text: We recognize that third-party service providers may introduce cybersecurity risks to our organization. In an effort to mitigate these risks, we have implemented a process before engaging with third-party service providers which are designed to assess their cybersecurity practices. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers, requiring them to adhere to certain cybersecurity standards and protocols.


text: Our Chief Information Security Officer, with oversight from the Chief Technology Officer and Chief Operations Officer, is primarily responsible for assessing and managing cybersecurity risks. Our Chief Information Security Officer has extensive cybersecurity knowledge and skills gained from over 25 years' experience in the field. Our Chief Information Security Officer is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: FOOT LOCKER, INC.

secItem: Item 1C


text: Several experienced information security professionals report to our Chief Information Security Officer and he is supported by a team of trained cybersecurity team members. In addition to our extensive in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: Notwithstanding the breadth of the Company's information security program, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse impact. For a discussion of whether and how any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, see Item 1A. "Risk Factors," which is incorporated by reference into this Item 1C.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: TSS, Inc.

ticker: TSSI


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: As part of our cybersecurity risk management system, our IT management team tracks and logs privacy and security incidents across our OEM partners, Microsoft and Oracle and other IT system providers, our vendors, and other third-party service providers to remediate and resolve any such incidents. Any significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We would consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosures and other compliance decisions. Our management is tasked with apprising TSS's independent public accounting firm of matters and any relevant developments.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee. The Company's IT department regularly uses specialist firms to independently test our cybersecurity controls. The IT management team is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with security personnel, threat intelligence and other information obtained from government, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions. See " Risk Factors - Security breaches and attacks on our computer systems could lead to significant costs and disruptions that could harm our business, financial results and reputation ".


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Gyrodyne, LLC

ticker: GYRO


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT service provider to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes that isolate the Company's financial and operating records from any other systems including email and other internet applications.


text: Risk Management and Strategy Our cybersecurity strategy prioritizes detection, analysis, and response to mitigate unknown and unexpected threats and security risks. Our cybersecurity risk management processes include technical security controls, monitoring systems, employee training, and management oversight to assess, identify, and manage risks from cybersecurity threats. We have implemented a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security and mobile device usage. We have mandatory training in the areas of cybersecurity, privacy, and confidential information handling. To date, we have not experienced any cybersecurity threats or incidents which have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, but we cannot provide assurance that they will not have a material impact in the future. See "Risk Factors" in Item 1A of this Annual Report for additional information about our cybersecurity risks.

companyName: Enservco Corp

ticker: ENSV


text: Also as part of our cybersecurity program, we partner with a third-party information technology firm to support and evaluate our cybersecurity and informational security program. This third-party service includes product and software security for data protection and cyber defense, to monitor, detect, prevent, and protect our Company against potential cybersecurity threats.


text: Our Board of Directors has overall responsibility for risk oversight in performing this function. Our Board of Directors assesses cybersecurity and information technology risks and the controls implemented to monitor and mitigate these risks. Our cybersecurity program is overseen by our Health, Safety, and Environmental Director, who has been a Heat Waves employee for over five years and has been in charge of our data protection and product and software security and compliance initiatives for the past several years. Our HSE Director meets regularly with the Board of Directors to share information about potential cybersecurity events and monitor, prevent, and detect potential cybersecurity incidents. The Board of Directors is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. The Board of Directors also discusses relevant incidents in the industry and the evolving threat landscape.


text: Risk Management and Strategy Aemetis' cybersecurity and information security framework includes physical, administrative and technical safeguards, as well as plans and procedures we believe are reasonable to help Aemetis prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact our operations, facilities and employees. These plans are based upon our assessment of risk considering our industry, specific operations, cyber perimeter, social exposure, information confidentiality and tertiary stakeholders.

companyName: AEMETIS, INC

ticker: AMTX


text: Our efforts focus on protecting and enhancing the security of our information systems, software, networks, and other assets. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or degrade service or our operations; sabotage systems; or otherwise cause harm to Aemetis, our customers, suppliers, or other key stakeholders. We employ capabilities, processes, and other security measures we believe are designed to reduce and mitigate these risks.


text: Aemetis contracts with a primary Managed Security Provider (MSP) to provide services that assist us with assessing, enhancing, implementing and monitoring our cybersecurity risk management programs and responding to incidents. Aemetis maintains cyber recovery plans as well as a cybersecurity insurance policy.


