.

companyName: Varex Imaging Corp

ticker: VREX


text: To identify, assess, and manage material cybersecurity risks, our team uses a cybersecurity risk assessment process aligned with leading frameworks such as the Cyber Security Framework of the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS") Critical Security Controls. Our cybersecurity risk assessment program provides the underlying basis for the activities of our team to identify and mitigate risks from, as well as develop risk management and response strategies for, evolving and emerging cybersecurity threats.


text: Our cybersecurity program includes a variety of processes to assess, identify and manage risks from cybersecurity threats arising from our own and third-party provided systems, including information security policies and procedures, simulation exercises, network and endpoint monitoring and detection tools, vulnerability management processes, risk assessments, third-party penetration testing and security requirements for our suppliers, vendors, and service providers. We have also engaged third parties to enhance and strengthen our cybersecurity program, to provide additional capabilities and support, and to provide periodic independent assessments and evaluations of our cybersecurity program, including through table top exercises to simulate responses to cybersecurity incidents, and other professional services.


text: We also monitor and test our safeguards and train our employees on cybersecurity safeguards related to our information technology systems. Our employees are required to take periodic training on cybersecurity and data privacy, and we conduct regular phishing email simulations to enhance awareness and responsiveness to such possible threats. We carry information security risk insurance that provides protection against certain defined potential losses arising from a cybersecurity incident.


text: In the event of a suspected incident, our incident response plan outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying the head of our Information Technology department ("Head of IT") and functional areas (e.g., legal and human resources) as appropriate. This includes processes for assessing such incidents for materiality, making required notifications, disclosures or communications and determining, among other things, whether any prohibition on the trading of our common stock by insiders should be imposed prior to the disclosure of information about a material cybersecurity event.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under Item 1A, "Risk Factors" in this Annual Report, which disclosures are incorporated by reference herein. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance Our Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee, is responsible for the oversight of risks from cybersecurity threats. At least annually, the Audit Committee receives an overview from management of our cybersecurity strategy, programs, and risk mitigation activities, as well as other developments and action items related to cybersecurity. In its meetings, the Audit Committee has the opportunity to discuss these matters with the head of our Information Technology department and other members of executive management. Members of the Board are also encouraged to engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are managed by the head of our Information Technology department, and our IT team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices.


text: The head of our Information Technology department, along with our cybersecurity program manager, are principally responsible for overseeing the risks related to cybersecurity. They are responsible for cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing the senior leadership with regular updates on cybersecurity-related matters. These team members combined have more than 39 years of experience in technology and information security risk management across a number of organizations, have multiple relevant technical and governance certifications, and are active in a number of cybersecurity related boards and organizations.


text: Cybersecurity Risk Management and Strategy We depend on information systems and technology in many aspects of our business, including running our manufacturing operations and communicating among our employees, suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including risk of system disruption, security breach, ransomware, theft, and inadvertent release of information. We have a risk-based cybersecurity program and a dedicated team of cybersecurity professionals focused on protecting our data and information systems. These cybersecurity threats and related risks make it necessary for us to stay apprised of developments in the information security field, and dedicate resources to cybersecurity. With Board of Directors and Audit Committee oversight, as part of our annual enterprise-wide risk management process, we assess and manage the material risks associated with cybersecurity.


text: Our cybersecurity risk management and strategy processes are managed by the head of our Information Technology department, and our Information Technology team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices.


text: The head of our Information Technology department, along with our cybersecurity program manager, are principally responsible for overseeing the risks related to cybersecurity. They are responsible for cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing senior leadership with regular updates on cybersecurity-related matters. These team members combined have more than 40 years of experience in technology and information security risk management across a number of organizations, have multiple relevant technical and governance certifications, and are active in a number of cybersecurity related boards and organization s.


text: Cyber Risk Management and Strategy Our cybersecurity organization's mission is to provide a targeted set of services, support and capabilities to reduce the risk of cyberattacks, rapidly detect and contain threats, and mitigate risks to critical data.

companyName: Moderna, Inc.

ticker: MRNA


text: Recognizing the threat of security breaches and cyberattacks globally, we have developed a cybersecurity program, overseen by our Chief Information Security Officer (CISO) and Chief Information Officer (CIO), that is designed to protect patient trust, defend the Moderna brand, and reduce the risk and impact of cyber-attacks. Our cybersecurity program is informed by industry standards and includes periodic risk assessments and security testing supported by cybersecurity technologies, including third-party security solutions, vulnerability management, and monitoring tools, designed to monitor, identify, and manage risks from cyber threats. In addition, we have implemented employee security and awareness training.


text: Management has established a cyber incident response plan (CIRP) designed to assess, identify and manage risks from cybersecurity threats and enable prompt response in the event that a cybersecurity incident is detected. We have a process in place for notification to our leadership response team in the event of a significant cyber incident, and for escalation of these events to our Audit Committee and Board, as appropriate. To date, we have not experienced a cybersecurity incident that has had a material impact on our business strategy, results of operations, or financial condition.


