text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: QMIS TBS Capital Group Corp.

secItem: Item 1C


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of our Board of Directors. Our executive team including our Chief Executive Officer, and Chief Financial Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, and Chief Financial Officer. In addition, the Company's incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents including significant breaches to the Company's networks or systems. The audit committee receives regular reports from the information technology team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: The threats to network and data security are increasingly diverse and sophisticated. Despite our efforts and processes to prevent breaches, our devices, as well as our servers, computer systems, and those of third parties that we use in our operations are vulnerable to cybersecurity risks, including cyber-attacks such as viruses and worms, phishing attacks, denial-of-service attacks, physical or electronic break-ins, employee theft or misuse, and similar disruptions from unauthorized tampering with our servers and computer systems or those of third parties that we use in our operations, which could lead to interruptions, delays, loss of critical data, unauthorized access to user data, and loss of consumer confidence. In addition, we may be the target of email scams that attempt to acquire personal information or company assets. Despite our efforts to create security barriers to such threats, we may not be able to entirely mitigate these risks. Any cyber-attack that attempts to obtain our or our users' data and assets, disrupt our service, or otherwise access our systems, or those of third parties we use, if successful, could adversely affect our business, operating results, and financial condition, be expensive to remedy, and damage our reputation. In addition, any such breaches may result in negative publicity, adversely affect our brand, decrease demand for our products and services, and adversely affect our operating results and financial condition.

companyName: Omnitek Engineering Corp

ticker: OMTK


text: We are increasingly dependent on information technology and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks.


text: Significant disruptions to our information technology systems or breaches of information security could adversely affect our business. We are increasingly dependent on sophisticated information technology systems and infrastructure to operate our business. Occasionally we also outsource elements of our operations to third parties, some of which are outside the U.S., including elements of our information technology infrastructure, and as a result we are managing many independent vendor relationships with third parties who may or could have access to our confidential information. The size and complexity of our information technology systems, and those of our third-party vendors with whom we contract, make such systems potentially vulnerable to service interruptions. In addition, we and our vendors could be susceptible to third party attacks on our information technology systems. Such attacks are increasingly sophisticated and are made by groups and individuals with a wide range of motives and expertise, including state and quasi-state actors, criminal groups, "hackers" and others. Any security breach or other disruption to our or our vendors' information technology infrastructure could also interfere with or disrupt our business operations, including our manufacturing, distribution, R&D, sales and/or marketing activities.


text: In the ordinary course of business, we and our vendors collect, store and transmit large amounts of confidential information (including trade secrets or other intellectual property, proprietary business information and personal information), and it is critical that we do so in a secure manner to maintain the confidentiality and integrity of such confidential information. The size and complexity of our and our vendors' systems and the large amounts of confidential information that is present on them also makes them potentially vulnerable to security breaches from inadvertent or intentional actions by our employees, partners or vendors, or from attacks by malicious third parties. Maintaining the security, confidentiality and integrity of this confidential information (including trade secrets or other intellectual property, proprietary information, business information and personal information) is important to our competitive business position. However, such information can be difficult to protect. While we have taken steps to protect such information, and to ensure that the third-party vendors' on which we rely have taken adequate steps to protect such information, there can be no assurance that our or our vendors' efforts will prevent service interruptions or security breaches in our systems or the unauthorized or inadvertent wrongful use or disclosure of confidential information that could adversely affect our business operations or result in the loss, misappropriation, and/or unauthorized access, use or disclosure of, or the prevention of access to, confidential information. A breach of our or our vendors' security measures or the accidental loss, inadvertent disclosure, unapproved dissemination, misappropriation or misuse of trade secrets, proprietary information, or other confidential information, whether as a result of theft, hacking, fraud, trickery or other forms of deception, or for any other cause, could enable others to produce competing products, use our proprietary technology or information, and/or adversely affect our business position. Further, any such interruption, security breach, or loss, misappropriation, and/or unauthorized access, use or disclosure of confidential information, including personal information regarding our patients and employees, could result in financial, legal, business, and reputational harm to us and could have a material adverse effect on our business, financial condition, results of operations, cash flows, and/or ordinary share price.


text: If we sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences.


text: Our information technology may be subject to cyber-attacks, security breaches or computer hacking. Hackers and data thieves are increasingly sophisticated and operate large-scale and complex automated attacks. Experienced computer programmers and hackers may be able to penetrate our security controls and misappropriate or compromise sensitive personal, proprietary or confidential information, create system disruptions or cause shutdowns. They also may be able to develop and deploy malicious software programs that attack our systems or otherwise exploit any security vulnerabilities. Our systems and the data stored on those systems may also be vulnerable to security incidents or security attacks, acts of vandalism or theft, coordinated attacks by activist entities, misplaced or lost data, human errors, or other similar events that could negatively affect our systems and the data stored on those systems, and the data of our business partners. Further, third parties, such as hosted solution providers, which provide services to the Company, could also be a source of security risk in the event of a failure of their own security systems and infrastructure.


text: The costs to eliminate or address the foregoing security threats and vulnerabilities before or after a cyber incident could be significant. Our remediation efforts may not be successful and could result in interruptions, delays or cessation of service, and the loss of existing or potential suppliers or customers. In addition, breaches of our security measures and the unauthorized dissemination of sensitive personal, proprietary or confidential information about the Company, our business partners or other third parties could expose us to significant potential liability and reputational harm. As threats related to cyber-attacks develop and grow, we may also find it necessary to make further investments to protect our data and infrastructure, which may impact the Company's results of operations. In case of a cyber-attack, the Company may suffer losses that could have a material adverse effect on its business. As a global enterprise, we could also be negatively impacted by existing and proposed laws and regulations, and government policies and practices related to cybersecurity, data privacy, data localization and data protection. In addition, our customers may encourage, or require, compliance with certain security standards, such as the voluntary cybersecurity framework released by the National Institute of Standards and Technology (NIST), which consists of controls designed to identify and manage Cybersecurity risks, and we could be negatively impacted to the extent we are unable to comply with such standards. Our business is subject to cybersecurity risks.


text: Our operations are increasingly dependent on information technologies and services. Threats to information technology systems associated with cybersecurity risks and cyber incidents or attacks continue to grow, and include, among other things, storms and natural disasters, terrorist attacks, utility outages, theft, viruses, phishing, malware, design defects, human error, or complications encountered as existing systems are maintained, repaired, replaced, or upgraded. Risks associated with these threats include, among other things: • Theft or misappropriation of funds; • loss, corruption, or misappropriation of intellectual property, or other proprietary or confidential information (including customer, supplier, or employee data); • disruption or impairment of our and our customers' business operations and safety procedures; • damage to our reputation with our customers and the market; • exposure to litigation; • loss or damage to our worksite data delivery systems; and • increased costs to prevent, respond to or mitigate cybersecurity events.


text: Although we utilize various procedures and controls to mitigate our exposure to such risk, cybersecurity attacks and other cyber events are evolving and unpredictable. Moreover, we have no control over the information technology systems of our customers, suppliers, and others with which our systems may connect and communicate. As a result, the occurrence of a cyber incident could go unnoticed for a period of time.


text: We do not presently maintain insurance coverage to protect against cybersecurity risks. If we procure such coverage in the future, we cannot ensure that it will be sufficient to cover any particular losses we may experience as a result of such cyber-attacks. Any cyber incident could have a material adverse effect on our business, financial condition and results of operations. A cybersecurity incident could negatively impact our business and our relationships with customers and expose us to litigation risk.


