text: Nominating and Corporate Governance Committee — The Nominating and Corporate Governance Committee, which is comprised entirely of independent directors, reviews with management the Company's technology and cybersecurity frameworks, policies, programs, opportunities, and risk profile both at its regularly scheduled meetings and, if appropriate, in real time. Cybersecurity Leadership, members of the cybersecurity team, or other advisors, as requested by the Nominating and Corporate Governance Committee, report at least quarterly on the Company's technology, data privacy, and cybersecurity strategies and risks. Cybersecurity topics are presented to the Nominating and Corporate Governance Committee on a quarterly basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics. Reporting to the Nominating and Corporate Governance Committee is multi-format and includes both live presentations and memoranda. The Board believes that this regular cadence of reporting helps to provide the Nominating and Corporate Governance Committee with an informed understanding of the Company's dynamic cybersecurity program and threat landscape. The Nominating and Corporate Governance Committee further reviews with management the Company's business continuity and disaster recovery plans and capabilities, including our cybersecurity and business interruption insurance coverages, and the effectiveness of the Company's escalation procedures. Based on these management reports, the Nominating and Corporate Governance Committee may request follow-up data and presentations to address any specific concerns and recommendations. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated by management on an as needed basis to the Nominating and Corporate Governance Committee. The Nominating and Corporate Governance Committee may also escalate such issues to the full Board at any time.


text: Management's Role The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by Cybersecurity Leadership who are actively involved in assessing and managing cybersecurity risks. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. The responsibilities and relevant experience of each of the Cybersecurity Leaders are listed below: • The CIO provides leadership for the Company's technology department, including responsibility for leading organization-wide cybersecurity strategy, policy, and processes. Our CIO has served in this role since June 2024 and has over 25 years of cybersecurity experience, including technology positions at the US Army, Accenture, Advance Auto Parts, Finishline Shoes, and PF Chang's. • The VPIT, reporting to the CIO, is responsible for the assessment, oversight, and management of our enterprise-wide cybersecurity strategy and governance. Our VPIT has served in this role since 2020 and has significant relevant experience and professional certifications, including nearly 20 years of cybersecurity and infrastructure experience. The VPIT, along with our cybersecurity team, has guided the organization through building a multi-layer cybersecurity program.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX

secItem: Item 1C


text: The Company's cybersecurity department is comprised of teams that engage in a range of cybersecurity activities such as threat intelligence, security architecture, and incident response. These teams, in coordination with third parties, conduct vulnerability management and penetration testing to identify, classify, prioritize, remediate, and mitigate vulnerabilities. The results of these tests are reviewed with the Nominating and Corporate Governance Committee. Leaders from each team regularly meet with Cybersecurity Leadership to provide visibility into major issues and seek alignment with strategy. As noted above under "Incident Response," the Company's cybersecurity incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management and the Board, as appropriate. Cybersecurity incidents that meet certain thresholds are escalated to Cybersecurity Leadership and cross-functional teams on an as-needed basis for support and guidance. The Company's incident response team also coordinates with external legal advisors, communication specialists, government agencies, regulators, law enforcement, and other key stakeholders. KNIGHT-SWIFT TRANSPORTATION HOLDINGS INC.


text: Inc. recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: SideChannel, Inc.

ticker: SDCH


text: Inc. has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Third-parties on Risk Management the complexity and evolving nature of cybersecurity threats, SideChannel, Inc. engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Third-party Risk we are aware of the risks associated with third-party service providers, SideChannel, Inc. implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our Chief Information Security Officer ("CISO") and on an ongoing basis by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. from Cybersecurity Threats have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence, Board of Directors Oversight Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain.


text: The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. CISO and the Chief Executive Officer ("CEO") play a pivotal role in informing the Audit Committee on cybersecurity risks.


text: They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; of ongoing cybersecurity initiatives and strategies;


text: reports and learnings from any cybersecurity events; and addition to our scheduled meetings, the Audit Committee, CISO and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of SideChannel, Inc. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Management Personnel responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO, Mr. Bill Roberts. With over 25 years of experience in the field of cybersecurity, Mr. Roberts brings a wealth of expertise to his role. His background includes extensive experience as an enterprise CISO and is well-recognized within the industry. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: CISO, in his capacity, regularly informs the Chief Financial Officer (CFO) and Chief Executive Officer (CEO) of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing SideChannel, Inc. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: The Board, Audit Committee, executive and middle management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, and mitigation. Assessing, identifying and managing cybersecurity related risks are integrated into our overall risk management process. We have policies and/or procedures concerning cybersecurity matters related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: Where Food Comes From, Inc.

ticker: WFCF


text: Company's Chief Technology Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Chairman of the Board. Our Chief Technology Officer has over two decades of experience leading cyber security oversight, while others on our IT security team have cybersecurity experience and/or a college degree with concentrations in security. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to attend company-wide training which includes cybersecurity topics several times a year.


text: have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. We utilize independent expert organizations that employ cybersecurity dashboards that automate the aggregation and analysis of data points to help us address possible exposures and internal control weaknesses, as well as review recommended areas of action to improve the quality and maturity of our controls. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. We also conduct an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.


text: full Board participates in discussions with management and amongst themselves regarding cybersecurity risks. Management provides updates regarding our cybersecurity program, which includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. Management also updates the Board on the Company's Cyber Attack Recovery Plan, which covers, among other things, our approach to material cybersecurity incidents, data privacy and our compliance programs.