text: We undergo several annual internal compliance audits and external reviews to evaluate our controls, including cybersecurity controls. In an effort to minimize third-party risk, we have established a process to assess the security practices of third-party suppliers and related risks, including through review of relevant supplier certifications and security and responses to standardized information gathering (SIG) questionnaires, as applicable and appropriate.


text: Governance Related to Cybersecurity Risks Our Board of Directors oversees Moderna's overall risk management strategy. The Board exercises oversight of risks from cybersecurity threats primarily through its Audit Committee, which oversees our risk management processes for information security and technology risks. Our cybersecurity risk management processes are integrated into our overall risk management strategy, which is overseen by the Audit Committee. At least annually, the Audit Committee discusses our risk management program, including information security and technology risks and findings from any audits, with our internal audit staff.


text: The Audit Committee receives cyber-related updates from management, including our CISO at committee meetings. During meetings, our CISO updates the committee on Moderna's cybersecurity posture, potential threats and risk mitigation strategies, and the progress of the Company's cybersecurity initiatives, as appropriate. The Chair of the Audit Committee and management provide regular briefings on such matters to the full Board of Directors, as appropriate.


text: At the management level, our CISO is primarily responsible for leading our cybersecurity strategy for assessing and managing material risks from cybersecurity threats. Our current CISO has over 25 years of cybersecurity experience across a wide array of industries, most recently serving in leadership positions at two different public companies and previous roles of increasing responsibility at multinational technology companies. Our CISO reports directly to our CIO, who is a member of our Executive Committee and reports to our Chief Executive Officer.


text: We have built a cybersecurity leadership team designed to align with key services, with a separate lead overseeing each service offering, all reporting to the CISO. We also maintain relationships with law enforcement and industry groups to support our cybersecurity intelligence and risk management efforts.


text: Recognizing the threat of security breaches and cyberattacks globally, we have developed a cybersecurity program, overseen by our Chief Information Security Officer (CISO), that is designed to protect patient trust, defend the Moderna brand, and reduce the risk and impact of cyber-attacks. Our cybersecurity program is informed by industry standards and includes periodic risk assessments and security testing supported by cybersecurity technologies, including third-party security solutions, vulnerability management, and monitoring tools, designed to monitor, identify, and manage risks from cyber threats. In addition, we have implemented employee security and awareness training.


text: At the management level, our CISO is primarily responsible for leading our cybersecurity strategy for assessing and managing material risks from cybersecurity threats. Our current CISO has over 25 years of cybersecurity experience across a wide array of industries, most recently serving in leadership positions at two different public companies and previous roles of increasing responsibility at multinational technology companies. Our CISO reports directly to our Chief People and Digital Technology Officer, who is a member of our Executive Committee and reports to our Chief Executive Officer.


text: As part of our information technology needs, we have contracted with National Beef to provide certain equipment and services related to telephone systems, servers, network access, desktop and end-user support, and back-office equipment support. Inherent in the services provided by National Beef are its efforts to assess, identify and manage risks from cybersecurity threats related to the specific equipment and services it provides us. We have no independent internal processes for addressing cybersecurity threats and have not integrated any processes provided by National Beef in assessing, identifying and managing risks from cybersecurity threats into our overall risk management system; however, we do receive monthly reports from National Beef on user access changes to our electronic accounting file share folder.

companyName: U. S. Premium Beef, LLC


text: We are not aware of any risks from cybersecurity threats or previous cybersecurity incidents (and we are not aware of any) that have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.


text: The Board of Directors oversight of risks from cybersecurity threats has been limited to authorizing the engagement of National Beef to provide the information technology equipment and services described above. Management's role in assessing and managing our risks from cybersecurity risks has similarly been limited to the engagement of National Beef to provide information technology equipment and services. If National Beef were to inform us of a cybersecurity incident, that incident would be reported to the Board of Directors if material in nature.


text: Risk Management and Strategy Our information security policies and processes are designed to assess, identify, and manage material risks from cybersecurity threats, including protecting the security and confidentiality of consumer information. We use various tools and strategies to identify and assess material risks from cybersecurity threats. We conduct ongoing cybersecurity gap analysis and risks assessments, vulnerability testing, and penetration testing. The cybersecurity risk assessments, vulnerability testing, and penetration testing are designed to identify internal and external risks to the security of our information systems.

companyName: CONSUMER PORTFOLIO SERVICES, INC.

ticker: CPSS


text: We also actively monitor our systems and connections for abnormal activity, including malicious phishing attempts. This includes the use of intrusion detection systems, log analysis, and real-time monitoring of critical systems. We have an incident reporting portal available to all employees to submit any issues they suspect may pose a risk to our information technology ("IT") systems and security.