text: We use computers in substantially all aspects of our business operations. We also use mobile devices, social networking and other online activities to connect with our employees and our customers. Such uses give rise to cybersecurity risks, including security breach, espionage, system disruption, theft and inadvertent release of information. Our business involves the storage and transmission of numerous classes of sensitive and/or confidential information and intellectual property, including customers' personal information, private information about employees, and financial and strategic information about the Company and its business partners. We also rely on a Payment Card Industry compliant third party to protect our customers' credit card information. While we have implemented measures to prevent security breaches and cyber incidents, our preventative measures and incident response efforts may not be entirely effective. The theft, destruction, loss, misappropriation, or release of sensitive and/or confidential information or intellectual property, or interference with our information technology systems or the technology systems of third parties on which we rely, could result in business disruption, negative publicity, brand damage, violation of privacy laws, loss of customers, potential litigation and liability and competitive disadvantage.


text: Risk Assessment and Management We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: AXIM BIOTECHNOLOGIES, INC.

ticker: AXIM


text: The company has an ERM program to identify, evaluate, and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with the company's broader business goals and objectives. We believe that integrating cybersecurity risks into our ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard the company's operations, financial condition, and reputation in an ever-evolving threat landscape.


text: The company maintain a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. Keep in mind we are a small company with limited exposures. As such we rely on traditional bookkeeping and reconciliations to discover any cybersecurity issues.


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, had not materially affected the company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our company. Our systems, infrastructure or data, or those used by our CROs, CMOs, clinical sites or other contractors or consultants, may or may be perceived to fail or suffer a cyberattack, security breach or other incident, including a breakdown or compromise of the confidentiality, integrity and availability of our systems, networks or data, which could adversely affect the operation of our business and reputation.


text: Incident Response The company does not have a dedicated incident management team responsible for managing and coordinating its cybersecurity incident response efforts. We have limited exposure to cybersecurity risks. We are a small company.


text: Board Oversight Role Our Board of Directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee (the Committee) of the Board of Directors oversees our cybersecurity and data privacy. The Committee meets periodically to review and discuss with management risks relating to significant cybersecurity matters and concerns involving the company, including information security, data privacy, backup of information systems and related regulatory matters and compliance. The Committee regularly reports to the Board of Directors with respect to the Committee's activities and recommendations, including those relating to cybersecurity matters and concerns. The company provides reports to the Committee on information security matters, including the adequacy and effectiveness of the company's information security policies and practices and the internal controls regarding information security, and notifies the chairperson of the Committee as soon as practicable of significant information security matters and concerns as they arise on a periodic basis.


text: Management's Role The company does not have a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters.


text: Use of Third Parties Oversight of Third-Party Service Providers The company uses third-party service providers to support its operations and many of its technology initiatives, and evaluates its third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following such evaluation, the company determines and prioritizes service provider risk based on the potential threat impact and likelihood, and such risk determination drives the level of due diligence and ongoing compliance monitoring required for each service provider.


text: The safeguarding of our digital and physical assets against cybersecurity threats is a cornerstone of our operational integrity and reliability. Recognizing the sophisticated and ever-evolving nature of cyber threats, we have instituted a robust cybersecurity framework that not only aims to protect our systems and data but also ensures the resilience of our operations against potential cyber-attacks.

companyName: AIBOTICS, INC.

ticker: AIBT


text: Cybersecurity Protocols and Practices AIBotics employs a multi-layered cybersecurity strategy that encompasses various protocols and best practices, designed to defend against a wide array of cyber threats:


text: Multifactor Authentication (MFA): To ensure the security of user accounts, we implement MFA across our digital platforms. This approach adds an additional layer of security by requiring two or more verification factors, significantly reducing the risk of unauthorized access.


text: Limited Physical Access to Local Servers and Company's NAS: We enforce strict physical security measures to safeguard our local servers and Network Attached Storage (NAS) devices. Access to these critical assets is restricted to authorized personnel only, thereby mitigating the risk of physical tampering or data theft.


text: Employee Training for Cybersecurity: Recognizing that human error can often be a cybersecurity vulnerability, we provide comprehensive cybersecurity training to our employees. This training covers essential practices such as recognizing phishing attempts, securing sensitive information, and adhering to our internal cybersecurity policies.


text: Credential Management and Rotation: To prevent unauthorized access stemming from compromised credentials, we implement rigorous credential management and rotation policies. These measures include regularly updating passwords and access keys, ensuring that former employees' access rights are promptly revoked, and employing advanced credential management systems.


text: Anti-Phishing Training: Our employees undergo targeted anti-phishing training to identify and respond appropriately to phishing attempts. This training is crucial in cultivating a vigilant and informed workforce capable of recognizing and thwarting phishing attacks.


text: Periodical Viruses Analysis: We conduct regular scans and analyses for viruses and malware across our network. This proactive approach enables us to detect and neutralize potential threats before they can inflict harm.


text: Software with Latest Security Updates: Our IT infrastructure is maintained with up-to-date software, including the latest security patches. This policy helps protect against vulnerabilities that could be exploited by cybercriminals.


text: Avoid Sharing Confidential Files Outside the Organization: We enforce strict data handling policies to prevent the sharing of confidential files outside the organization. This includes the use of encrypted communication channels and secure data storage solutions.


text: Scanning Third-Party Emails and Attachments: To mitigate the risk of email-based threats, all incoming emails and attachments from third parties are scanned for malicious content. This ensures that potentially harmful materials are identified and quarantined before they can reach the end user.


text: IT Staff Authorization for Software Installations and Updates: To maintain the integrity of our IT environment, only authorized IT staff are permitted to install or update software on the company's computers. This control prevents the introduction of unauthorized or potentially malicious software.


text: Additional Measures and Good Practices In addition to the aforementioned protocols, we are committed to continuous improvement and adaptation of our cybersecurity measures to counter new threats. This includes engaging in threat intelligence sharing with industry partners, conducting regular cybersecurity risk assessments, and implementing a comprehensive incident response plan to quickly address and mitigate the impact of any cybersecurity incidents.


text: Governance and Oversight Our cybersecurity strategy is governed by a dedicated cybersecurity team, under the leadership of the Chief Information Security Officer (CISO). This team is responsible for the continuous monitoring and improvement of our cybersecurity posture. Furthermore, our Board of Directors regularly reviews our cybersecurity strategies and policies, ensuring they align with our overall business objectives and the evolving cybersecurity landscape.


text: Our company prioritizes cybersecurity to safeguard our systems, networks, and data. Despite our efforts, we recognize the evolving nature of cyber threats and remain vigilant in addressing potential risks.

companyName: Glidelogic Corp.

ticker: GDLG


text: 1). Network and Data Security: We employ firewalls and access controls to protect our infrastructure and sensitive information from unauthorized access. 2). Regular Security Assessments: We conduct security reviews to identify and resolve potential system weaknesses. 3). Employee Awareness: Our employees are constantly reminded to keep full awareness of cybersecurity risks and best practices. 1). Cyber Attacks: Our systems could be compromised by cyber-attacks, potentially leading to data loss or operational disruption. 2). Data Breaches: There is a risk of unauthorized access to confidential customer and employee data. 1). Incident Response: We maintain an incident response plan to quickly address and minimize cybersecurity incidents.


text: 2). Safeguard of Information: Our business communication and document sharing are mainly conducted via online platforms such as Amazon Web Service (AWS) and various Google Services, which each has its only cybersecurity measurements. All the important business information and documents have offline backup storage as well for safekeeping.