text: To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically attends presentations on face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "A significant data breach or information technology system disruption could adversely affect our business, financial results, or reputation, and we may be required to increase our spending on data and system security" in


text: We have a range of security measures that are designed to protect against the unauthorized access to and misappropriation of our information, corruption of data, intentional or unintentional disclosure of confidential information, or disruption of operations. These security measures include controls, security processes and monitoring of our manufacturing systems. We have cloud security tools and governance processes designed to assess, identify and manage material risks from cybersecurity threats. In addition, we maintain an information security training program designed to address phishing and email security, password security, data handling security, cloud security, operational technology security processes, and cyber-incident response and reporting processes.

companyName: IMPACT BIOMEDICAL INC.

ticker: IBO


text: Company is committed to maintaining the highest standards of cybersecurity to protect our data, intellectual property, and customer information from cyber threats. As part of this commitment, we leverage a sophisticated cybersecurity framework that integrates the robust capabilities of the Microsoft cloud ecosystem with the specialized services of a leading third-party cybersecurity service provider.


text: Microsoft cloud ecosystem, including Microsoft 365, Azure, SharePoint Online, Microsoft Defender, and Microsoft InTune, forms the backbone of our cybersecurity infrastructure. These platforms offer advanced security features such as data encryption in transit and at rest, network security controls, identity and access management, and threat protection capabilities. Microsoft's constant investment in cybersecurity research and development ensures that we benefit from cutting-edge security technologies and practices.


text: In addition to utilizing the Microsoft cloud ecosystem, we have engaged a third-party service provider to enhance our cybersecurity posture further. This provider brings additional layers of security through services including: Software Security Management: Ensuring that applications such as Office 365 and Azure are configured, maintained and following best security practices.


text: Monitoring and Consultation Services: Continuous monitoring of our systems for suspicious activities and providing expert consultation to address and mitigate potential threats.


text: Storage and Backup of Source Systems: Implementing robust data storage solutions and backup protocols to ensure data integrity and availability. Policy Management: Developing and enforcing comprehensive security policies that govern all aspects of our cybersecurity efforts. Response Management: Rapid identification and response to security incidents to minimize impact. Software Implementation: Deployment of state-of-the-art security software solutions that complement the security features of the Microsoft cloud ecosystem.


text: Our approach to cybersecurity is proactive and multifaceted, combining the scalability and reliability of the Microsoft cloud services with the agility and expertise of our third-party cybersecurity partner. Together, these resources form a comprehensive defense mechanism against a wide range of cyber threats, from phishing and malware attacks to sophisticated nation-state sponsored cyber-attacks. We continuously evaluate and adapt our cybersecurity strategy to respond to evolving threats and to align with best practices and regulatory requirements.


text: Our commitment to cybersecurity is integral to our business operations, and we believe our strategic investments in this area significantly mitigate the risk of cybersecurity incidents that could impact our company's reputation, financial position, or operational capabilities.


text: The management of the Company is responsible for overseeing risk for the Company and has delegated to the VP, Engineering & Technology ("VPE&T") the responsibility for overseeing the cybersecurity risk management strategy for the Company. Management receives regular updates on our cybersecurity risk management process from the VPE&T. The VPE&T reviews our comprehensive cybersecurity framework, including reviewing our cybersecurity reporting protocol that provides for the notification, escalation and communication of significant cybersecurity events to the management team. Company's cybersecurity program is overseen by our VPE&T, who is responsible for global information technology, including cybersecurity.


text: Our VPE&T, is primarily responsible for assessing and managing material risks from cybersecurity threats, including monitoring the measures used for prevention, detection, mitigation and remediation of cybersecurity incidents. The information security organization is comprised of internal IBIO employees and external security suppliers who provide security monitoring and response.


text: Management and Strategy have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We monitor cybersecurity threats, including any potential unauthorized occurrence on or conducted through information systems that we use through third party providers that may result in adverse effects on the confidentiality, integrity, or availability of any information residing therein.

companyName: Bone Biologics Corp

ticker: BBLG


text: require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole.


text: Chief Executive Officer and Chief Financial Officer are primarily responsible to assess and manage our material risks from cybersecurity threats. Chief Financial Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy"


text: above. Under such policies and processes, our Chief Financial Officer is responsible for reporting to our Board of Directors regarding any cybersecurity incidents.


text: believe cybersecurity is critical to advancing our technological advancements. As a biopharmaceutical company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Canton Strategic Holdings, Inc.

ticker: CNTN


text: Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our cybersecurity consultant, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Our Cybersecurity consultant has extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach.


text: rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.


text: Cybersecurity Processes We continue to strengthen our cybersecurity measures to safeguard our information systems based on industry standards. Our measures include policies to promote internal compliance by our employees, policies and procedures to regularly evaluate the security of our information systems and implementation of third-party products, including intrusion prevention and detection solutions, multifactor identification and anti-virus software, to help detect and protect against potential cybersecurity threats. We educate our staff on cybersecurity matters with periodic risk awareness information, phishing awareness campaigns, and training materials. Moreover, given the rapid growth of our global operations in 2023 due to the Ibeo acquisition, and our expectations for near- and long-term strategic growth, our Information Technology, or IT, team is prioritizing enhancements to our response system and continuity plans.

companyName: MICROVISION, INC.

ticker: MVIS


text: key dimension to the security and effectiveness of our information system is our compliance with standards that are unique to the industries in which we operate. For instance, it is critical that our information system achieves TISAX certification. Established by the German Association of the Automotive Industry, Trusted Information Security Assessment Exchange, or TISAX, is a globally recognized assessment and exchange mechanism for information security in the automotive industry. Automotive OEMs rely on the TISAX label to ensure that suppliers and partners have a solid information security management system in place. To successfully complete the TISAX assessment process in our German and U.S. operations, we are actively evaluating our cybersecurity measures and seeking enhancements, including engaging a third-party auditor and global standardization of our cybersecurity training program, to ensure a comprehensive and robust system.