text: We use the results of the above-described tools and strategies to assess the sufficiency of the safeguards in place to manage material risks from cybersecurity threats, to enhance such safeguards, or implement new safeguards, as necessary. We have several safeguards in place to manage material risks from cybersecurity threats. We have security awareness training for our employees, including ongoing simulated phishing email campaigns. We utilize firewalls, anti-virus software, encryption on stored data and communication channels, secure web portals for remote access to our systems, password security, and two-factor authentication. We continuously update our software and security patches. We restrict inbound email attachments, certain websites, and cloud-based drives. We monitor and restrict information transfers to and from unauthorized IP addresses. We also have physical security safeguards for our locations and data centers. We back up our systems and data regularly. In addition, we have a disaster recovery program designed to help us quickly respond to and recover from an interruption of critical IT services.


text: As part of our overall risk management processes, we engage in a multi-departmental strategy to assess and incorporate the above processes and involve other departments as needed, including IT, Systems, Risk Management, and Legal. We engage assessors, consultants, auditors, or other third parties to assist with some of the processes above, including conducting risk and gap assessments, IT audits and consulting, system monitoring, vulnerability testing, and penetration testing. To oversee and identify material cybersecurity risks associated with our use of third-party service providers, we limit data access for third-party service providers to only the data that is necessary for the given function and conduct due diligence on our service providers including their information security practices. We require our service providers to maintain appropriate safeguards for the security of consumer information.


text: We cannot assure that our information security policies and processes will be effective in protecting us from cybersecurity threats. Risks from cybersecurity threats have not materially affected us. However, if we experience a material cybersecurity incident it is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For more information, please see Item 1A. Risk Factors of this Report, including the risk factors titled "If We Experience Problems with Our Originations, Accounting or Collection Systems, Our Results of Operations May Be Impaired" and "A Breach in the Security of Our Systems Could Result in the Disclosure of Confidential Information, or Subject us to Liability."


text: The Senior Vice President of Systems and the Vice President of IT are responsible for assessing and managing material risks from cybersecurity threats through the implementation of the Company's information security policies and processes. The Senior Vice President of Systems has over 20 years in IT and cybersecurity experience with the Company. The Vice of President IT has over 15 years in IT and cybersecurity experience with the Company and has earned industry certifications in IT. The Senior Vice President of Systems and the Vice President of IT report to the Executive Vice President of Risk, Systems, and IT.


text: The Senior Vice President of Systems and the Vice President of IT work directly with the internal and external IT personnel to implement our information security policies and processes, including those described in the "Risk Management and Strategy" above. They are informed about and monitor the prevention, detection, mitigation, and remediation or prevention of cybersecurity incidents through those processes. They regularly report on the status of these matters to the Executive Vice President of Risk, Systems, and IT.


text: The Board, as a whole, is responsible for risk oversight, including cybersecurity risk. As part of this oversight, the Executive Vice President of Risk, Systems, and IT reports to the Board annually on the status of and developments in the Company's information security policies and processes.


text: Management and Strategy Our cybersecurity program is designed to assess, identify, and manage material risks from cybersecurity threats, and protect and preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, the Company. Cybersecurity risks are incorporated into the Company's broader risk management process to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. As part of the cybersecurity program, we utilize a combination of internal technology and a third-party managed security service provider and their platform to monitor, evaluate and respond to cyber activity. We monitor and assess the information gathered by our security tools and services to identify gaps, exposures, or weaknesses in our overall security approach, and make the necessary changes to address such findings.

companyName: Lifeway Foods, Inc.

ticker: LWAY


text: Impact of Cybersecurity Risks and Threats We are not aware of having experienced any risks from cybersecurity threats or incidents through the date of this Report that have materially affected the Company, its business strategy, results of operation or financial condition or are reasonably likely to have such an effect over the long term. This does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact.


text: Additional information on cybersecurity risks we face is discussed in Part I, Item A – Risk Factors, which should be read in conjunction with the foregoing information.


text: Board of Directors Our Board of Directors oversees our risk management process, and cybersecurity risks are monitored as a part of the broader program. Our Board has delegated the primary responsibility to oversee risks from cybersecurity threats to the Audit and Corporate Governance Committee. The Chief Financial Officer presents updates to the Audit and Corporate Governance Committee and the full Board of Directors, on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, and the emerging threat landscape.


text: Our Chief Financial Officer is responsible for management oversight of our information security program and controls, which includes cybersecurity risk management. Our Director of IT ("Director") is responsible for the development, operation, and maintenance of our information security program and controls.


text: The Director has over 18 years of experience in the information technology field, and cybersecurity knowledge and skills gained through relevant experiences. The Director and Chief Financial Officer regularly review potential risks and measures implemented by the Company to identify and mitigate cyber security risks.


text: Risk management and strategy We, through our third-party provider that manages our information technology systems and networks, maintain policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Chief Financial Officer, who manages the Company's overall risk assessment and mitigation process. In addition to monitoring cybersecurity threats to the Company's information systems, the Company's risk management practices are intended to help monitor, mitigate and prevent cybersecurity risks from external sources. We operate as a virtual company and maintain vital information, including financial and payroll information, on servers owned and maintained by our vendors. As such, we rely on the internal controls of our third party vendors to protect our vital information. We obtain and review reports on the internal controls of our vendors on an annual basis to ensure that we believe their cybersecurity procedures are adequate and to confirm that there have been no data breaches affecting our information.