text: Aemetis utilizes a third-party cybersecurity and information security awareness training programs. Training is administered and tracked through online learning modules and ongoing phishing simulations. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe our controls are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.


text: Role of Management Aemetis' cybersecurity initiative is led by its Chief Financial Officer, who is in the unique position of being able to integrate cybersecurity with the financial internal control framework. He is responsible for administration of the cybersecurity and information security program and risk management, using his experience working with information technology and financial control system during a majority of his career, including over 10 years of overseeing the Aemetis information technology and security program.


text: We utilize a Managed Security Provider (MSP) who serves as the central point for identifying all cybersecurity incidents and reporting, including incidents that directly target company network, internal information systems and incidents originating from third parties. The MSP provides end-to-end operations for the purpose of monitoring, detecting, alerting and responding to cyber incidents. The MSP is also responsible for activating the containment and resolution efforts where appropriate to support Aemetis through the resolution of the incident.


text: The MSP escalates incidents with significant impact and pervasiveness to Aemetis' Chief Financial Officer, who evaluates each incident in terms of its impact on Aemetis and operations, ability to conduct business with customers and suppliers, brand reputation and health, safety or the environment, and the speed and degree to which the incident has been contained. Our Chief Financial Officer, working with the executive management team, also manages the communication with our Board and outside parties. After initial identification, evaluation and escalation for material events, the MSP monitors all cybersecurity incidents for changes in degree of impact or pervasiveness.


text: Role of the Board The Board of Directors ("Board") recognizes the importance of cybersecurity in safeguarding the sensitive data and protecting the perimeter of the computer network. The Board is responsible for overseeing overall risk management for the Corporation, including review of the cybersecurity program. As part of its oversight responsibilities, the Board receives an annual cybersecurity update from the Chief Financial Officer. The annual review includes oversight of cyber exposure, risk assessment, incident response, integration with other control activities, internal monitoring, and risk management processes, such as updates to Aemetis' cybersecurity programs and mitigation strategies, and other cybersecurity developments.


text: The operation of our business is dependent on the secure functioning our computer infrastructure. This infrastructure is used to maintain key processes including management of sensitive company information and operation of sales, record-keeping, and accounting functions.

companyName: RADNOSTIX INC

ticker: INIS


text: We employ a specialized third-party information technology ("IT") management firm to monitor and manage our cybersecurity functions. Processes employed include real-time monitoring of company communications and IT activities and consultation and risk assessment of company procedures. Additionally, our third-party IT firm provides education to management and employees regarding our specific IT risks. All our employees receive information security training (including data protection and fraud awareness) on an annual basis. Department managers are given additional risk management training as part of periodic management meetings. Our activities are monitored at all times by our IT firm; we regularly meet with our them to review our cybersecurity response plans, discuss any needed updates, and identify risk management actions to be taken. The IT firm reports all matters of cybersecurity including any threats, breaches, or risks directly to our Chief Financial Officer who reports directly to the Chief Executive Officer. Updates regarding cybersecurity are provided to our directors at least annually and as needed for any important developments including cybersecurity breaches and risks.


text: We carry a cybersecurity insurance policy to help cover any costs that may occur from a cybersecurity incident. Although risks from cybersecurity threats and implementation of our cybersecurity program have not materially affected our business strategy, business operations or our financial condition, a cybersecurity incident could have a material adverse effect in the future if it were to cause business disruption or data loss.


text: Governance Related to Cybersecurity Risks Our board of directors, as a whole and through its committees, holds overall oversight responsibility for our risk management processes, including in relation to risks from cybersecurity threats. Our board of directors exercises its oversight function through the audit committee, which oversees the management of risk exposure across various areas, including cybersecurity risks, in accordance with its charter. The audit committee receives quarterly reports from our Management on the status of our cybersecurity program. The Chair of the audit committee provides a quarterly report to the board of directors, which includes any key updates on cybersecurity matters, as applicable.

companyName: MILESTONE SCIENTIFIC INC.

ticker: MLSS


text: Our management team is responsible for the day-to-day administration and management of our cybersecurity program, under the direct supervision of our Chief Executive Officer currently we also work with external security service providers to support our security monitoring and threat detection capabilities and have implemented a process to report relevant findings to the Chair of audit committee where appropriate.


text: Cybersecurity Risk Management and Strategy We maintain a cybersecurity program, which includes processes for identification, assessment, and management of cybersecurity risks. We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify potential areas of enhancement, and develop strategies for the mitigation of cyber risks. We have implemented a process to periodically conduct security awareness training for employees.