text: our third-party information system providers, as well as any other provider that may have access to our data, for their maturity and reliability, and as a matter of policy we choose to only work with reputable vendors.


text: from Cybersecurity Threats have not encountered cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our operations or financial condition. Any material cybersecurity incident could have a material impact on our operations by causing a disruption to our ability to function as a global organization, by interrupting our internal and external communications and reporting or managing our operations. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K, including "Our operations could be adversely impacted by information technology system failures, network disruptions, or cybersecurity breaches," for additional discussion about cybersecurity-related risks.


text: of Directors and Audit Committee delegated authority from our Board of Directors and in accordance with its charter, our Audit Committee is charged with the oversight of enterprise risk, including risk related to cybersecurity threats. Our Audit Committee Chair is expected to report regularly to our Board of Directors about our Audit Committee's oversight of enterprise risk. Beginning in 2024, our Audit Committee Chair will report quarterly to our Board of Directors specifically about our cybersecurity incident management and governance.


text: Management, and specifically our Chief Financial Officer, reports to our Audit Committee on cybersecurity, including initiatives and strategies, and incident reporting and any lessons learned. Beginning in 2024, our Chief Financial Officer will make this report on a quarterly basis.


text: From time to time, management will also engage in informal discussions with members of the Audit Committee about our cybersecurity practices and risks, including informing our Audit Committee Chair in a timely manner about any cybersecurity incidents that management determines may have a significant impact on our operations or that may trigger any reporting obligations. Audit Committee will conduct an annual review of our cybersecurity measures and the effectiveness of our risk management strategies.


text: Verma, joined MicroVision in 2021 as our Chief Financial Officer. He is an experienced risk management professional and currently oversees the Company's accounting and finance strategies, including risk management. Mr. Verma also oversees our IT team and, with regular communication with the team, is responsible for approving the IT budget, hiring of IT personnel, including third-party consultants, and approving cybersecurity processes and other cybersecurity-related matters. Although we do not currently employ a chief information security officer, we are working with an outside consulting firm that is serving in this role and assisting our internal team with the primary responsibility of overseeing our cybersecurity measures and risks.


text: day-to-day responsibility for assessing, monitoring and managing our cybersecurity risks resides with our IT team. Across the IT team we have employees who have in-depth knowledge and decades of cybersecurity industry experience, including prior experience with developing and overseeing cybersecurity polices and processes for companies required to comply with NIST SP800-171, cybersecurity standards for companies that store sensitive unclassified information on behalf of the United States government, and former Ibeo employees having experience with TISAX compliance. Yet, we recognize the evolving and increasing threat that cybersecurity will have on our operations. As part of our long-term growth strategy, we expect to establish a dedicated cybersecurity team to oversee our cybersecurity risk management.


text: IT Team Director regularly meets with the Chief Financial Officer and as appropriate the Chief Executive Officer to discuss cybersecurity risks. This ensures that management is informed about our current cybersecurity measures and aware of any potential risks facing our operations. In the event of a cybersecurity incident, we have put in place a reporting structure to inform the Chief Financial Officer, Chief Executive Officer and General Counsel promptly of any incident so that they may assess the appropriate response to the incident and any reporting concerns that may be triggered by the incident.


text: Company's cybersecurity risks are theft of intellectual property, theft of other business data, fraud or extortion, lack of access to our information systems, harm to employees, harm to business partners, violation of privacy laws, potential reputational risk, and litigation or other legal risk if a cybersecurity incident were to occur. It is difficult to assign a monetary materiality assessment to these risks or to the impact if the Company were to sustain a breach of its systems. Our approach is based on the premise that any cybersecurity incident could result in material harm to the Company.

companyName: enVVeno Medical Corp

ticker: NVNO


text: Audit Committee has been designated with oversight responsibility for cybersecurity risks and our Chief Financial Officer is responsible for managing our efforts in this area. Neither the Chief Financial Officer nor any member of the Audit Committee has relevant expertise in cybersecurity. Rather, the Company retains an outside technical expert to support our information technology systems including addressing cybersecurity risks.


text: conduct annual assessments of risks posed by cybersecurity threats in conjunction with our insurance renewal cycles. This includes a thorough review of our systems and vulnerabilities. As a result of these assessments, we have implemented tools and practices to proactively monitor our systems and user accounts including, but not limited to, deploying solutions to constantly monitor users accessing systems, implementation of two factor authentication for logins, and improved rules for password maintenance.


text: many companies, we make use of cloud-based solutions provided by several large service providers for critical information technology infrastructure such as email and file storage. We do not maintain stand-alone servers for our email, file storage or other business applications.


text: In the normal course of our relationships with the providers of these services, we regularly monitor their message boards and other formal and informal communications channels for signs of breaches of their systems. We also survey available public information for indications that they have suffered a breach of their systems.


text: of our business partners also maintain data related to our trials and ongoing product development on servers they maintain. We require these partners to comply with all HIPAA standards for maintaining security of their systems where this data resides.


text: management and strategy have developed and maintain a cybersecurity risk management program that focuses primarily on securing and safeguarding computer systems, networks, cloud services, business applications, and data and that is integrated in our overall risk management strategy and framework.

companyName: InspireMD, Inc.

ticker: NSPR


text: We have implemented protocols to protect against cyber threats and ensure the containment and security of sensitive business data, including ongoing security reviews of critical systems, continuous monitoring of event data, and employee training programs, which processes are aligned with our overall business and operational goals and strategies. Our risk assessment occurs on an ongoing basis and covers identification of risks that could act against the company's objectives as well as specific risks related to a compromise to the security of data.