companyName: Xenetic Biosciences, Inc.

ticker: XBIO


text: We engage third party services in connection with our cybersecurity risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. Our managed information technology service provider monitors and alerts us of cybersecurity threats and potential breaches. Our managed information technology service provider has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: Employee training and phishing campaigns are conducted every year. The Company's employees are expected to help safeguard the Company's information systems and to assist in the discovery and reporting of cybersecurity incidents.


text: Although we may face a number of cybersecurity risks in connection with our business, we have not experienced any cybersecurity threats, incidents, or challenges that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, " Risk Governance


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers, with assistance from third-party consultants or advisors as appropriate, are responsible for the day-to-day management of the material risks we face. Our Chief Financial Officer oversees our cybersecurity risk assessment and mitigation process, and is responsible for the timely reporting of any material cybersecurity incident or threat, as well as any other cybersecurity related risks, to our board of directors.


text: Companies such as ours face a variety of risks, including financial reporting, legal, credit, liquidity, operational, health, safety and cybersecurity risks. The Board believes an effective risk management system will (1) identify the material risks that we face in a timely manner, (2) communicate necessary information with respect to material risks to senior executives and, as appropriate, to our directors (3) implement or oversee implementation of appropriate and responsive risk management and mitigation strategies consistent with our risk profile, and (4) integrate risk management into our decision-making.

companyName: GeoSolar Technologies, Inc.


text: Our Board oversees risk management after receiving briefings from advisors and also based on its own analysis and conclusions regarding the adequacy of our risk management processes. The Board continuously evaluates and manages material risks including geopolitical and enterprise risks, financial risks, environmental risks, health and safety risks and cybersecurity risks.


text: Daniel Chartock, our Chief Growth Officer and Executive Vice President of Operations, is responsible for assessing and managing cybersecurity risks. Mr. Chartock is experienced in assessing and managing cybersecurity risks due to his 30+ years in information technology consulting.


text: To date we have not experienced any cybersecurity threats and any risks from cybersecurity threats have not materially affected, and are not reasonably likely to materially affect, our business strategy, results of operations, or financial condition.


text: Cyber criminals are becoming more sophisticated and effective every day, and they are increasingly targeting software companies. All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data customers and other stakeholders entrust to us a top priority. Our Board and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Paysign, Inc.

ticker: PAYS


text: Risk Management and Strategy We understand the critical importance of cybersecurity in protecting our operations, customer data, and the integrity of our services. Our commitment to cybersecurity is unwavering, and we adopt a serious, multi-layered approach to minimize the risks and potential impacts of cyber-attacks which has been integrated into our overall risk management process. Our strategies are designed to ensure the resilience and security of our systems, safeguarding against both internal and external vulnerabilities. We employ state-of-the-art technologies and practices to secure our systems. This includes deploying advanced encryption, securing network infrastructure, and implementing robust access controls and authentication mechanisms.


text: While we can provide no assurance against unauthorized access and breaches, our information technology infrastructure is designed with security at its core, with all data, whether at rest or in transit, being protected against unauthorized access and breaches.


text: Partnerships and Collaboration We believe in the strength of collaboration in combating cyber threats. We actively engage with cybersecurity communities, industry groups, and regulatory bodies to stay ahead of evolving cyber risks. By sharing knowledge and best practices, we enhance our defenses and contribute to the broader effort of securing the digital ecosystem. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.


text: We continuously monitor our information technology environment to detect and respond to threats in real-time. Our dedicated cybersecurity team uses sophisticated tools to track anomalies, potential vulnerabilities, and ongoing attacks. This includes leveraging a best-in-class third-party 24/7/365 Security Operations Center.


text: This proactive surveillance allows us to address threats swiftly, mitigating any possible impact on our operations and clients. Semi-annually, we leverage third-party independent consultants to perform penetration and segmentation testing of our internal and externally facing environments. The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader risk assessment that is presented to our Board, Audit Committee, and members of management.


text: Technical Safeguards Cybersecurity is an ever-evolving field, and we are committed to continuous improvement of our security practices. We regularly review and update our cybersecurity policies, procedures, and technologies to address new challenges and adapt to the changing threat landscape.


text: is a foundational element of our operations. Our multi-layered approach — encompassing system security, vigilant monitoring, comprehensive training, and collaborative engagement — demonstrates our dedication to protecting our company, our clients, and the financial ecosystem. We remain steadfast in our commitment to maintaining the highest standards of cybersecurity resilience and response. We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our employees, management and the Board on our response to a cybersecurity incident.


text: Education and Awareness Recognizing that human error can often be a weak link in cybersecurity defenses, we are committed to regular and comprehensive training for all employees and executives. This includes annual cybersecurity awareness sessions for our Board, ensuring that our highest levels of leadership are informed and vigilant about the latest cybersecurity trends and threats. Our training programs are designed to foster a culture of security awareness, equipping our team with the knowledge and tools needed to recognize and prevent cyber threats.