text: Cybersecurity Risk Management and Strategy The cybersecurity risk management program, processes and strategy described in this section are limited to the personal and business information belonging to or maintained by the Company (collectively, "Confidential Information"), our own third-party critical systems and services supporting or used by the Company (collectively, "Critical Systems"), and service providers.

companyName: New Asia Holdings, Inc.

ticker: NAHD


text: We expect to develop and implement a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our Confidential Information and Critical Systems. Our cybersecurity risk management program will be integrated into our overall enterprise risk management program and is expected to include a cybersecurity incident response plan.


text: Our cybersecurity risk management program is expected to include: risk assessments designed to help identify material cybersecurity risks to our Confidential Information, Critical Systems and the broader enterprise IT environment;


text: a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; cybersecurity awareness and spear-phishing resistance training of our employees, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a vendor management policy for service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, could have a material adverse effect on us including an adverse effect on our business, financial condition and results of operations.


text: Cybersecurity Governance Our executive management team, along with our managed information technology service provider, is responsible for assessing and managing risks from cybersecurity threats to the Company, including our Confidential Information and Critical Systems.


text: Our Board considers cybersecurity risk as part of its risk oversight function and oversight of cybersecurity and other information technology risks. Our Board oversees management's implementation of our planned cybersecurity risk management program. Our executive management team is responsible for updating the Board, as necessary, regarding significant cybersecurity incidents. Our Board shall also receive periodic reports from management on our cybersecurity risks and cybersecurity risk management program.


text: The Company recognizes the importance of developing, implementing and maintaining cybersecurity measures to better safeguard our information systems and protect the confidentiality, integrity and availability of our data. Our management team will work to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have not been subject to cybersecurity challenges that have materially impaired our operations or financial standing. In the future, the Company will require the Board and employees to complete cybersecurity training related to the physical security of assets, data privacy and other information security policies and procedures.

companyName: Mexus Gold US


text: The Company implemented commercially available defenses against cybersecurity threats when it began relying on the internet 30 years ago. The Company does not have formal processes for identifying cybersecurity risks associated with third-party service providers. A successful attack on the Company could result in a delay in required filings with the SEC and in financial losses from attacks on bank accounts. The board of directors relies on the Company's president to identify material risks and to implement reasonable defenses. The president informs the board about such risks. The president receives direct and immediate notification of cybersecurity incidents and personally monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. The president does not have formal training in cybersecurity.

companyName: ALTEX INDUSTRIES INC

ticker: ALTX


text: Risk Management and Strategy The Company considers cybersecurity to be an important part of its overall business strategy and risk management. UTMD continuously monitors its information systems to assess, identify and manage risks from both inside and outside forces. Functional modules are fully-integrated, which provides for transaction checks and balances. Software systems have been validated for effectiveness of intended uses. Policies and procedures have been implemented which all employees acknowledge in writing, and agree to follow as a condition of employment. Access is documented and controlled by business function. Regular employee user training is conducted to promote awareness of outside threats and the importance of following procedures.

companyName: UTAH MEDICAL PRODUCTS INC

ticker: UTMD


text: UTMD utilizes state-of-art cybersecurity devices and software to timely identify and prevent intrusion from external actors. The corporate information systems operations manager continuously monitors activity, and reports weekly to the CEO. Additional sources for assessing security effectiveness are annual outside audits of the information technology environment, risk and performance assessments provided by vendors of the routers and firewalls used by the Company and the news media.


text: There have been no events in at least the last thirty-two years that have been considered material enough to warrant changes to systems, processes or controls.


text: The Governance Committee of the Board of Directors maintains overall responsibility to oversee and assess the effectiveness of the Company's cybersecurity strategy. The Board meets quarterly and any potential threats are reviewed and discussed at that time, unless the information systems team and/or the CEO decide earlier notification is warranted.


text: The identification, detection, prevention and remediation of known or potential IT security vulnerabilities, including those arising from third-party hackers, hardware or software, is extremely costly and time consuming. Lifted does not have the manpower, expertise or financial resources to effectively identify, detect, prevent or remediate cybersecurity risks. No assurance or guarantee whatsoever can be given that Lifted will not be seriously damaged by the exploitation of its cybersecurity vulnerabilities.

companyName: LFTD PARTNERS INC.

ticker: LIFD


text: During the year ended December 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. See "Item 1A. Risk Factors" for more information regarding the Company's cybersecurity-related risks.


text: The identification, detection, prevention and remediation of known or potential IT security vulnerabilities, including those arising from third-party hackers, hardware or software, is extremely costly and time consuming. Company does not have the manpower, expertise or financial resources to effectively identify, detect, prevent or remediate cybersecurity risks. No assurance or guarantee whatsoever can be given that Company will not be damaged by the exploitation of its cybersecurity vulnerabilities.

companyName: WEED, INC.

ticker: BUDZ


text: During the year ended, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.


text: The safeguarding of our digital and physical assets against cybersecurity threats is a cornerstone of our operational integrity and reliability. Recognizing the sophisticated and ever-evolving nature of cyber threats, we have instituted a robust cybersecurity framework that not only aims to protect our systems and data but also ensures the resilience of our operations against potential cyber-attacks.


text: Cybersecurity Protocols and Practices AIBotics employs a multi-layered cybersecurity strategy that encompasses various protocols and best practices, designed to defend against a wide array of cyber threats:


text: Multifactor Authentication (MFA): To ensure the security of user accounts, we implement MFA across our digital platforms. This approach adds an additional layer of security by requiring two or more verification factors, significantly reducing the risk of unauthorized access.


text: Limited Physical Access to Local Servers and Company's NAS: We enforce strict physical security measures to safeguard our local servers and Network Attached Storage (NAS) devices. Access to these critical assets is restricted to authorized personnel only, thereby mitigating the risk of physical tampering or data theft.


text: Employee Training for Cybersecurity: Recognizing that human error can often be a cybersecurity vulnerability, we provide comprehensive cybersecurity training to our employees. This training covers essential practices such as recognizing phishing attempts, securing sensitive information, and adhering to our internal cybersecurity policies.


text: Credential Management and Rotation: To prevent unauthorized access stemming from compromised credentials, we implement rigorous credential management and rotation policies. These measures include regularly updating passwords and access keys, ensuring that former employees' access rights are promptly revoked, and employing advanced credential management systems.


text: Anti-Phishing Training: Our employees undergo targeted anti-phishing training to identify and respond appropriately to phishing attempts. This training is crucial in cultivating a vigilant and informed workforce capable of recognizing and thwarting phishing attacks.


text: Periodical Viruses Analysis: We conduct regular scans and analyses for viruses and malware across our network. This proactive approach enables us to detect and neutralize potential threats before they can inflict harm.


text: Software with Latest Security Updates: Our IT infrastructure is maintained with up-to-date software, including the latest security patches. This policy helps protect against vulnerabilities that could be exploited by cybercriminals.


text: Avoid Sharing Confidential Files Outside the Organization: We enforce strict data handling policies to prevent the sharing of confidential files outside the organization. This includes the use of encrypted communication channels and secure data storage solutions.


text: Scanning Third-Party Emails and Attachments: To mitigate the risk of email-based threats, all incoming emails and attachments from third parties are scanned for malicious content. This ensures that potentially harmful materials are identified and quarantined before they can reach the end user.


text: IT Staff Authorization for Software Installations and Updates: To maintain the integrity of our IT environment, only authorized IT staff are permitted to install or update software on the company's computers. This control prevents the introduction of unauthorized or potentially malicious software.