text: engage a third-party to provide operational support for cybersecurity risks. This forms a critical part of our risk management strategy, facilitating effective management and mitigation of risks, and ensuring adherence to applicable regulatory and industry standards.


text: we believe that we have established a robust framework for confidentiality, integrity, and availability of information, adhering to relevant security standards, practices, and compliance requirements. In addition, we maintain insurance to help protect against risks associated with cybersecurity threats. As of the date of this report, we do not believe that any risks from cybersecurity threats have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition.


text: However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Item 1.A – Risk Factors – Risks Related to Our Business Operations – Our business and operations would suffer in the event of computer system failures, cyber-attacks Governance


text: board of directors provides oversight of our cybersecurity program and helps guide our strategy for managing cybersecurity risks in the context of our overall risk management system. Our cybersecurity program is managed by our Senior Vice President of Finance, our internal IT team and our external Chief Information Security Officer ("CISO") whose is responsible for leading enterprise-wide cybersecurity strategy, protocols, framework, standards and processes. The Senior Vice President of Finance reports to our board of directors, as well as our Chief Executive Officer and Chief Financial Officer and other members of senior management as appropriate.


text: Management and Strategy regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our board of directors assesses risks based on probability and potential impact to key business systems and processes as part of our overall risk management program overseen by the board of directors. Risks that are considered high are incorporated into our overall risk management program. We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes and to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services. Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. Refer to the risk factor captioned " Cyber security risks and the failure to maintain the integrity of company, employee or guest data could expose us to data loss, litigation and liability, and our reputation could be significantly harmed " in Part I, Item 1A. "Risk Factors" for additional details regarding cybersecurity risks and potential impacts on our business.

companyName: Lipocine Inc.

ticker: LPCN


text: board of directors oversees our risk management process, including as it pertains to cybersecurity risks, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.


text: Meetings of our board of directors include discussions and presentations from management regarding specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from management on our enterprise risk profile on an annual basis. The board of directors reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents. We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents.


text: Management and Strategy our business information, intellectual property, customer and employee data and technology systems is essential for the continuity of our business, meeting applicable regulatory requirements and maintaining the trust of our stockholders. Cybersecurity is an important and integrated part of our enterprise risk management function that identifies, monitors and mitigates business, operational and legal help protect us from a major cybersecurity incident that could have a material impact on operations or our financial results, we have implemented policies, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps we take to reduce our vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to: annual penetration testing by a third party vendor, cloud and agent based security scanning that runs continuously, establishing information security policies and standards, implementing information protection processes and technologies, monitoring our information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, and implementing cybersecurity training. In addition, we annually purchase a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.

companyName: ACORN ENERGY, INC.

ticker: ACFN


text: Board of Directors is actively engaged in overseeing and reviewing our strategic direction and objectives, taking into account, among other considerations, our risk profile and related exposures, including oversight of risks from cybersecurity threats. As part of this oversight, the Company established a Cybersecurity Steering Committee consisting of certain members of our senior management team and a Board representative, that meets quarterly and updates the Board periodically, and at least annually, on our cybersecurity program, including with respect to particular cybersecurity threats, cybersecurity incidents, new developments in our risk profile, the status of projects to strengthen our cybersecurity systems, assessments of our cybersecurity program, and the emerging threat landscape.


text: has the responsibility to manage risk and bring to the Board's attention any material near-term and long-term risks to the Company, including risks from cybersecurity threats. We actively engage with key vendors and industry participants and monitor new developments in global cybersecurity concerns as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and procedures. Our Cybersecurity Steering Committee has developed a standard operating procedure that outlines specific steps to identify, mitigate and report on any cybersecurity-related incidents that may be discovered.


text: we did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.


text: risk management and strategy have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Stereotaxis, Inc.

ticker: STXS


text: design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") and the System and Organizational Controls ("SOC2"), as well as information security standards issued by the International Organization for Standardization, including ISO 27001 and ISO 27002. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: We also maintain third party security procedures to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment;


text: security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls;


text: awareness training for our employees, incident response personnel, and senior management; and cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. management team, including our IT management team, is responsible for assessing and managing our material risks from cybersecurity threats.


text: The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: management team has certifications from various organizations, such as ISC2 (Certified Information Security Systems Professional or "CISSP"), Global Information Assurance ("GIAC"), and the EC-Council.


text: management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: The Board oversees our enterprise risk management processes, which includes cybersecurity risk, directly and through its audit committee. The audit committee of the Board assesses with management the Company's major risk exposures and the steps management has taken to monitor and control such exposures. The audit committee reviews management's risk assessment and risk management programs and reports on such matters to the full Board.


text: board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our clients, business partners and employees. Our management, led by our Chief Executive Officer and Chief Financial Officer, are actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). Our cybersecurity processes and practices are fully integrated into the Company's ERM efforts.

companyName: MANHATTAN BRIDGE CAPITAL, INC

ticker: LOAN


text: In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. In addition, we regularly review cybersecurity trends and, partially as a result of our prior cybersecurity exposure, have moved some of our internal servers to off-site locations.


text: Management and Strategy one of the critical elements of our overall ERM approach, our cybersecurity efforts are focused on the following key areas: Governance:


text: Management oversees cybersecurity risk mitigation and reports to the board of directors any cybersecurity incidents. Further, our Audit Committee periodically discusses cybersecurity.


text: Approach: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: parties also play a role in our cybersecurity. We engage third-party service providers to conduct evaluations of our security controls, independent audits or consulting on best practices to address new challenges.