text: Our team is informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third-party security software and technology services. In addition, we use third-party security solutions, monitoring, and alerting tools and resources, designed to monitor, identify, and address risks from cybersecurity threats. We also have implemented processes and technologies for network monitoring and data loss prevention procedures, and from time to time review such processes and technologies.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10 K for more information.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to cyber risk management ("CRM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's CRM program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: UNIVERSAL STAINLESS & ALLOY PRODUCTS INC


text: Risk Management and Strategy As one of the critical elements of the Company's overall CRM approach, the Company's cybersecurity program is focused on the following key areas:


text: Governance: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management includes interaction with the Company's Chief Information Officer ("CIO") at least quarterly and similar interaction on this topic with other members of management.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the CIO and the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: The Board, in coordination with the CIO and Company management, oversees the Company's CRM process, including the management of risks arising from cybersecurity threats. The Board receives at least a quarterly update on cybersecurity risks, which addresses a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Board, the CIO and other members of the Company's management team will discuss, at least annually, the Company's approach to cybersecurity risk management.


text: The CIO, in coordination with our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and General Counsel ("GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, members of the CIO's team are deployed to address cybersecurity threats and to respond to cybersecurity incidents. The Company's management team, through ongoing communications with CIO's team, monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.


text: The CIO holds a B.S.B.A. degree in Management Information Systems and has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Officer for the Company. The Company's CEO, CFO and GC each hold undergraduate degrees in their respective fields, and collectively have over 50 years of experience managing risks at the Company and at similar companies.


text: Cybersecurity threats, including all previous cybersecurity incidents, have not materially affected, or currently are believed by the Company to not materially affect the Company, including its business strategy, results of operations or financial condition. While these risks have yet to materially affect the Company, the Company cannot guarantee that its ongoing and robust approach towards cybersecurity will be able to prevent all cybersecurity incidents that could have a material effect on the Company. For more information about cybersecurity risks that the Company faces, see "If we are unable to protect our information technology infrastructure against service interruptions, data corruption, cyber-based attacks or network security breaches, our operations could be disrupted" in Item 1A, Risk Factors.


text: Cybersecurity Risk Management Program Overview We recognize the critical role that properly managing cybersecurity risk plays in maintaining the trust and confidence of our stockholders, the patients in our clinical trials, our employees, our business partners and our other stakeholders. Accordingly, our cybersecurity program is designed to identify, assess, manage and mitigate material risks from cybersecurity threats through a variety measures, including risk assessments, implementation of security measures, and ongoing monitoring of systems and networks. In collaboration with our third-party information technology service providers, a cross-functional team comprised of representatives from our administrative, finance and legal functions actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We also engage external experts, including information technology experts, other consultants, and auditors to evaluate our cybersecurity measures and risk management processes.

companyName: CervoMed Inc.

ticker: CRVO


text: We also identify our cybersecurity threat risks by comparing our processes to industry standards and best practices as well as by engaging experts to manage our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and other evaluations on a routine basis;


text: provide training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: leverage threat intelligence available to us and our third party IT service provider to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Board Oversight of Cybersecurity Risk Management and Governance Our Board is responsible for general oversight of our risk environment and associated management policies and practices and has delegated to its Audit Committee the responsibility for oversight of our certain major risk categories and exposures, including with respect to cybersecurity and management's processes to monitor and control them. The Audit Committee meets regularly throughout the year and, on no less than a quarterly basis, receives and reviews a report from management, including the Company's General Counsel, regarding the Company's IT, cybersecurity, data security, and physical security risk, including any suspected material or immaterial cybersecurity incidents during the preceding quarter, if any, and discusses such matters with appropriate management and other personnel. In addition, on a semi-annual basis, the Audit Committee receives a report from the Company's primary third-party information technology and cybersecurity regarding the Company's IT environment, overall cybersecurity risk management program and strategy and education regarding emerging trends and threats.


text: Management's Role in Cybersecurity Risk Management and Governance Our executive management team is responsible for assessing and managing material risks from cybersecurity threats and possess relevant experience and expertise in various disciplines that are key to effectively managing such risks. The experience and expertise of our executive management team is also supplemented by our external IT service providers that collectively have extensive, broad experience and expertise in these areas. Our executive management team reports information about such risks to the Audit Committee of the Board on at least a quarterly basis.