text: Additional Measures and Good Practices In addition to the aforementioned protocols, we are committed to continuous improvement and adaptation of our cybersecurity measures to counter new threats. This includes engaging in threat intelligence sharing with industry partners, conducting regular cybersecurity risk assessments, and implementing a comprehensive incident response plan to quickly address and mitigate the impact of any cybersecurity incidents.


text: Governance and Oversight Our cybersecurity strategy is governed by a dedicated cybersecurity team, under the leadership of the Chief Information Security Officer (CISO). This team is responsible for the continuous monitoring and improvement of our cybersecurity posture. Furthermore, our Board of Directors regularly reviews our cybersecurity strategies and policies, ensuring they align with our overall business objectives and the evolving cybersecurity landscape.


text: Risk management and strategy We have limited exposure to cybersecurity threats. We have established policies and processes, identifying and managing material risk from cyber security threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Free Flow USA, Inc.

ticker: FFLO


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably Address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. The primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our Chief Executive Officer will employ the expertise of an IT consultant in the event that risk management assessment warrants.


text: As part of our overall risk management system, our CEO will monitor and test our safeguards in collaboration with outside IT consultants.


text: We will engage consultants or other third parties in connection with our risk assessment processes. These service providers will assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to IA, "Risk Factors", in the annual report on Form 10–K.


text: We maintain informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors and chief executive officer are responsible for monitoring and assessing strategic risk exposure, the day-to-day management of the material risks we face. Our board of directors and executive officer administer our cybersecurity risk oversight regarding third-party providers.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We assess risks from cybersecurity threats against our information systems that may result in adverse effects on our information systems or any information residing therein. We conduct periodic and ad-hoc assessments to identify cybersecurity threats.

companyName: CFN Enterprises Inc.

ticker: CNFN


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. IT leadership reports to our CEO and CFO to manage the risk assessment and mitigation process. We monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. We promote a company-wide culture of cybersecurity risk management. This ensures that the senior management are kept abreast of the cybersecurity posture and potential risks faced by the Company. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing during the financial year ended December 31, 2024.


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole. Our executive management will update the board of directors on cybersecurity risks on a periodic basis, with a minimum frequency of once per year.


text: The threats to network and data security are increasingly diverse and sophisticated. Despite our efforts and processes to prevent breaches, our devices, as well as our servers, computer systems, and those of third parties that we use in our operations are vulnerable to cybersecurity risks, including cyber-attacks such as viruses and worms, phishing attacks, denial-of-service attacks, physical or electronic break-ins, employee theft or misuse, and similar disruptions from unauthorized tampering with our servers and computer systems or those of third parties that we use in our operations, which could lead to interruptions, delays, loss of critical data, unauthorized access to user data, and loss of consumer confidence. In addition, we may be the target of email scams that attempt to acquire personal information or company assets. Despite our efforts to create security barriers to such threats, we may not be able to entirely mitigate these risks. Any cyber-attack that attempts to obtain our or our users' data and assets, disrupt our service, or otherwise access our systems, or those of third parties we use, if successful, could adversely affect our business, operating results, and financial condition, be expensive to remedy, and damage our reputation. In addition, any such breaches may result in negative publicity, adversely affect our brand, decrease demand for our products and services, and adversely affect our operating results and financial condition.


text: We are increasingly dependent on information technology and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks.


text: Significant disruptions to our information technology systems or breaches of information security could adversely affect our business. We are increasingly dependent on sophisticated information technology systems and infrastructure to operate our business. Occasionally we also outsource elements of our operations to third parties, some of which are outside the U.S., including elements of our information technology infrastructure, and as a result we are managing many independent vendor relationships with third parties who may or could have access to our confidential information. The size and complexity of our information technology systems, and those of our third-party vendors with whom we contract, make such systems potentially vulnerable to service interruptions. In addition, we and our vendors could be susceptible to third party attacks on our information technology systems. Such attacks are increasingly sophisticated and are made by groups and individuals with a wide range of motives and expertise, including state and quasi-state actors, criminal groups, "hackers" and others. Any security breach or other disruption to our or our vendors' information technology infrastructure could also interfere with or disrupt our business operations, including our manufacturing, distribution, R&D, sales and/or marketing activities.


text: In the ordinary course of business, we and our vendors collect, store and transmit large amounts of confidential information (including trade secrets or other intellectual property, proprietary business information and personal information), and it is critical that we do so in a secure manner to maintain the confidentiality and integrity of such confidential information. The size and complexity of our and our vendors' systems and the large amounts of confidential information that is present on them also makes them potentially vulnerable to security breaches from inadvertent or intentional actions by our employees, partners or vendors, or from attacks by malicious third parties. Maintaining the security, confidentiality and integrity of this confidential information (including trade secrets or other intellectual property, proprietary information, business information and personal information) is important to our competitive business position. However, such information can be difficult to protect. While we have taken steps to protect such information, and to ensure that the third-party vendors' on which we rely have taken adequate steps to protect such information, there can be no assurance that our or our vendors' efforts will prevent service interruptions or security breaches in our systems or the unauthorized or inadvertent wrongful use or disclosure of confidential information that could adversely affect our business operations or result in the loss, misappropriation, and/or unauthorized access, use or disclosure of, or the prevention of access to, confidential information. A breach of our or our vendors' security measures or the accidental loss, inadvertent disclosure, unapproved dissemination, misappropriation or misuse of trade secrets, proprietary information, or other confidential information, whether as a result of theft, hacking, fraud, trickery or other forms of deception, or for any other cause, could enable others to produce competing products, use our proprietary technology or information, and/or adversely affect our business position. Further, any such interruption, security breach, or loss, misappropriation, and/or unauthorized access, use or disclosure of confidential information, including personal information regarding our patients and employees, could result in financial, legal, business, and reputational harm to us and could have a material adverse effect on our business, financial condition, results of operations, cash flows, and/or ordinary share price.


text: If we sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences.


text: Our information technology may be subject to cyber-attacks, security breaches or computer hacking. Hackers and data thieves are increasingly sophisticated and operate large-scale and complex automated attacks. Experienced computer programmers and hackers may be able to penetrate our security controls and misappropriate or compromise sensitive personal, proprietary or confidential information, create system disruptions or cause shutdowns. They also may be able to develop and deploy malicious software programs that attack our systems or otherwise exploit any security vulnerabilities. Our systems and the data stored on those systems may also be vulnerable to security incidents or security attacks, acts of vandalism or theft, coordinated attacks by activist entities, misplaced or lost data, human errors, or other similar events that could negatively affect our systems and the data stored on those systems, and the data of our business partners. Further, third parties, such as hosted solution providers, which provide services to the Company, could also be a source of security risk in the event of a failure of their own security systems and infrastructure.


text: The costs to eliminate or address the foregoing security threats and vulnerabilities before or after a cyber incident could be significant. Our remediation efforts may not be successful and could result in interruptions, delays or cessation of service, and the loss of existing or potential suppliers or customers. In addition, breaches of our security measures and the unauthorized dissemination of sensitive personal, proprietary or confidential information about the Company, our business partners or other third parties could expose us to significant potential liability and reputational harm. As threats related to cyber-attacks develop and grow, we may also find it necessary to make further investments to protect our data and infrastructure, which may impact the Company's results of operations. In case of a cyber-attack, the Company may suffer losses that could have a material adverse effect on its business. As a global enterprise, we could also be negatively impacted by existing and proposed laws and regulations, and government policies and practices related to cybersecurity, data privacy, data localization and data protection. In addition, our customers may encourage, or require, compliance with certain security standards, such as the voluntary cybersecurity framework released by the National Institute of Standards and Technology (NIST), which consists of controls designed to identify and manage Cybersecurity risks, and we could be negatively impacted to the extent we are unable to comply with such standards. Our business is subject to cybersecurity risks.