text: we have experienced cybersecurity threats in the past in the normal course of business and expect to continue to experience such threats from time to time, to date, none have had a material adverse effect on our business, financial condition, results of operations or cash flows. Even with the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.


text: board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our clients, business partners and employees. Our management, led by our Chief Executive Officer and Chief Financial Officer, are actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). Our cybersecurity processes and practices are fully integrated into the Company's ERM efforts. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. In addition, we regularly review cybersecurity trends and, partially as a result of our prior cybersecurity exposure, have moved some of our internal servers to off-site locations.

companyName: MBC FUNDING II CORP.


text: Management and Strategy one of the critical elements of our overall ERM approach, our cybersecurity efforts are focused on the following key areas: Governance: Management oversees cybersecurity risk mitigation and reports to the board of directors any cybersecurity incidents.


text: Risk Management and Strategy has both on-shore and ship-board systems that are highly dependent on information technology systems. Loss, disruption, or compromise of these systems could significantly impact operations and results. As such, OSG has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our program is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: OVERSEAS SHIPHOLDING GROUP INC


text: assessments designed to help identify material cybersecurity risks to critical systems integral to our business and our broader enterprise information technology environment. use of external service providers, where appropriate, to assess, test or assist with aspects of security controls. cybersecurity awareness and compliance training that occurs annually and is mandatory for all employees. cybersecurity plan that includes procedures for responding to a cybersecurity incident. have not experienced any material cybersecurity violation or occurrence over the last three years.


text: will continue to invest time, effort and financial resources to secure our systems, networks and communications. However, our security measures cannot provide absolute assurance that we will be successful in preventing or responding to all cybersecurity attacks. There can be no assurance that any breach or incident will not have a material impact on our operations and financial results. See Item 1A, "Risk Factors-Interruption, failure or breach of OSG's information technology and communications systems could impair its ability to operate" for a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: information technology ("IT") controls are subject to audit by internal and external auditors, as well as the ABS. The management team at least annually advises the Corporate Governance and Risk Assessment Committee of the Board on information security matters and provides user training and monitoring of system access as part of our compliance program. Our team of IT professionals, led by the Director of IT, collectively has over 50 years of experience in the cybersecurity space and have professional security certifications and advanced training in the field of cybersecurity and technology. The IT team has primary responsibility for OSG's overall cybersecurity risk management program and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, and alerts and reports produced by security tools.


text: IT networks and related systems are critical to the operation of our business and essential to our ability to successfully perform day-to-day operations. We have implemented security measures and controls to mitigate risks to our IT networks and related systems, including the risks of disruption, release of confidential information, and corruption of data. This includes a variety of technological tools and systems, including both company-owned IT and technology services provided by outside parties to support our critical functions, and in particular, the following: External port penetration testing; violation report reviewed routinely for any abnormalities; employee training and testing on cyber risks;

companyName: Omega Flex, Inc.

ticker: OFLX


text: assessment, procedural review and testing in connection with cyber insurance renewals; and terms of governance, the Company employs an IT director, with over 20 years of relevant experience, who supervises our other IT employees and is also responsible for our outside technology services. Our IT director reports directly to our President and reviews cybersecurity assessments with our President on at least a monthly basis. Our President is responsible for escalating any cybersecurity matters as appropriate, in consultation with our General Counsel. Our Board of Directors is ultimately responsible for oversight of cybersecurity risk management and receives regular reports from, and engages in regular dialogue with, Company management.


text: we believe we have implemented appropriate measures and controls for our business, there can of course be no assurance that cyber incidents will be prevented or of their severity if they occur. To date, to our knowledge, there have been no incidents materially affecting the Company, but a material incident could result in disruption of critical IT networks and systems, impeding our operations, release of confidential information, and/or corruption of data. Such an incident could damage our reputation and brand and our future sales and could expose us to potential liability. See Item 1A. Risk Factors - A cyber security incident or other technology disruption could harm us.


text: are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Aspire Biopharma Holdings, Inc.

ticker: ASBP


text: Management and Strategy We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: SurgePays, Inc.

ticker: SURG


text: Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.


text: Our cybersecurity risk management methodology risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment;


text: individuals, including employees and external third-party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; awareness training of our employees, incident response personnel, and senior management;


text: cybersecurity incident response plan that includes procedures for responding to cybersecurity third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board provides strategic oversight on cybersecurity matters, including material risks associated with cybersecurity threats. The Board has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management methodology. Our Board and the Audit Committee receives periodic updates from our Chief Financial Officer and more frequently as needed, regarding the overall state of our cybersecurity preparedness, information on the current threat landscape, and material risks from cybersecurity threats and cybersecurity incidents. The Audit Committee and our management team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from third-party service providers and reliance on communications with our risk management, legal, and/or compliance personnel.


text: The Audit Committee reports to the full Board regarding cybersecurity activities. The full Board also receives briefings from management on cyber risk issues and best practices. Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for developing and maintaining our overall cybersecurity risk methodology and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel;


text: threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: the ordinary course of our business, we collect, process, store, and transmit players' data, including confidential, sensitive, proprietary, and personal information. Maintaining the confidentiality, integrity and availability of our information technology systems and data, as well as appropriate limitations on access to such information, is important to our operations and business strategy. To this end, we have implemented various Information Security programs aligned to ISO and NIST cyber security frameworks with functions incorporating the "Identify", "Protect", "Detect", "Respond", and "Recover" concepts. They are designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.