text: We depend on and engage various other third parties, including suppliers, vendors, and service providers, to support key elements of our business including our information technology infrastructure. Our processes address cybersecurity threat risks associated with our use of such third-party service providers. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel.


text: In response to an identified cybersecurity incident, a group comprised of appropriate management personnel, our third-party information technology service provider and, depending on the scope and severity of the incident, additional third-party subject matters experts, will be assembled to develop and implement a response strategy to contain, control, and remediate the cybersecurity incident, including securing our affected systems and/or information, mitigating harmful effects of the incident, preventing further compromises, and communicating information to affected parties, regulatory agencies and law enforcement, as necessary. This group will also report any such cybersecurity incident to the Audit Committee of the Board.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis by both management and the Board, including how such risks could materially affect our business strategy, operational results, and financial condition.


text: As of the date of this Annual Report, we have not experienced a cybersecurity incident that results in a material effect on our business strategy, results of operations or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such an incident or risks related thereto.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading Item 1A. Risk Factors – General Risks Related to the Company's Business and Operations," which disclosures are incorporated by reference herein.


text: Cybersecurity Risk Management and Strategy As a company committed to safeguarding our operations, assets and stakeholders against cyber threats, we recognize the critical importance of the need for cybersecurity risk management and strategy. In today's digital landscape, where cyber threats continue to evolve and proliferate, it is imperative that we remain vigilant and proactive in our approach to cybersecurity.

companyName: ESCALADE INC

ticker: ESCA


text: In this section, we outline our cybersecurity risk management strategies and initiatives aimed at mitigating cyber risks and ensuring the resilience of our organization. From risk assessment and threat detection and continuous improvement, our approach to cybersecurity reflects our resolve to maintain the confidentiality, integrity and availability of our systems and data.


text: Risk Assessment – We regularly conduct risk assessments to identify and evaluate potential cybersecurity threats and vulnerabilities. These assessments consider factors such as our current IT infrastructure, the sensitivity of our data, industry best practices, and emerging cybersecurity trends.


text: Threat Detection and Prevention – Given our limited resources, we prioritize the deployment of cost-effective tools and technologies for threat detection and prevention. This includes the use of firewalls, intrusion detection systems, antivirus software, and security information and event management (SIEM) solutions to monitor and mitigate potential security incidents.


text: Employee Training and Awareness – We understand that employees play a crucial role in maintaining cybersecurity. Therefore, we provide regular training and awareness programs to educate our staff about cybersecurity best practices, common threats and how to recognize and report suspicious activities.


text: Engagement of Third-Party Consultants and Assessors – In addition to our internal efforts to manage cybersecurity risks, we recognize the value of engaging third-party consultants, firms or assessors to provide specialized expertise and support in enhancing our cybersecurity posture, policies and procedures. While our internal IT staff possess valuable skills and knowledge, leveraging external resources can provide additional insights, validation and assurance in our cybersecurity initiatives.


text: Continuous Improvement – We are committed to continuously improving our cybersecurity posture in line with industry standards and best practices. This includes staying informed about emerging threats and vulnerabilities, conducting regular security audits and assessments and investing in cybersecurity technologies and training as resources allow.


text: Currently, we have not identified any risks stemming from known cybersecurity threats, including those resulting from previous cybersecurity incidents, which have significantly impacted our operations, business strategy, financial condition or results of operations. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company's business. See " Risk Factors – Operational Risks to the Company and Our Business. "


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other threats or risks. The Audit Committee is primarily responsible for overseeing the Company's risk management processes, which include cybersecurity, global operations, product compliance and other regulatory risks.


text: The Audit Committee receives reports from management regarding the Company's assessment of the cybersecurity risks, and other risks, on an annual basis. In addition, management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents. The Audit Committee reports regularly to the full Board regarding its activities, including those related to cybersecurity.


text: Management of the Company is responsible for the day to day risk management process, specifically the Director of IT, who reports and operates under the direction of the Chief Financial Officer (CFO), who then reports directly to the Audit Committee regarding such risks. The CFO provides updates to the Audit Committee on cybersecurity risks and threats annually, but the Director of IT attends both the Audit Committee meetings and the Board meetings to provide further updates on cybersecurity and other IT related matters. At a minimum, the Audit Committee is given updates on a quarterly basis, but if a situation were to arise, the Audit Committee would be notified once the Company was aware of the issue.