text: Our operations are increasingly dependent on information technologies and services. Threats to information technology systems associated with cybersecurity risks and cyber incidents or attacks continue to grow, and include, among other things, storms and natural disasters, terrorist attacks, utility outages, theft, viruses, phishing, malware, design defects, human error, or complications encountered as existing systems are maintained, repaired, replaced, or upgraded. Risks associated with these threats include, among other things: • Theft or misappropriation of funds; • loss, corruption, or misappropriation of intellectual property, or other proprietary or confidential information (including customer, supplier, or employee data); • disruption or impairment of our and our customers' business operations and safety procedures; • damage to our reputation with our customers and the market; • exposure to litigation; • loss or damage to our worksite data delivery systems; and • increased costs to prevent, respond to or mitigate cybersecurity events.


text: Although we utilize various procedures and controls to mitigate our exposure to such risk, cybersecurity attacks and other cyber events are evolving and unpredictable. Moreover, we have no control over the information technology systems of our customers, suppliers, and others with which our systems may connect and communicate. As a result, the occurrence of a cyber incident could go unnoticed for a period of time.


text: We do not presently maintain insurance coverage to protect against cybersecurity risks. If we procure such coverage in the future, we cannot ensure that it will be sufficient to cover any particular losses we may experience as a result of such cyber-attacks. Any cyber incident could have a material adverse effect on our business, financial condition and results of operations. A cybersecurity incident could negatively impact our business and our relationships with customers and expose us to litigation risk.


text: We use computers in substantially all aspects of our business operations. We also use mobile devices, social networking and other online activities to connect with our employees and our customers. Such uses give rise to cybersecurity risks, including security breach, espionage, system disruption, theft and inadvertent release of information. Our business involves the storage and transmission of numerous classes of sensitive and/or confidential information and intellectual property, including customers' personal information, private information about employees, and financial and strategic information about the Company and its business partners. We also rely on a Payment Card Industry compliant third party to protect our customers' credit card information. While we have implemented measures to prevent security breaches and cyber incidents, our preventative measures and incident response efforts may not be entirely effective. The theft, destruction, loss, misappropriation, or release of sensitive and/or confidential information or intellectual property, or interference with our information technology systems or the technology systems of third parties on which we rely, could result in business disruption, negative publicity, brand damage, violation of privacy laws, loss of customers, potential litigation and liability and competitive disadvantage.


text: A consistent and holistic approach to cybersecurity is important to achieving our strategic business objectives and protecting our intellectual property. Because we sell many of our products through e-commerce platforms, we would be indirectly affected by a variety of cybersecurity threats such as ransomware and denial-of-service attacks that affect most industry sectors. Our customers, suppliers and other business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. We are continually evaluating best practices and methods to protect us from a wide range of potential threats.

companyName: HEALTHY EXTRACTS INC.

ticker: HYEX


text: The Board oversees our processes for identifying and mitigating risks, including cybersecurity risks. Our management periodically briefs the Board on our cybersecurity and information security policies and plans. In the event of an incident, we have developed an incident response plan, which sets forth the steps to be followed from incident detection and assessment to mitigation, recovery and notification and reporting, including notifying functional areas, as well as senior leadership and the Board, as appropriate.


text: We continue to evaluate our cybersecurity requirements to address the evolving cybersecurity risks that we face in an increasingly technically capable environment. Our management manages our cybersecurity policies, with the goal of preventing cybersecurity incidents, if possible, while also maintaining IT system performance and data integrity to minimize the business impact should an incident occur.


text: Although we take cybersecurity risks seriously, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.


text: Our company prioritizes cybersecurity to safeguard our systems, networks, and data. Despite our efforts, we recognize the evolving nature of cyber threats and remain vigilant in addressing potential risks.


text: 1). Network and Data Security: We employ firewalls and access controls to protect our infrastructure and sensitive information from unauthorized access. 2). Regular Security Assessments: We conduct security reviews to identify and resolve potential system weaknesses. 3). Employee Awareness: Our employees are constantly reminded to keep full awareness of cybersecurity risks and best practices. 1). Cyber Attacks: Our systems could be compromised by cyber-attacks, potentially leading to data loss or operational disruption. 2). Data Breaches: There is a risk of unauthorized access to confidential customer and employee data. 1). Incident Response: We maintain an incident response plan to quickly address and minimize cybersecurity incidents.


text: 2). Safeguard of Information: Our business communication and document sharing are mainly conducted via online platforms such as Amazon Web Service (AWS) and various Google Services, which each has its only cybersecurity measurements. All the important business information and documents have offline backup storage as well for safekeeping.


text: Spectral maintains a comprehensive cybersecurity risk management program designed to identify, protect against, detect, respond to, and mitigate reasonably foreseeable cybersecurity threats to the Company's operations. This program incorporates internal controls and safeguards aligned with industry standards – including access controls, data encryption, network monitoring, and employee cybersecurity training – to protect the confidentiality, integrity, and availability of the Company's information assets. We utilize a range of security tools and procedures to continuously monitor our systems and prevent unauthorized access or data loss. In addition, the Company has implemented a formal incident response plan that outlines procedures for promptly addressing and containing cybersecurity incidents. This incident response plan is tested and updated periodically (e.g., through tabletop simulations and third-party penetration testing) to ensure preparedness and effective remediation of any identified security events.

companyName: SPECTRAL CAPITAL Corp

ticker: FCCN


text: Oversight and Governance: Cybersecurity risk management is overseen at the highest levels of the Company's leadership. The Board of Directors, through its Audit Committee, is responsible for monitoring the Company's cybersecurity risks and related risk management practices. The Audit Committee receives regular reports from management on cybersecurity matters, including updates on risk assessments, security improvements, and any relevant threat developments or incidents. Senior management has designated personnel (including information technology and security officers) to manage day-to-day cybersecurity operations and to implement cybersecurity policies, controls, and procedures. These personnel regularly brief the Audit Committee and the Board on the status of the Company's cybersecurity posture and risk mitigation activities. The Company also provides periodic cybersecurity training to all employees to reinforce security awareness and protocol compliance as part of its internal control framework.


text: Risk Management Processes: Spectral conducts regular assessments of cybersecurity vulnerabilities and emerging threats across its systems and products. Our risk management approach draws on widely accepted frameworks (such as the NIST Cybersecurity Framework) to prioritize risks and guide the implementation of appropriate security measures. We engage independent security experts to perform evaluations of our cybersecurity program – including periodic third-party security audits and penetration testing – in order to test the effectiveness of our safeguards and to identify areas for improvement. Additionally, the Company maintains a third-party risk management program that assesses and monitors the cybersecurity practices of critical vendors and partners, helping ensure that our service providers uphold robust data security standards. Findings from these ongoing risk assessments and tests are used to continually enhance our internal controls and cybersecurity defenses.


text: As of the date of this Annual Report, the Company has not experienced any known cybersecurity incidents that had a material effect on our business, operations, or financial condition. During the reporting period, no cybersecurity breach or attack has been identified that resulted in significant data loss, financial costs, or operational disruptions for Spectral. Nevertheless, cybersecurity threats continue to evolve rapidly, and no security program can guarantee absolute protection against all attacks. A significant cybersecurity incident in the future could potentially cause substantial harm to the Company, including business interruptions, remediation costs, reputational damage, loss of sensitive information, or legal and regulatory consequences. Spectral remains proactive in updating and strengthening its cybersecurity measures in light of new threats and technological changes. For further information on the risks associated with cybersecurity and data protection, refer to the "Risk Factors" section of this Annual Report (Item 1A) which discusses these risks in more detail.