companyName: GAN Ltd


text: security program is managed and monitored by a dedicated Information Security team, which is led by our Vice President of Global Information Security, the Company's designated Chief Information Security Officer ("CISO"), and includes mechanisms, controls, technologies, systems, policies and other processes designed to prevent, detect, respond, and recover from data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them. For example, we have adopted a risk-based approach to security which includes continuous risk assessments, vulnerability scans and periodic penetration and testing. We perform due diligence on our key technology vendors and other contractors and suppliers. We also conduct employee training on cyber and information security, among other topics. Our security program is subjected to independent external audits annually to evaluate the effectiveness of our security program and identify areas for continuous improvement.


text: Our CISO, who reports directly to the Chief Technology Officer, is a Certified Information Systems Security Professional with over 20 years of experience managing information technology and cybersecurity matters, including more than four years in gaming and two years at GAN Limited. Members of the information security team who support the security program hold relevant educational and professional credentials with experience in similar roles from other technology companies.


text: The CISO and Information Security team, together with our Privacy and Data Protection Team, led by a dedicated Data Protection Officer are responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified any prior cybersecurity incidents that have materially affected us, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors".


text: Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Board of Directors receive updates on cybersecurity and information technology matters and related risk exposures from our CISO and CTO as well as other members of the senior leadership team.


text: do not currently engage in any business activities that provide revenue or cash flow. Management intends to explore and identify business opportunities, including a potential acquisition of an operating entity through a reverse merger, asset purchase or similar transaction.

companyName: Atlantis Glory Inc.

ticker: AGLY


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents.


text: Risk Management and Strategy We, through our third party service provider that manages our information have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Indaptus Therapeutics, Inc.

ticker: INDP


text: design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: team members are responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; and cybersecurity incident response plan that includes procedures for responding to cybersecurity have not identified risks from known cybersecurity threats, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors – Our Risks Related to Our Business - Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity. "


text: Our Board considers cybersecurity risk as part of its risk oversight function and oversees our cybersecurity and other information technology risks and management's implementation of our cybersecurity risk management program.


text: Our Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board and the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including our Chief Operating Officer, is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Operating Officer has primary responsibility for our overall cybersecurity risk management program and supervises our retained provider of IT services and external cybersecurity consultants. Our Chief Operating Officer has experience supervising and managing company security and privacy departments.


text: management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Company recognizes the importance of identifying, assessing, and managing risks associated with cybersecurity threats. The Company's cybersecurity program utilizes components of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: PERMA FIX ENVIRONMENTAL SERVICES INC

ticker: PESI


text: Key components of our cybersecurity program include governance, risk management, access and authentication controls, change management, audit and assessment, awareness and training, contingency planning, recovery, media handling, incident response, personnel and physical security, and communication integrity.


text: program is embedded into Information Technology ("IT") and Information System ("IS") operations across the business with a focus on awareness, transparency, minimizing business impacts, and reducing enterprise risk, including strategic, compliance, legal and financial risk. The Company has policies and procedures in place to ensure compliance with its cybersecurity program and cybersecurity controls. Our program relies on a philosophy of continuous improvement by using periodic self-assessments, 3 rd party assessments, and customer/agency audits to determine cyber control presence, applicability, and effectiveness. Our program is customized with additional controls that address financial systems risk, nuclear quality assurance, Sarbanes Oxley, European Union cyber and data protection requirements, and supply chain risks.


text: risk management process addresses confidentiality, availability, and integrity and includes evaluating information systems specific threats, vulnerabilities, likelihood, and potential impact. Impact thresholds, which are reviewed and approved by the Board of Directors (the "Board") and senior management, are used to define incident escalation paths from IT operations to management, the Audit Committee and the Board. This process is used to identify, manage, and communicate material risks to the business. Additional cyber incident reporting requirements are in place to comply with customers and regulatory agency requirements.


text: threat and vulnerability management systems are in place and updated per industry standards and best practices. Our IT team further manages risk by evaluating external providers of threat, vulnerability, and risk mitigation information. This information is used to proactively implement new methods or controls for reducing risk associated with a particular emerging threat or vulnerability.


text: Company's cybersecurity program is managed by the Vice President ("VP") of IS, who has been employed by the Company for 20 years and has over 35 years of total experience in information systems. The VP of IS has an extensive career in software development and infrastructure management including working with Fortune 500 companies in his prior positions. The VP of information system is a participant in the overall Company strategic process and has aligned the program to best service the strategic objectives of the business.


text: Company's Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats. Our senior management is responsible for the day-to-day management of the material risks we face. Our VP Of Information System is scheduled to report to the CFO on a weekly basis and the Audit Committee on a quarterly basis on cybersecurity matters to include updates on cybersecurity threat management, strategy processes, system updates and cybersecurity risks activities, including but not limited to any recent cybersecurity incidents and related responses. Our Board is also engaged in discussion with senior management and the Audit Committee at least on a quarterly basis on cybersecurity matters to discuss any updates to our cybersecurity risk management and strategy program. Each member of our Board has a working knowledge and/or experience with cybersecurity, IT strategy and IT risk assessment.


text: the past 2 years, the Company does not believe that it has experienced any material cybersecurity incidents, nor any material costs related to immaterial cyber incidents. Although we have a comprehensive process for the prevention of material cybersecurity incidents as discussed, we cannot provide assurance that our results of operations and financial condition and business strategy will not be materially impacted from cybersecurity risks in the future. For more information on our cybersecurity related risk and potential effects on the Company of a material cybersecurity breach, see under "General Risk Factors" in "Item 1A. Risk Factors"


text: Program Overview maintain, routinely review and evaluate our information technology and cybersecurity policies, practices and procedures (our "Cybersecurity Program"). The Cybersecurity Program has various policies and procedures, including an Information and Cybersecurity Policy and Business Continuity/Disaster Recovery Plan. Our Cybersecurity Program is administered by our Information Security Committee, which consists of our Chief Financial Officer, Chief Compliance Officer and other Company management and counsel, as appropriate, all of which is subject to the oversight of our Board of Directors. We also utilize the services of information technology and cybersecurity advisers, consultants and experts in the evaluation and periodic testing of our information technology and cybersecurity systems to recommend improvements to our Cybersecurity Program and in connection with any cybersecurity incident. We believe that the individuals involved in our Cybersecurity Program possess the necessary skills, experience and backgrounds that, when combined with the resources of our external information technology and cybersecurity advisers, consultants and experts, are sufficient to manage our Cybersecurity Program.