text: Our management team, led by our CFO, is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through updates by our Director of IT. This management team is responsible for assessing and managing risks that may arise from cybersecurity threats. Our CFO has over 10 years of experience managing IT operations including strategy, infrastructure and execution. Our Director of IT has over 20 years of experience in information technology including roles managing operations, compliance, development, applications, information security, support and execution.


text: Risk Management and Strategy As of December 31, 2023, cybersecurity and data protection policies and procedures have been implemented. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees receive awareness notices and are informed about new email threats and recent phishing attempts and email frauds. We have capable employees with significant expertise in cybersecurity related to our industry. We evaluate, create and deploy advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.

companyName: TABLE TRAC INC

ticker: TBTC


text: Our Information Technology General Controls are firmly established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery.


text: To date, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For additional information about our cybersecurity risks, see "Any disruption in our software and related information technology systems due to a cyber incident could adversely affect our business, operating results and financial condition" under the heading "Risk Factors Relating To Our Business" in Item 1A. of this Annual Report.


text: The Board of Directors has oversight of the cyber security risk management and strategy. The senior leadership, including our Chief Executive Officer and Chief Financial Officer, regularly meets with and provides periodic briefings to our Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our Chief Executive Officer and Chief Financial Officer are responsible for implementing and maintaining our cybersecurity risk assessment and management processes.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are fully integrated into the Company's overall risk management approach, and cybersecurity risks are subject to oversight by the Company's board of managers. The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with specific the goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: Risk Management and Strategy Consistent with overall Company policies and practices, the Company's cybersecurity program focuses on the following areas:


text: Vigilance: The Company uses a reputable third-party managed service provider ("MSP") for cybersecurity support, which has operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. The Company's MSP is staffed with several security personnel, many of which have Certified Information Systems Security Professional ("CISSP") certifications.


text: Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. In the event of a potential cybersecurity incident, the Company's MSP has the capability to take a number of immediate steps to isolate the potential threat.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Training: The Company provides annual mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. The Company also conducts monthly "phishing" email testing for every employee and provides remedial follow-up training when necessary.


text: Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans, in coordination with the Company's MSP, that fully address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident.


text: Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's operations, risk management, internal audit and other key business functions, as well as the members of the board of managers in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.


text: Governance: The board of managers' oversight of cybersecurity risk management is supported by the Company's Incident Response Team (the "IRT"), which is made up of the Company's Co-Chief Information Officers, the Chief Operating Officer, and their designees. The IRT regularly interacts with the board of managers and members of management.


text: The IRT, in coordination with the board of managers, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. Any cybersecurity incidents that are detected by the Company's MSP are routed directly to the IRT. The board of managers receives reports on cybersecurity risks from management. The board of managers will be informed of any cybersecurity incident that is determined by the IRT to be material, and will receive ongoing updates regarding such material incident until it has been addressed. At least once each year, the board of managers and the IRT discuss the Company's approach to cybersecurity risk management with the Company's Co-Chief Information Officers.


text: The Company's Co-Chief Information Officers are the members of the Company's management principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Co-Chief Information Officers work in coordination with the other members of the IRT, which includes our Co-Chief Information Officers, our Chief Operating Officer, and their designees. The Company's Co-Chief Information Officers have each served in various roles in information technology and information security for over 30 years, including in leadership positions with both small and large companies. The Co-Chief Information Security Officers each have extensive knowledge in technology and cybersecurity. The Company's President, Chief Financial Officer, Chief Operating Officer, and Chief Compliance Officer each hold undergraduate, and, in some cases, graduate, degrees in their respective fields, and each have over 20 years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.


text: The Company's Co-Chief Information Officers, in coordination with the IRT, work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. The Co-Chief Information Officers and the rest of the IRT, in collaboration with the Company's MSP, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the board of managers when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company's business strategy, results of operations, or financial condition. See the "General Risk Factors" section in Part I, Item 1A, Risk Factors for more information about the Company's cybersecurity risks.