text: Cybersecurity Threats We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition.


text: Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Audit Committee directly oversees our cybersecurity program. The Audit Committee receives regular updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.


text: Management's Role Our Chief Technology Officer, Information Security Officer, and General Counsel have primary responsibility for assessing and managing material cybersecurity risks and are members of our management's Information Technology Steering Committee (the "Security Committee"), which is a governing body that drives alignment on security decisions across the Company. Such individuals have experience in various roles for public companies involving managing information security, managing risk, implementing effective information and cybersecurity programs, and adhering to relevant compliance requirements. The Security Committee meets at least quarterly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Security Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies.


text: Risk Management and Strategy We maintain a technology and cybersecurity program, which includes information security, as part of our overall risk management process with the aim that our information systems, including those of our vendors and other third-parties, will be resilient, effective, and capable of safeguarding against emerging risks and cybersecurity threats. A key element of our technology and cybersecurity program strategy is fostering training and awareness for our employees.

companyName: Cardiff Lexington Corp

ticker: CDIX


text: Our technology and cybersecurity program focuses on the defense, rapid detection and rapid remediation of cybersecurity threats and incidents. Our program also includes cybersecurity policies and a crisis response and management plan that is intended to allow rapid management and response and appropriate communication of cybersecurity threats and incidents.


text: Our cybersecurity crisis management plan sets forth the items, procedures, and actions we expect to address and follow in the event of a cybersecurity incident, including detection, response, mitigation and remediation. When a potential threat or incident is identified, our cyber security incident response team will assign a risk level classification and initiate the escalation and other steps called for by our plan. All incidents that are initially assessed by the cybersecurity incident response team as potentially high-risk are escalated promptly to our Chief Executive Officer, who will determine whether and what elements of our cybersecurity crisis response and management plan should be activated, including escalation to other senior management. Our Chief Executive Officer will inform our board of directors of cybersecurity incidents, as appropriate, considering a variety of factors, including financial, operational, legal, or reputational impact.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: We are committed to appropriate cybersecurity governance and oversight. Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity and information security risks. As noted elsewhere in this report, we plan to establish a standing audit committee. Once we establish an audit committee, we anticipate that the audit committee will oversee risks related to cybersecurity and report to the full board regarding its activities, including those related to cybersecurity.


text: Our board of directors meets regularly with our executive management and receives updates on the status and overall effectiveness of our technology and cybersecurity program, relevant information technology operations, any changes in material cybersecurity risks and any significant cybersecurity incidents consistent with our technology and cybersecurity program. The board also discusses with executive management the steps management has taken to monitor and mitigate privacy, data security, and cybersecurity risk exposures, our information governance policies and programs, and major legislative and regulatory developments that could materially impact our exposure regarding privacy, data security risk, and cybersecurity. The board of directors considers cybersecurity as part of our business strategy, financial planning, and capital allocation.


text: For additional information on our cybersecurity risks, please see Item 1A " Risk Factors—Risks Related to Our Business and Structure—A cyber security incident could cause a violation of HIPAA, breach of member privacy, or other negative impacts."


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Sunshine Biopharma Inc.

ticker: SBFM


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the SOC reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: We have established policies and procedures for assessing, identifying, and managing material risk from cybersecurity threats. We monitor cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that we use through third party providers that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Empery Digital Inc.

ticker: EMPD


text: We conducted a NIST risk assessment and perform as needed updates to our risks to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. We engage a managed service provider ("MSP") and other third parties in connection with our cybersecurity and information technology risk assessment processes and our MSP also assists us with managing and monitoring our network and local compute systems. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as monitoring and testing our safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through communications.


text: As of December 31, 2023, and through the date of the filing of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual report on Form 10-K.


text: One of the key responsibilities of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face.


text: Our Executive Vice-President and Chief Financial Officer ("CFO") is primarily responsible for assessing and managing our material risks from cybersecurity threats. In this regard, our CFO has assistance from service providers, other consultants and third parties. Our CFO has served as an executive officer for three years and prior to this was an audit and advisory partner at a public accounting firm overseeing financial statement audits of public and private companies. Audit procedures performed for his clients included evaluating internal controls and risk assessment evaluations over information technology and cybersecurity policies.


text: Our CFO oversees our cybersecurity policies and procedures, including those described in "Risk Management and Strategy" above. Under such policies and procedures, our CFO is responsible for reporting to our board of directors regarding any cybersecurity incident including the results of cybersecurity risk assessments.


text: One of the functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives updates as needed from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition As of December 31, 2023, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.

companyName: ATHENA GOLD CORP

ticker: AHNRF


text: The Company does not, and will not, have the resources to institute cybersecurity measures until such time as it may be able to enter into a successful merger transaction.