companyName: SURO CAPITAL CORP.

ticker: SSSS


text: Role in Cybersecurity Risk Management part of our overall risk management process, our management engages at least annually in an enterprise risk management review and evaluation, during which management reviews the principal risks relating to our business and operations. Included in this process is a review and evaluation of our risks relating to our Cybersecurity Program. Additionally, as part of our Rule 38a-1 compliance program, we review at least annually the compliance policies and procedures of our key service providers, including documentation discussing each service providers' information security and privacy controls. Any failure in our or our key service providers' cybersecurity systems could have a material impact on our operating results. See "Item 1A. Risk Factors - General Risk Factors - The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively."


text: Board of Directors as a whole has responsibility for the Company's risk oversight, with reviews of certain areas being conducted by the relevant Board committees that report on their deliberations to the full Board of Directors. The oversight responsibility of the Board of Directors and its committees is enabled by management reporting processes that are designed to provide visibility to the Board of Directors about the identification, assessment and management of critical risks and management's risk mitigation strategies. Accordingly, our Board of Directors provides strategic oversight on cybersecurity matters, including material risks associated with cybersecurity threats. Our Board of Directors receives periodic updates from our Chief Compliance Officer (or more frequently, as needed) regarding the overall state of our Cybersecurity Program, information on the current threat landscape, and material risks from cybersecurity threats and cybersecurity incidents.


text: understand the importance of preventing, identifying, assessing and managing material risks associated with cybersecurity threats. Cybersecurity processes to identify, assess and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process and are designed to help protect our information assets and operations from internal and external cyber threats and protect employee and customer information from unauthorized access or attack, as well as secure our network and systems. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") and are included in the Company's overall risk management system and processes. We have implemented into our operations these cybersecurity processes, technologies and controls to identify, assess and manage material risks. Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic internal and external penetration testing by an independent cybersecurity firm to inform our risk identification and assessment of critical, high, medium and minor material cybersecurity threats.

companyName: Co-Diagnostics, Inc.

ticker: CODX


text: manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: Monitor evolving cybersecurity standards and emerging data protection laws and implement changes to our processes to comply;


text: assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: Company leverages third-party vendors to house critical clinical trial data. These vendors are required to be GxP compliant which entails strong cybersecurity controls that are validated by a third-party auditor. Furthermore, the Company has begun performing security risk assessments prior to on-boarding new significant vendors.


text: Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices. multifactor authentication on internal and external systems;


text: regular phishing email simulations for all employees; and cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: incident response plan coordinates the activities that we and our third-party cybersecurity providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: part of the above processes, we engage with subject matter expert consultants to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use, including those in our supply chain or who have access to patient and employee data or our systems. Third-party risks are included within our risk management process discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, cybersecurity threats may affect our business. See " Cyber security risks and the failure to maintain the integrity of company, employee or guest data could expose us to data loss, litigation and liability, and our reputation could be significantly harmed. " in "Item 1A. Risk Factors" of this Annual


text: Audit Committee of the Board of Directors is responsible for oversight of our cybersecurity risk assessment, risk management, incident response procedures and cybersecurity risks and provides updates to the Board of Directors regarding such oversight. Periodically during each year, the Audit Committee receives an overview from our Vice President, Head of Technology of our cybersecurity threat risk management and strategy processes, including potential impact on us, the efforts of management to manage the risks that are identified and our incident response preparations.


text: cybersecurity risk assessment, management and strategy processes are led by our Chief Technology Officer. Our Chief Technology Officer has over 15 years of experience in various roles involving managing information security, managing privacy and data protection, developing cybersecurity strategy, and implementing cybersecurity programs. The Chief Technology Officer was recently promoted and is training to be a Certified Information Security Manager (CISM), is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through management of the cybersecurity risk management and strategy processes described above, including our incident response plan.


text: In conjunction with EBM, Inc., we employ best in class Endpoint Detection and Response with 24/7 SOC at the Endpoints. We also utilize MFA and Geolocation enforcement where available. We continuously monitor and maintain our network infrastructure including consistent vulnerability monitoring and remediation. We also engage in quarterly phishing campaigns as well as cybersecurity awareness training to our end users to keep them vigilant in being able to detect threats.

companyName: Azitra, Inc.

ticker: AZTR


text: we develop and maintain systems and controls designed to prevent cybersecurity threats from occurring, and we have a process to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of these events occurring cannot be eliminated entirely. As we outsource more of our information systems to vendors, engage in more electronic transactions with service providers and patients, and rely more on cloud-based information systems, the related security risks will increase and we will need to expend additional resources to protect our technology and information systems.


text: In addition, there can be no assurance that our internal information technology systems or those of our third-party contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Governance.


text: Our senior management team conducts the regular assessment and management of material risks from cybersecurity threats, including review with our IT team and third-party service providers. All employees and consultants are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly interviews with our senior officers and independent registered accounting firm.


text: Management and Strategy have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risks. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process.