text: Cybersecurity Risk Management and Strategy We recognize the paramount importance of cybersecurity in preserving the integrity, confidentiality, and availability of our systems, data, and operations. We are committed to maintaining a comprehensive cybersecurity posture that encompasses proactive risk management, robust defense mechanisms, and continuous monitoring. To this end, we employ a multifaceted approach to cybersecurity, which includes regular assessments of our infrastructure, applications, and processes to identify vulnerabilities and weaknesses. Furthermore, we prioritize ongoing employee education and awareness initiatives to cultivate a culture of security throughout our organization. Our workforce receives regular training on best practices, emerging threats, and incident response procedures to empower them to be active participants in our cybersecurity efforts. Additionally, we enforce strict access controls and data encryption protocols to safeguard sensitive information and mitigate the risk of unauthorized access or data breaches.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: While we have implemented extensive measures to fortify our defenses against cyber threats, it is important to acknowledge that the cybersecurity landscape is constantly evolving, with threat actors employing increasingly sophisticated tactics. Despite our best efforts, we cannot guarantee that our systems will be completely immune to cyber attacks. As such, we maintain a proactive stance in monitoring for emerging threats and vulnerabilities, leveraging threat intelligence sources and collaborating with industry partners to stay abreast of evolving risks.


text: In the event of a cybersecurity incident, we have established incident response protocols designed to facilitate swift and effective remediation efforts. These protocols outline clear escalation procedures, delineate responsibilities among key stakeholders, and emphasize transparency and communication with internal teams, regulatory authorities, and affected parties.


text: In summary, while we maintain confidence in the effectiveness of our cybersecurity measures, we acknowledge the dynamic nature of the cybersecurity landscape and remain vigilant in our efforts to adapt and respond to emerging threats. Our commitment to cybersecurity extends beyond mere compliance; it is a fundamental aspect of our corporate ethos and a cornerstone of our efforts to safeguard the interests of our shareholders, customers, and stakeholders.


text: We enlist the support of third-party providers to bolster our cybersecurity risk management. These providers offer ongoing assistance, such as threat monitoring, mitigation strategies, updates on emerging trends and developments, and policy guidance. Additionally, we engage specific providers for targeted assistance, such as security and forensic expertise, as the need arises. Before sharing any sensitive data or integrating with a third-party provider, we conduct a thorough assessment of their security capabilities in alignment with our risk posture and request modifications as deemed necessary.


text: Cybersecurity Governance Oversight for cybersecurity risk lies with the Audit Committee. Periodically the Audit Committee will work with our IT management to provide a full update to the board on continuous improvements made to our monitoring and preventative activities, as well as information on those monitoring activities itself such as attempts of unauthorized access to systems.


text: Our IT management team is directly responsible for cyber security and maintaining of protection, keeping abreast of latest cyber security issues and concerns, monitoring threats, and the design and updating of policies and procedures along with appropriate education for all company employees. Our IT staff and management team have been trained on current industry standards and best practices and hold degrees and have experience necessary to have the skills necessary to address such threats. IT management is also responsible for the appropriate communications regarding threats and breaches should they occur and appropriate shut down and recovery activities and have action plans in place.


text: As of December 31, 2023, we have not encountered any cybersecurity threats that have had a material impact on our operations, business strategy, financial results, or overall financial health.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. To this end, our processes are designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems (including such risks associated with the use of any third -party service providers) that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by third -party experts under supervision of management, and, where necessary or desired, include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. We may also consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: FITLIFE BRANDS, INC.

ticker: FTLF


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our processes and resources are also designed to help enable us to actively identify, protect, detect, respond to, and recover from risks and threats. Nevertheless, we face certain ongoing cybersecurity risk threats that, if realized, are reasonably likely to materially affect us. As of the date of this report, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition.


text: Third-party experts assist our senior management team in assessing and managing material risks from cybersecurity threats. All employees and consultants are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly discussions with our senior officers and independent registered accounting firm.


text: We recognize the critical importance of maintaining the trust and confidence of our patients, employees, and business partners toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our audit committee of the board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. We have taken into account recognized frameworks established by the National Institute of Standards and Technology, or NIST, when developing cybersecurity policies, standards, processes and practices among other considerations. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: PALVELLA THERAPEUTICS, INC.

ticker: PVLA


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including phishing training, regular network and endpoint monitoring, audits, vulnerability assessments, to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance; Management" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by the General Counsel and third-party information technology and security providers who act as our information technology team.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care and enter into confidentiality agreements, and enter into data processing agreements with third parties that are processing personal data we control;