companyName: CONECTISYS CORP

ticker: CONC


text: Risk Management and Strategy We recognized the significance of cybersecurity in our business operations. Therefore, we have established a comprehensive cybersecurity and risk management framework, which includes regular cybersecurity risk assessments to identify and evaluate potential cyber-attack threats and information security weakness that may affect our business. We plan to implement a series of preventive measures, including firewalls, cyber-attack detection systems, and data encryption, to safeguard confidential information and data. We will regularly conduct cybersecurity awareness training for employees to enhance their awareness of potential cybersecurity threats and ensure they take appropriate preventive measures.

companyName: TANCHENG GROUP CO., LTD.

ticker: QSJC


text: We ensure compliance with PRC laws and regulations, including but not limited to the Cybersecurity Law, the Personal Information Protection Law and The Cybersecurity Review Measures (2021 version). We endeavor to take appropriate measures to protect national secrets and sensitive data while ensuring that the disclosure complies with PRC restrictions on data transport.


text: Our cybersecurity crisis management plan outlines the items, procedures and actions we will undertake in the event of a cybersecurity incident, including detection, response, mitigation and remediation. When a potential threat or incident arises, our cybersecurity incident response team, currently consisting of one cybersecurity expert, will assign a risk level classification and initiate the necessary escalation procedures outlined in our plan. All incidents that are initially assessed by the cybersecurity incident response team as potentially high-risk are escalated promptly to our Chief Financial Officer, who will determine whether and what elements of our cybersecurity crisis response and management plan should be activated, including escalation to other senior management. Our Chief Financial Officer will inform our board of directors of cybersecurity incidents, as appropriate, considering a variety of factors, including financial, operational, legal or reputational impact.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. In the event of any significant cybersecurity incidents, we will publicly disclose the nature, scope, and impact of the incident, as well as the remediation measures we implement.


text: We are committed to appropriate cybersecurity governance and oversight. Our technology and cybersecurity program is the principal responsibility of our board of directors. Our board of directors will regularly review the cybersecurity policies and incident response plans to ensure the company remains vigilant against cybersecurity threats.


text: Our board of directors has oversight of our strategic and business risk management and has delegated cybersecurity risk management oversight to the Chief Financial Officer and our cybersecurity incident response team. Our board of directors are responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors. The company will continue to commit to maintaining high standards of cybersecurity practices to protect the interests of our customers, shareholders, and other stakeholders. We will continuously monitor the latest developments in the field of cybersecurity and update our cybersecurity and risk management framework as needed.


text: Risk Management and the ordinary course of our day-to-day business, we receive, process, use, store, and share digitally data, including user data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our this end, we have implemented a Security Incident Response Plan ("SIRP") designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them. Our SIRP is managed and monitored by a dedicated security/information systems team and includes mechanisms, controls, technologies, systems, policies, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them.

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: Preparation —perform a risk assessment and identify sensitive assets. Our team includes an outside security/information systems team that provides managed services on a regular basis.


text: Identification —monitor information technology systems and detect deviations from normal operations and see if they represent actual security incidents. When an incident is discovered, collect additional evidence, establish its type and severity, and document the incident. Containment —perform short-term containment, for example by isolating the network segment that is under attack;


text: then focus on long-term containment, which involves temporary fixes to allow systems to be used in production, while rebuilding clean systems.


text: Eradication —remove malware from all affected systems, identify the root cause of the attack, and take action to prevent similar attacks in the future.


text: affected production systems back online carefully, to prevent additional attacks. Test, verify, and monitor affected systems to ensure they are back to normal activity. Lessons learned —no later than two weeks from the end of the incident, perform a retrospective of the incident.


text: Prepare complete documentation of the incident, investigate the incident further, understand what was done to contain it, and determine whether anything in the incident response process could be improved.


text: The audit committee of our board of directors (the "Audit Committee") is responsible for overseeing cybersecurity risk and periodically updates our board of directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters, and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.


text: The identification, detection, prevention and remediation of known or potential IT security vulnerabilities, including those arising from third-party hackers, hardware or software, is extremely costly and time consuming. Company does not have the manpower, expertise or financial resources to effectively identify, detect, prevent or remediate cybersecurity risks. No assurance or guarantee whatsoever can be given that Company will not be damaged by the exploitation of its cybersecurity vulnerabilities.

companyName: PATRIOT GOLD CORP

ticker: PGOL


text: During the year ended, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Chilean Cobalt Corp.

ticker: COBA


text: We use a third-party vendor to provide a suite of services to assess, identify, and manage material risks from cybersecurity threats. These services include providing us with a secure email platform, including content examination and data leak prevention; system monitoring and support, including patch management, anti-virus and threat hunting services; and system backup and recovery services. As we expand our business operations, we plan to evaluate the development of enhanced processes that will allow for the identification and assessment of cybersecurity risk that will be integrated into an overall risk management system, which will be managed by senior management and overseen by the Board of Directors.