companyName: NEPHROS INC

ticker: NEPH


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment;


text: an outsourced security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training for our employees, incident response personnel, and senior management. This includes mandatory computer-based training, internal communications, and regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.


text: In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), our outsourced security team has a written incident response plan outlining how to address cybersecurity events that occur. We have assigned a team comprised of finance and technology personnel to review the plan annually to serve as a framework for the execution of responsibilities across businesses and operational roles. The incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties.


text: In addition to the cybersecurity incident response plan, our outsourced team conducts tabletop exercises to enhance our incident response preparedness. They also have processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. Such processes include conducting due diligence and risk assessment of our current and potential vendors that examine such vendor's cybersecurity protocols and adherence to applicable regulations.


text: We also maintain business continuity and disaster recovery plans to prepare for and respond to the potential for any disruption in the technology we rely on. Additionally, we maintain insurance coverage that, subject to its terms and conditions, is intended to help us cover certain costs associated with cybersecurity incidents and information system failures.


text: (or the third parties we rely on) may not be able to fully, continuously, or effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine whether and how to implement certain security controls and it is possible that we may not implement the necessary controls if we are unable to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate cybersecurity risks.


text: Cybersecurity events, when detected by security tools or third parties, may not always be identified immediately or addressed in the manner intended by our cybersecurity incident response plan.


text: Based on the information available as of the date of this Annual Report, we have no reason to believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "Risks Related that cybersecurity risks can impact various areas of responsibility of the Committees of the Board, as well as the overall size of the Board, the Board believes it is useful and effective for the entire Board to maintain direct oversight over cybersecurity matters. We have implemented processes that will include regular updates to the Board from our Chief Executive Officer and Chief Financial Officer for its review and feedback regarding cybersecurity governance processes, the status of projects to strengthen internal cybersecurity, results from third-party assessments, and also discusses any significant cyber incidents, including recent incidents at other companies and the emerging threat landscape.


text: cybersecurity risk management strategy processes, discussed in greater detailed above, are led by our Chief Financial Officer, in conjunction with our outsourced security team, under the supervision of our Chief Executive Officer. Our Chief Financial Officer has over 5 years of prior work experience in various roles involving supervising the implementation of various information technology systems. These individuals are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including their roles in our overall enterprise risk management. As discussed above, our Chief Executive Officer and Chief Financial Officer regularly report to the Board about cybersecurity threat risks, among other cybersecurity related matters.


text: We face various cybersecurity threats that could adversely affect our business, financial condition, and results of operations. We have implemented processes and procedures to assess, identify, and manage these risks, as well as to respond to and mitigate the impact of any potential or actual cybersecurity incidents to our information systems and the information residing therein. Our processes for assessing and identifying cybersecurity risks include regular network security assessments, vulnerability scans, penetration tests, and audits of our information systems, as well as monitoring and analysis of network activity and threat intelligence. We engage third-party service providers to assist us with some of these activities. We also have processes to oversee and identify cybersecurity risks associated with our use of third-party service providers, such as conducting due diligence, reviewing contracts, and verifying compliance with security standards and best practices. Our cybersecurity risk management processes have been integrated into our enterprise risk framework, which identifies, aggregates, and evaluates risks across the enterprise. We identify our enterprise risks through each member of our management team, along with counsel from our internal auditors and attorneys and we present an assessment of our enterprise risks to our board of directors on an annual basis. Our information technology management plays an integral part in the identification and communication of cybersecurity risks to our management team.

companyName: Superior Drilling Products, Inc.


text: Despite our efforts, there is the ever-present risk that our systems and/or data will suffer a successful cyber incident such as unauthorized access, use, disclosure, modification, or destruction by hackers, cybercriminals, state-sponsored actors, insiders, or other malicious actors. We have experienced attempts to compromise our systems and/or data. These attempts included phishing attacks, malware infections, and unauthorized access attempts. We do not believe that these attempts, if successful, would have resulted in a material adverse effect on our business, financial condition, or results of operations. We continue to be diligent in preventing, detecting, and responding to a cyber incident. However, we cannot guarantee that we will not suffer cybersecurity incidents in the future, which could result in:


text: Loss of or damage to our data, intellectual property, or other proprietary or confidential information Interruption or degradation of our operations, services, or systems availability Compromise or corruption of our data or systems integrity Reputational harm or loss of customer trust or confidence Legal liability, regulatory fines, penalties, or sanctions Remediation or mitigation costs, such as increased security expenditures, investigation expenses, or litigation fees insurance coverage or Other negative consequences. of these outcomes could have a material adverse effect on our business, financial condition, or results of operations.


text: Management and Strategy have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Biofrontera Inc.

ticker: BFRI


text: elements of our cybersecurity risk management program include: assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology environment; our external service providers, where appropriate, to assess, test, monitor or otherwise assist with aspects of our security controls;


text: training and awareness programs for employees to drive adoption and awareness of cybersecurity processes cybersecurity incident response plan that includes procedures for responding to cybersecurity the last two fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business, results of operations or financial condition, refer to Item 1A. Risk Factors - "Our business and operations would suffer in the event of system failures or, cyber-attacks or a deficiency in our cyber-security," which is incorporated by reference into this Item 1C. (Role of Management/Role of the Board)


text: Our cybersecurity program and function is overseen by the Director of Information Technology ("Director of IT"), who has over 15 years of experience leading information technology divisions in various industries. The Director of IT collaborates with all business units to identify and assess cybersecurity risks and compliance with company policy. The Director of IT stays aware of emerging threats and trends in cybersecurity through attendance at cyber security conferences, subscription to the CISA.gov mailing list, various tech focused news outlets, and other sources.