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including physical security measures to prevent access to data processing systems, firewalls, intrusion prevention and detection systems, email security controls, anti-malware functionality and access controls, endpoint detection and response systems, all of which are evaluated and improved through internal and external vulnerability assessments and cybersecurity threat intelligence;


text: provide mandatory training and notifications for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to understand, identify and address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: conduct mandatory annual phishing training and regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; utilize pseudonymized data for patients and use other encryption methods to ensure security of personal data;


text: leverage procedures informed by appropriate incident handling frameworks to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: As part of the above processes, we engage with third parties, including annually having a qualified third-party review our incident response plan and our cybersecurity measures to help identify areas for continued focus, improvement and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and assess cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, for example, by engaging with known, reputable vendors, and requiring they have industry standard safeguards and notification procedures. We may also ask vendors associated with increased cybersecurity risk to complete a periodic questionnaire regarding their security practices for ongoing vendor management purposes.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Significant disruptions of information technology systems or security breaches could adversely affect our business" in Item 1A, Risk Factors, which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. We also have not been subject to any penalties or settlements.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials that include discussions of current and emerging general material cybersecurity threat risks, including our particular cyber risk situation, and describing our ability and strategy to mitigate those risks and may discuss such matters with our Information Technology team or General Counsel. Our audit committee also receives prompt and timely information regarding any cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our external Information Technology team, an Information Technology council composed of various management and senior level employees, and the General Counsel. Such individuals have collectively over 10 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: Risk Management and Strategy We employ a risk management framework to identify, assess, monitor, and test cyber risk and controls, and perform comprehensive due diligence and ongoing oversight of third-party relationships, including vendors. We have made and will continue to make ongoing investments in developing and enhancing our security processes and controls and in maintaining our technology infrastructure, including the maintenance of a business continuity and disaster recovery program, which is tested on a regular basis. We have also implemented processes to help identify, assess and manage cybersecurity risks associated with our use of a third-party service provider. We also provide regular education and training to our employees and contractors on cybersecurity and the protection of our information systems in order to mitigate risk associated with protection against threats to the confidentiality, availability, and integrity of our information systems. We do not believe that risks from cybersecurity threats of which we are currently aware, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See Item 1A – Risk Factors above for additional information on risks related to cyber-attacks.

companyName: RiceBran Technologies

ticker: RIBT


text: Together with the Board's standing committees, the Company's Board of Directors is responsible for ensuring that material risks, including material cybersecurity risks, are identified and managed appropriately. The Board and its committees regularly review material operational, financial, cybersecurity, compensation and compliance risks with management. For example, the Audit Committee oversees the Company's consultation with outside parties with an expertise in cybersecurity that we engage and retain to review and assess our information security program. The Board also receives regular updates concerning our information security and cyber risk strategy, cyber defense initiatives, cyber event preparedness, and cybersecurity risk assessments.


text: Cyber Security Governance Oversight of cybersecurity infrastructure is managed by members of our management team, including our President & Chief Executive Officer. Management works in tandem with a third-party service provider (the "Service Provider"). The Service Provider periodically reviews and updates our antivirus and antimalware software, manages our Business Continuity and Disaster Recovery system, reviews our vulnerability management and ensures our system is Payment Card Industry (PCI) compliant. Given our overall risk profile, the Board has had limited involvement with our cybersecurity risk management. The management team, with support from the Service Provider, would raise any significant cybersecurity risks with the Board.

companyName: Saker Aviation Services, Inc.

ticker: SKAS


text: Risk Management and Strategy We believe we have implemented processes that are designed to effectively identify and manage risks from cybersecurity threats. Through our Service Provider, we receive Endpoint Detection and Response services ("EDR"). The EDR helps to ensure faster identification of a cybersecurity breach. Once a cyber incident is identified, our Service Provider will notify management and work to secure our systems and fix the vulnerability. An investigation will be conducted, with the assistance of the Service Provider if needed, to determine the root cause of the cyber incident, the materiality of the cyber incident, and any disclosure or legal obligations that will stem from the cyber incident.


text: We have not been the victim of a cyber incident in the past but may be the subject of cyber incidents in the future.


text: The Company recognizes the importance of securing its information, devices, and data and the IT systems it relies on to conduct its business. The Company has established its Network, Information, and Data Security Policy Guidelines (the "NIDSP Guidelines") designed to protect the integrity and confidentiality of data and information belonging to or being exchanged by the Company and its employees, partners, customers, service providers, and suppliers and to safeguard that information and the Company's IT infrastructure from unauthorized access, use, disclosure, alteration, and destruction.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: Risk Management and Strategy The protections, procedures, and controls set forth in the NIDSP Guidelines demonstrate the Company's attention to and prioritization of cybersecurity as a component of its overall strategy and system for managing risks. The NIDSP Guidelines include five policies described below, that together define the Company's strategy and practices for managing cybersecurity threats and mitigating cybersecurity risks.