text: As part of these developments, we plan to identify and address cybersecurity risks related to our business, privacy and compliance issues through a multi-faceted approach that is expected to include third-party assessments, internal information technology (IT) audit, IT security, governance, risk and compliance reviews. In connection with these planned approaches, and to defend, detect and respond to cybersecurity incidents, we, among other things, will consider: conducting proactive privacy and cybersecurity reviews of systems and applications, audits of applicable data policies, performing penetration testing using external third-party tools and techniques to test security controls, conducting employee training, monitoring emerging laws and regulations related to data protection and information security, and implementing appropriate changes.


text: As part of the above-planned processes, we may engage external auditors and consultants with expertise in cybersecurity to assess our internal cybersecurity programs and compliance with applicable practices and standards.


text: We plan to design our risk management program to also assess third-party risks, and we plan to perform third-party risk management to identify and mitigate risks from third parties, such as vendors, suppliers, and other business partners associated with our use of third-party service providers. In addition to new vendor onboarding, we plan to perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: We expect that cybersecurity will become an important part of our risk management processes and an area of focus for our Board of Directors and management. We expect that our Board of Directors will be responsible for the oversight of risks from cybersecurity threats. We expect our senior management will provide our Board of Directors updates on at least an annual basis regarding matters of cybersecurity. This is expected to include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. We expect that our Board members will also engage in periodic conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Currently, our Chief Operating Officer is expected to lead our cybersecurity risk assessment and management processes and oversee their implementation and maintenance.


text: Our Chief Operating Officer will be tasked with staying informed about, and monitoring the prevention, mitigation, detection and remediation of cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes we plan to develop and as described above, including the operation of an incident response plan, and report to the Board of Directors on any appropriate items.


text: Risk Management and Strategy We have implemented a cybersecurity process that is designed to assess, identify, manage and govern material risks from cybersecurity threats and requires a firewall for outside connections.

companyName: FOCUS UNIVERSAL INC.

ticker: FCUV


text: We operate a closed server in a locked room and regularly examine cybersecurity threats that could compromise our information system's security or data and otherwise maintain our cybersecurity policies and procedures in accordance with industry standard control frameworks and applicable regulations, laws, and standards.


text: We regularly check and improve our security measures and educate our employees about such measures with the help of our information technology (IT) team. Key personnel are made aware of our cybersecurity process through trainings. We do not engage third party professionals or disclose our internal security measures to private parties.


text: We have never experienced a cybersecurity incident that was determined to be material, although, like many technology-dependent companies operating in the current environment, we have experienced cybersecurity incidents in the past. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, please see the section titled " Risk Factors."


text: One of the key functions of our board of directors, in connection with our IT team, is informed oversight of our risk management process, which includes risks from cybersecurity threats.


text: Our board of directors monitors and assesses strategic risk exposure, and our executive officers manage the material risks we face.


text: Our Vice President of Operations, who has over 30 years of experience in IT and marketing, works with our board of directors to manage our cybersecurity policies and processes, including those described in the "Risk Management and Strategy" section above. Together, they stay informed and manage how we identify, address, prevent and resolve cybersecurity issues and related matters. They also track how we prevent, identify, lessen, and address cybersecurity issues. This is done through regular checks of our systems, tests to identify security weaknesses, and maintaining an incident response plan. In addition to such regular system checks, our Vice President of Operations, together with the board, regularly discuss active, emerging and potential cybersecurity risks. They keep each other informed about significant changes affecting cybersecurity, and they periodically update management with these changes, as well as our cybersecurity risks, so that management can administer its oversight function as a part of its broader oversight and risk management.


text: We recognize the importance of securing our data and information systems and have a process for assessing, mitigating and managing cybersecurity and related risks.

companyName: INTRUSION INC

ticker: INTZ


text: Our VP of Engineering, who reports to the CEO, leads our cybersecurity function and is responsible for managing our cybersecurity risk and the protection of our networks, systems, and data. The VP of Engineering uses both internal and external resources to execute this process including our own INTRUSION Shield technology, to help prevent, identify, escalate, investigate, and resolve security incidents in a timely manner. The Company, with the oversight of the CTO, also requires all employees to complete an annual cybersecurity training course.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities. The Board of Directors receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually.


text: AppTech recognizes the importance of developing, implementing, and maintaining strong cybersecurity measures to safeguard our information systems and protect our data's privacy and integrity.

companyName: AppTech Payments Corp.

ticker: APCX


text: Engage Third-parties on Risk Management Due to the difficulties and evolving nature of cybersecurity threats, AppTech engages with external experts, including cybersecurity consultants and auditors to evaluate and test its risk management systems.


text: These relationships allow us to utilize specialized knowledge and insights, ensuring our strategies and processes remain in-line with current best practices. These third-parties provide the Company with regular audits, threat assessments, and consultations on security enhancements. Also, during onboarding and periodically thereafter, we conduct trainings for the Company's employees, contractors, and temporary workers about cybersecurity risks, including sending test phishing emails for training purposes to all users of the Company's email system.


text: Oversee Third-party Risk To manage the risks associated with third-party service providers, AppTech conducts weekly calls with its providers to monitor compliance on an ongoing basis. Issues that arise are addressed immediately with mitigating measures added to avoid future problems.