text: Our board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our clients, business partners and employees. Our management, led by our Chief Executive Officer, is actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). Our cybersecurity processes and practices are fully integrated into the Company's ERM efforts. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: APPlife Digital Solutions Inc

ticker: ALDS


text: Risk Management and Strategy As one of the critical elements of our overall ERM approach, our cybersecurity efforts are focused on the following key areas: Governance: Management oversees cybersecurity risk mitigation and reports to the board of directors any cybersecurity incidents.


text: Collaborative Approach: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-virus and anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: We have not engaged third-party service providers to conduct evaluations of our security controls, independent audits or consulting on best practices to address new challenges.


text: While we have not experienced any cybersecurity threats in the past in the normal course of business, in the future, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.


text: The Company implemented commercially available defenses against cybersecurity threats when it began relying on the internet 30 years ago. The Company does not have formal processes for identifying cybersecurity risks associated with third-party service providers. A successful attack on the Company could result in a delay in required filings with the SEC and in financial losses from attacks on bank accounts. The board of directors relies on the Company's president to identify material risks and to implement reasonable defenses. The president informs the board about such risks. The president receives direct and immediate notification of cybersecurity incidents and personally monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. The president does not have formal training in cybersecurity.


text: To date, due to our limited financial resources, we have not adopted any special processes for assessing, identifying, and managing material risks from cybersecurity threats to the Company or through our use of any third-party service provider, and we have not engaged any assessors, consultants, auditors, or other third parties in connection with such risks. We are not aware of any previous cybersecurity incidents involving the Company and we do not believe cybersecurity risks have materially affected us or our strategy, results of operations or financial condition. Our president, who is also our sole director and sole employee, is responsible for the oversight of risks from cybersecurity threats and is informed about such risks because of his direct participation in the Company's operations, transactions, and relationships. Our president has no prior work experience in cybersecurity and no relevant degrees, certifications, knowledge, skills, or other background in cybersecurity. Although we face cybersecurity risks, we believe such risks are reduced by the nature of our operations in which our product sales are made and payments are received through eBay and our website and email systems are maintained by third parties. We do not independently maintain any servers or other extensive information systems and correspondence and other business information is stored on our president's computer system, which is not on a network and is protected by a third-party virus protection program. We may be unable to successfully identify threats, prevent attacks, satisfactorily resolve cybersecurity incidents, or implement adequate mitigating controls. Any breach of our or our providers information systems or other cybersecurity-related incidents that results in, or may result in, the loss, theft or unauthorized disclosure of data, or any delay in determining the full extent of a potential breach, could have a material adverse impact on our business, results of operations, and financial condition, including harm to our reputation and brand, reduced demand for our products, time-consuming and expensive litigation, fines, penalties, and other damages.

companyName: Outdoor Specialty Products, Inc.

ticker: ODRS


text: Our operations and other aspects of our business rely heavily on various information technology systems which are largely managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber-attacks. These threats could disrupt our operations, lead to the loss of confidential information, and hinder our ability to accurately report our financial results in a timely manner. We have adopted a Cybersecurity Policy to create effective administrative, technical, electronic, and physical protections to safeguard the personal information of Company personnel, confidential information concerning our portfolio investments and the integrity of the Company's information systems.

companyName: EQUUS TOTAL RETURN, INC.

ticker: EQS


text: We have created an Information Security Team, consisting of our Chief Financial Officer and our Chief Compliance Officer, to implement and administer our Cybersecurity Policy. Among the duties and responsibility of our Information Security Team are the following: Ensuring that all Equus personnel are aware of the Cybersecurity Policy and agree to adhere to its requirements; Establishing that information concerning the Fund is stored on encrypted cloud-based servers accessible only by authorized Equus personnel;


text: Providing that all of the Company's information systems are backed up daily, with offline copies available in the event that a major security issue arises; Testing and evaluating cybersecurity safeguards via the use of third-party information technology service providers;


text: Reviewing the security measures in the Company's Cybersecurity Policy annually or when there is a change in applicable laws or regulations or in business activities of Equus; and Conducting training as necessary for all Equus personnel; and Reporting cybersecurity matters to our Board of Directors who provide oversight of our Information Security Team.


text: We utilize third-party services and tools for identifying, protecting against, and detecting cyber incidents, and also partner with external vendors to augment our internal security capabilities. Additionally, we engage third-parties to conduct independent assessments of our cybersecurity infrastructure to evaluate the efficiency and effectiveness of our detection capabilities, along with our response mechanisms, and overall risk management.


text: Our approach to managing cybersecurity risks is part of a continuous improvement process, both in the context of cybersecurity and broader operational risk management. This ongoing process, which includes personnel training, is aimed at routinely reviewing and, as necessary, improving, our oversight processes and tools to ensure they remain effective and resilient in their management of cybersecurity risk.


text: Material Impact of Cybersecurity Threats While we have yet to experience a material cybersecurity event, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial results adversely. We maintain robust policies and procedures focused on cybersecurity incident management, ensuring timely communication and escalation to all relevant stakeholders. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.


text: Board of Directors Oversight Our Board of Directors oversees risks related to cybersecurity, including the security of our corporate, financial, and portfolio investment information and the steps management is taking to monitor and control these risks. Our Chief Compliance Officer conducts regular meetings with our independent directors to discuss various compliance matters, including any cybersecurity issues, and also delivers a comprehensive Annual Compliance Report to the Board, which report also addresses cybersecurity matters.


text: We have implemented a cross-departmental approach to managing cybersecurity risk, which includes seeking input from our employees, management, third-party vendors, the Audit Committee of the Board of Directors (the "Audit Committee"), and the Board of Directors. We devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and response. To more effectively address cybersecurity threats, we have a dedicated Chief Information Security Officer ("CISO") who is responsible for leading enterprise-wide information security strategy, policy, process, and technology. Our current CISO has 20+ years of information security and risk management experience and holds a Certified Information Systems Security Professional (CISSP) certification. Our CISO regularly briefs our Audit Committee on our cybersecurity and information security program and cybersecurity incidents deemed to pose a risk of a critical business impact or reputational harm. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. Our information security team, comprised of employees with an expertise in cybersecurity and information technology, regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, and response.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: Our information security program includes, among other things, cybersecurity incident response, vulnerability management, antivirus and malware protection, technology compliance and risk management, encryption, identity and access management, application security, and security monitoring. The program also has an information security awareness program, which includes annual training regarding our acceptable use and information classification and handling policies, regular phishing campaigns complemented by additional employee training as appropriate, and communications and companion trainings to keep our users informed on current events.


text: The information security program's ultimate goal is preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. In the event of an identified cybersecurity incident, we have developed a detailed cybersecurity incident response process, which outlines the steps to be followed from incident detection, analysis, containment, eradication, recovery, and notification, including notifying functional areas (e.g. information technology, legal, finance, operations, privacy), as well as senior leadership and the Audit Committee, as appropriate. For critical cybersecurity incidents, processes have been established for our legal team to determine the materiality of each incident.


text: Our information security team engages third-party services to conduct evaluations of our security controls, including penetration testing and independent audits. Annually, an external auditor conducts a System and Organization Controls ("SOC") type 2 audit covering the security principle for systems supporting our products.