text: Risks from Cybersecurity Threats Like other companies in our industry, we face several cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations, or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our data and systems, including denial of service and phishing attacks.


text: Risk Management Personnel and managing our cybersecurity risks rests with our third-party provider, the Company's Director of Information Technology and Director of Software Engineering (referred to as "IT"). Their knowledge, experience and relationship with our third-party vendor instrumental in developing and executing our cybersecurity strategies.


text: Risk Management Reporting The IT Team provides updates to upper Management on a routine basis or as potentially critical risks from cybersecurity threats or incidents arise. In addition, the audit committee is notified of any material cybersecurity concerns that may impact internal controls, data storage, or the integrity of our financial reporting.


text: We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: Phio Pharmaceuticals Corp.

ticker: PHIO


text: Cybersecurity Program Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of safeguards, such as: continuous monitoring for internal and external threats; regular evaluations of our cybersecurity program, including periodic external reviews; and industry benchmarking. We also require cybersecurity trainings when onboarding new employees, as well as cybersecurity awareness training for our employees. Our program leverages standard industry frameworks to strengthen our program effectiveness and reduce cybersecurity risks.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider. We use a number of means to assess and manage cyber risks related to our third-party service providers, including conducting due diligence in connection with onboarding new vendors and seeking to include appropriate security terms in our contracts where applicable.


text: Cybersecurity Threats In the event of a cybersecurity incident, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain a disaster recovery plan in the event of a significant cybersecurity incident.


text: We have relationships with a number of third-party service providers to assist with cybersecurity containment and remediation efforts, including insurance providers and various law firms.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by the use of consultants as the Company does not have a full-time dedicated cybersecurity position in the Company. Our consultant has over 20 years of experience in information technology matters and is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. The Board of Directors (the " Board ")


text: has overall responsibility for risk oversight and cybersecurity risk matters. The Board is responsible for discussing with management the Company's data privacy, information technology and security and cybersecurity risk exposures, including: (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation; (ii) the programs implemented by management to monitor and mitigate any exposures; and (iii) major legislative and regulatory developments that could materially impact the Company's data privacy and cybersecurity risk exposure.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall information technology (" IT ") processes. As part of our IT process, we identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our own systems, networks, and technology or the systems, networks and technology of our contractors, consultants, vendors and other business partners.


text: As of December 31, 2023, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors."


text: There have been an increasing number of cyberattacks on companies around the world, which have caused operational failures, compromised sensitive corporate or customer data, and/or resulted in significant financial damages. These attacks have occurred over the internet, through malware, viruses or attachments to e-mails, or through inside actors with access to systems within the organization.

companyName: CNS Pharmaceuticals, Inc.

ticker: CNSP


text: Risk Management and Strategy We have recently implemented additional security measures as part of an evolving cybersecurity posture and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks and mitigate the damage that could result from such an attack. All employees have recently (subsequent to December 31, 2023) begun receiving cybersecurity training and other education regarding their use of computers, information technology, and sensitive data including specifically how to recognize common attack strategies. As the Company does not have a physical office location, it does not have a local network or in-house servers and proprietary applications. We therefore utilize third parties applications and resources to support our information technology ("IT") needs. All applications utilized by the Company are Software as a Service ("SaaS") offerings. As our applications are developed and managed by third parties, we are dependent on these providers for many functions including disaster recovery during a disaster or cyber incident. Our goal is to only utilize the most secure and trusted providers for our IT needs. To this end, we are currently reviewing the security credentials and certifications of our key application providers. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers.


text: Our cybersecurity management strategy consists of utilizing a combination of employee education, preventative controls, detective controls, and periodic third-party cybersecurity testing.


text: During fiscal year 2023 we began to deploy and utilize enterprise scale technology to support an appropriate cybersecurity posture including: endpoint detection and response, firewalls, security information and event management, email security, multifactor authentication, and vulnerability management, with deployment of these tools completed subsequent to December 31, 2023. As part of the service offering from out outsourced IT security services provider, cybersecurity related alerts will be issued to us as relevant situations develop. These alerts will be evaluated in concert with our IT provider and in the event an alert requires action within our environment, such actions will be taken promptly. Our process and cybersecurity posture will continue to be refined based on the results of periodic cybersecurity assessments conducted jointly with our IT provider. We have recently begun reporting on cybersecurity in reports to the Board of Directors and will continue to do so.


text: To operate our business, we rely upon certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, SaaS platforms, managed services, cloud-based infrastructure, content delivery, encryption and authentication technology, corporate productivity services, and other functions. We are developing certain vendor management processes designed to help to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections, requiring their completion of written questionnaires regarding their services and data handling practices, and conducting periodic re-assessments during their engagement. For our largest third-party provider, our Contract Research Organization ("CRO") which is helping us manage our potentially pivotal global trial of Berubicin, we are currently conducting a comprehensive security assessment and review including their cybersecurity practices, protocols and protections, handling of information protected by HIPAA, and physical security.