text: Our assessment of risks associated with the use of third-party vendors is part of our overall cybersecurity risk management framework. If a third-party vendor is unable to provide a SOC 1 or SOC 2 report, our information security team takes additional steps to assess their cybersecurity preparedness and our initiation or continued engagement with them. Additionally, third-party vendors are required to include security and privacy addendums to our contracts where applicable and are reassessed periodically as necessary depending on the risk level that has been assigned to the third-party vendor. Our legal team also requires that our third-party vendors report cybersecurity incidents to us so the impact of the incident on us can be assessed.


text: Our Audit Committee is responsible for reviewing cybersecurity risks and our cybersecurity program. It oversees and reviews our cybersecurity and other information technology risks, controls, policies, and procedures. Our information security team annually performs a cybersecurity enterprise risk assessment and presents the results to management and the Audit Committee. The Audit Committee periodically reports on its review of cybersecurity risks and our cybersecurity program to our Board of Directors. In 2023, our CISO or his team met with the Audit Committee four times to discuss cybersecurity risks and threats.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Notwithstanding the approach we take to cybersecurity, we may not successfully prevent or mitigate cybersecurity incidents that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be covered or, if covered, fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: We have implemented a cross-functional information security program to assess, identify and manage material risks from cybersecurity risk, which includes seeking input from our employees, management, third-party vendors, the Audit Committee of the Board of Directors ("Audit Committee") and the Board of Directors.


text: Our information security program's ultimate goal is preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. In the event of an identified cybersecurity incident, we have developed a detailed cybersecurity incident response process, which outlines the steps to be followed from incident detection, analysis, containment, eradication, recovery and notification, including notifying functional areas (e.g. information technology, legal, finance, operations, privacy), as well as senior leadership and the Audit Committee, as appropriate. In certain instances, incidents are escalated to certain members of our legal team who are responsible for, among other things, the accurate and timely disclosure of material cybersecurity incidents required under federal securities laws, including making the materiality determination and approving related securities disclosures.


text: Risk Management and Strategy Our information security program devotes significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and response. Our information security program leverages the National Institute of Standards and Technology (NIST) and International Organization for Standardization (ISO) 27001 frameworks choosing to organize our cybersecurity risks into five categories: identify, protect, detect, respond and recover. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST and ISO frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our information security program is integrated into our overall enterprise risk management program. Our information security program includes, among other things: • cybersecurity incident response; • vulnerability management; • antivirus and malware protection; • technology compliance and risk management; • encryption; • identity and access management; • application security; and • security monitoring.


text: Our information security program also includes an information security awareness program, which includes annual training regarding our acceptable use and information classification and handling policies, regular phishing campaigns complemented by additional employee training as appropriate, and communications and companion trainings to keep users informed on current events.


text: Our assessment of risks associated with the use of third-party vendors is part of our overall cybersecurity risk management framework. If a third-party vendor is unable to provide a SOC 1 or SOC 2 report, our information security team takes additional steps to assess its cybersecurity preparedness and our initiation or continued engagement with it. Additionally, third-party vendors are required to include security and privacy addenda to our contracts where determined applicable and are reassessed periodically as necessary depending on the risk level that has been assigned to the third-party vendor. Our legal team also requires that our third-party vendors report cybersecurity incidents to us so the impact of the incident on us can be assessed.


text: As of the date of this Annual Report on Form 10-K, we have not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Notwithstanding the approach we take to cybersecurity, we may not successfully prevent or mitigate cybersecurity incidents that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be covered or, if covered, fully insured.


text: For a discussion of our cybersecurity-related risks, see Part I, Item 1A of this Annual Report on Form 10-K under the heading "Risk Factors."


text: Role of Management To more effectively assess and manage cybersecurity threats, we have a dedicated Chief Information Security Officer ("CISO") who is responsible for leading enterprise-wide information security strategy, policy, process, and technology. Our current CISO has 20+ years of information security and risk management experience and holds a Certified Information Systems Security Professional (CISSP) certification. Our CISO regularly briefs our Audit Committee on our cybersecurity and information security program and cybersecurity incidents deemed to pose a risk of a critical business impact or reputational harm.


text: Our information security team, comprised of employees with an expertise in cybersecurity and information technology, regularly assesses the threat landscape and takes a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and response. Our information security team annually performs a cybersecurity enterprise risk assessment and presents the results to management and the Audit Committee. In addition, our internal audit team conducts periodic audits of the Company's systems and cybersecurity processes, with findings reported to the Audit Committee and senior management.


text: Role of the Board of Directors and the Audit Committee Our Audit Committee has responsibility for overseeing and reviewing our cybersecurity, data privacy, and other information technology risks, controls and procedures, including our plans to mitigate cybersecurity risks and to respond to data breaches. Our Audit Committee also reviews with management any specific cybersecurity issues that could affect the adequacy of our internal controls and disclosure procedures and any public disclosures about our cybersecurity controls and procedures, the Board of Directors' cybersecurity expertise, and its oversight of cybersecurity risk. The Audit Committee periodically reports on its review of cybersecurity risks and our cybersecurity program to our Board of Directors. In 2024, our CISO or his team met with the Audit Committee four times to discuss cybersecurity risks and threats.


text: Cybersecurity Management & Strategy We manage information security risk through, and as part of, MetLife's Information Security Program (the "Program"), which institutes and maintains controls for the systems, applications, and databases of the Company and of its third-party providers. The primary goal of the Program is to protect the confidentiality, integrity and availability of all data MetLife owns or possesses, as well as its technology assets, through physical, technical, and administrative safeguards. This includes controls and procedures for monitoring, detecting, reporting, containing, managing, and remediating cyber threats. The Program aims to prevent data exfiltration, manipulation, and destruction, as well as system and transactional disruption. The Program's threat-centric and risk-based approach for securing the MetLife environment takes into consideration applicable guidelines from the cybersecurity framework developed by the U.S. Government's National Institute of Standards and Technology, and is managed by MetLife's CISO, in collaboration across lines of business and corporate functions. Our Board of Directors oversees the Program.

companyName: METLIFE INC

ticker: MET


text: The key features of the Program include: • A cybersecurity incident response team under the CISO's direction, which is responsible for monitoring and responding to threats, vulnerabilities, and incidents. • An incident response plan that is managed by the CISO and our Privacy Office and tested through cross-functional annual exercises in various geographical regions of the Company, many of which include participation from senior executives and the Board of Directors. • Information security policies and procedures that are reviewed at least annually and updated to reflect applicable changes in law, technology, practice and emerging threats. • Regular network and application testing and surveillance. • Periodic review of threats, vulnerabilities and other cybersecurity risks, internal and external. • Risk mitigation strategies, including annual internal and third-party risk assessments, as well as cybersecurity and privacy liability insurance intended to defray costs associated with an information security breach. • Vendor management procedures designed to identify and address potential risks associated with the use of third-party service providers. • Employee training programs on information security, data security, and cybersecurity practices and protection of data against cyber threats, at least annually. • A cross-functional approach to addressing cybersecurity risk, with participation from Global Technology & Operations, Risk, Compliance, Legal, Privacy and Internal Audit functions.


text: We exercise risk-based due diligence in selecting our third-party service providers, including, as appropriate, review of vendor applications, general IT controls and the IT facilities used to service MetLife's business. Third parties are governed by the MetLife Third-Party Risk Management program, which includes risk assessment prior to onboarding. Based on the assessment of risk, certain third-party service providers must periodically update relevant assessment documentation and be reevaluated by MetLife relative to their internal controls. Vendors deemed critical and high risk are continuously monitored by various industry solutions and services designed to identify cybersecurity risks.


text: We also work with third parties, such as independent assessors (for example, for industry maturity assessments, penetration testing, application security reviews, and independent audits), external legal counsel and other consultants as part of the design and implementation of the Program. The Program is periodically evaluated by external experts, and the results of those reviews are reported to the Board of Directors.


text: During the period covered by this report, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect MetLife, including its business strategy, results of operations or financial condition. For further discussion of MetLife's risks related to cybersecurity, see "Risk Factors — Operational Risks — We May Fail to Protect the Confidentiality and Integrity of Our Data, Including As a Result of a Failure in Our Cybersecurity or Other Information Security Systems or Our Disaster Recovery Plans or Those of Our Vendors."


text: Cybersecurity Governance The CISO is a senior-level executive responsible for establishing and executing the Company's information security strategy. Management provides regular reports to the CISO detailing on-going cybersecurity risk management. The CISO and the head of Global Technology & Operations present updates to the Audit Committee quarterly and, as necessary, to our full Board of Directors. These regular reports include updates on our performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. The Audit Committee also reviews with management, as necessary, but at least annually, the adequacy and effectiveness of the Company's policies and internal controls regarding information security and cybersecurity. Additionally, the CISO periodically and on an event-driven basis informs and updates the Board of Directors about information security incidents and the related risks posed to the Company.


text: The Program is subject to MetLife's risk management framework and operates under the "Three Lines of Defense" model MetLife uses. The CISO regularly reports about information security risk to the Enterprise Risk Committee ("ERC"), including the Chief Risk Officer ("CRO"), and other members of the senior management team. See "Management's Discussion and Analysis of Financial Condition and Results of Operations — Risk Management."


text: The CISO, who oversees an organization that supports the day-to-day operation of the Program, is qualified in the areas of data protection and cybersecurity, having more than twenty years of professional IT experience in financial services. Prior to his current role, the CISO previously served as MetLife's Global Chief Technology Officer with accountability for the Company's global infrastructure, engineering, service operations, quality assurance, application maintenance, and production management functions; he also served variously as the chief technology officer, CISO, chief information officer and global head of telecommunications engineering at other financial institutions prior to joining MetLife in 2012.


text: Cybersecurity Management & Strategy We manage information security risk through, and as part of, MetLife's Information Security Program (the "Program"), instituted to maintain controls for the systems, applications, and databases of the Company and of its third-party providers. The primary goal of the Program is to protect the confidentiality, integrity and availability of all data MetLife owns or possesses, as well as its technology assets, through physical, technical, and administrative safeguards. This includes controls and procedures across business units and at the enterprise level for monitoring, detecting, reporting, containing, managing, and remediating cyber threats. The Program aims to prevent data exfiltration, manipulation, and destruction, as well as system and transactional disruption. The Program's threat-centric and risk-based approach for securing the MetLife environment takes into consideration applicable guidelines from the cybersecurity framework developed by the U.S. Government's National Institute of Standards and Technology along with the sensitivity of the systems and the potential severity of the associated risks to MetLife and its relevant lines of business, and is managed by MetLife's CISO, collaborating with lines of business and corporate functions. Our Board of Directors oversees the Program.


text: The key features of the Program include: • A cybersecurity incident response team under the CISO's direction, which is responsible for monitoring and responding to threats, vulnerabilities, and incidents. • An incident response plan that is managed by the CISO and the Chief Privacy Officer and tested through cross-functional annual exercises in various geographical regions of the Company, many of which include participation from senior executives and the Board of Directors. • Information security policies and procedures that are reviewed at least annually and updated to reflect applicable changes in law, technology, practice and emerging threats. • Regular network and application testing and surveillance. • Periodic review of threats, vulnerabilities and other cybersecurity risks, internal and external. • Risk mitigation strategies, including annual internal and third-party risk assessments, as well as cybersecurity and privacy liability insurance intended to defray costs associated with an information security breach. • Vendor management procedures designed to identify and address potential risks associated with the use of third-party service providers. • Employee training programs on information security, data security, and cybersecurity practices and protection of data against cyber threats, at least annually. • A cross-functional approach to addressing cybersecurity risk, with participation from Global Technology & Operations, Risk, Compliance, Legal, Privacy and Internal Audit functions.


text: During the period covered by this report, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect MetLife, including its business strategy, results of operations or financial condition. For further discussion of MetLife's risks related to cybersecurity, see "Risk Factors — Operational Risks — We May Fail to Protect the Confidentiality, Integrity or Availability of Our Systems or Data, Including As a Result of a Failure in Our Cybersecurity or Other Information Security Systems or Our Disaster Recovery Plans or Those of Our Vendors."


text: Cybersecurity Governance The CISO is a senior-level executive responsible for establishing and executing the Company's information security strategy. Management provides regular reports to the CISO detailing on-going cybersecurity risk management. The CISO and the head of Global Technology & Operations present updates to the Audit Committee quarterly and, as necessary, to the full Board of Directors. These regular reports include updates on our performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. The Audit Committee also reviews with management, as necessary, but at least annually, the adequacy and effectiveness of the Company's policies and internal controls regarding information security and cybersecurity. Additionally, the CISO periodically and on an event-driven basis informs and updates the Board of Directors about information security incidents and the related risks posed to the Company.


text: The CISO, who oversees an organization that supports the day-to-day operation of the Program, is qualified in the areas of data protection and cybersecurity and has more than 30 years of experience leading information and physical security operations, with the emphasis on threat and vulnerability management, malware protection and cyber forensics. Prior to joining MetLife in 2024, the CISO was a chief security officer and a cybersecurity leader at other financial institutions, where he oversaw global cybersecurity programs for physical security, executive protection, risk management, critical incident response and management, disaster preparedness, third-party risk, insider threat, and security background investigations. He holds multiple patents for systems and methods related to information security risk assessment, including three information security patents from his prior employment with another large U.S. financial institution.


text: Risk Management and Strategy Our Information Security team manages Edwards' Information Security Program, which is focused on assessing, identifying, and managing cyber risk and information security threats. We evaluate cybersecurity risk on an ongoing basis, and it is a risk monitored through our overall enterprise risk management program, including by the executive leadership and the board of directors, described below under "Governance."

companyName: Edwards Lifesciences Corp

ticker: EW


text: To proactively manage cybersecurity risk in our organization, our management team has instituted an Edwards Information Technology Security Policy that is available to all employees through the employee handbook and on our intranet. We also conduct regular cybersecurity awareness and training campaigns for existing employees. Internal and external stakeholders can access the Edwards Integrity Helpline 24/7 online or by phone, to report any security incidents for escalation. We also disclose information about our product security and provide relevant contact information for our stakeholders to report any product vulnerabilities.


text: To proactively identify, mitigate, and prepare for potential cybersecurity incidents, we maintain both a business continuity plan and cyber incident response plan with formalized workflows and playbooks. We periodically conduct simulation exercises involving employees at various levels of the organization. We also periodically engage external partners to conduct annual audits of our systems, and test our IT infrastructure. Through these channels and others, we work to proactively identify potential vulnerabilities in our information security system. We recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Information Security team identifies and addresses known cybersecurity threats and incidents at third-party service providers on a continuous basis. In addition, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process.


text: We have not had previous cybersecurity incidents that have materially affected us. Our risks associated with cybersecurity threats are set forth under "Risk Factors" in Part I, Item 1A in this report.