text: Physical Security Policy (the "PSP"). The PSP establishes guidelines related to selecting IT operation sites, designating security zones, using, inspecting, and storing IT Assets, designing restricted-access and security controls, and monitoring compliance with safety and security standards. The goal of the PSP is to minimize risks of damage, destruction, unauthorized access, inadvertent disclosure, misuse, loss, or theft of the Company's IT Assets. In accordance with the PSP, the Company: (i) evaluates IT operation sites based on their susceptibility to natural disasters, crime and theft, and unauthorized access; (ii) requires the use of keycards or biometrics in order to enforce security zones and give users the least amount of access required to do their jobs; (iii) requires systems and devices that store confidential data to be maintained and protected in accordance with the Company's Confidential Data Policy; and (iv) requires visitors at the Company's office to complete a sign-in log, wear a visitor badge, and be escorted by a designated employee at all times.


text: Network Security Policy (the "NSP"). The NSP aims to protect the integrity of the Company's data by securing the systems and devices that make up the Company's network infrastructure. Pursuant to the NSP, the Company: (i) enforces strict password-construction criteria for network devices; (ii) requires employees to verify their identities using multi-factor authentication to access internal resources; (iii) maintains and reviews logs from application services, network devices, and critical devices and requires the retention of logs in accordance with the Company's Retention Policy; (iv) implements and configures firewall technology to filter both inbound and outbound network connections; (v) authorizes the IT Manager to determine the extent and scope of external security testing to be performed; (vi) establishes a software-use policy; and (vii) requires antivirus and anti-malware software to be used and timely patched and updated on any Company-provided devices.


text: Backup Policy. The Company's Backup Policy applies to all data stored on Company systems. The Backup Policy specifies the types of data and information considered to be critical to the Company's operations and thus required to be backed up, establishes a backup schedule that is necessary for successful data recovery, and implements procedures for the off-site rotation, storage, and retention of backups. The Backup Policy also establishes the Company's data-restoration procedures and mandates the periodic testing of those procedures.


text: Remote Access Policy (the "RAP"). The RAP defines the Company's standards for accessing IT resources from outside the Company's network, such as when an employee is working remotely. Pursuant to the RAP, remote access is only permitted if accomplished through secure, Company-provided means. The Company's uses remote-access software designed to guard against unauthorized access using traffic encryption during transmission and firewall protections.


text: Confidential Data Policy (the "CDP"). The CDP governs the handling, storage, transmission, destruction, and protection of confidential data. Pursuant to the CDP, confidential data must be securely stored, removed from common areas, properly marked as confidential data, protected with strong encryption if being transmitted, and destroyed by means that make recovery impossible. Employees who are given access to confidential data are required to immediately notify their supervisor if they suspect any misuse or unauthorized disclosure of confidential information.


text: The Company's NIDSP Guidelines and policies apply not only to the Company's employees and consultants but also to any third parties that access or utilize the Company's information and systems. Such third parties may include the Company's service providers, customers, suppliers, contractors, consultants, and any other individuals the Company conducts business with. The IT infrastructure that the Company has developed in accordance with the NIDSP Guidelines is designed to monitor both internal and external cybersecurity risks. The NIDSP Guidelines equip the Company with the tools and systems necessary to recognize, address, and protect against risks associated with its third-party interactions.


text: Cybersecurity Governance The Company's IT Manager and executive team is responsible for the day-to-day management of cybersecurity risks, while the Company's Board of Directors has responsibility for oversight of risk management.


text: As part of the Company's framework for cybersecurity risk oversight and governance, the Company's network, information, and data-security policies set forth in the NIDSP Guidelines are enforced by the Company's IT Manager and/or its executive team. The IT Manager is an employee designated by the Company to manage the Company's security policies and program. The IT Manager is tasked with ensuring that the Company maintains compliance with the Company's security policies and any applicable security regulations. The IT Manager is responsible for: (i) implementing the Company's security policies; (ii) disseminating the Company's security policies to all employees; (iii) establishing a training program for all employees and users covered by the Company's IT security policy to notify them of the Company's security policies, train and re-train them to comply with the Company's IT security program, and educate them on the importance of data security; (iv) performing any ongoing testing or analysis of the Company's security infrastructure, policies, and procedures; and (v) updating the NSP and any other policies and guidelines as needed to comply with applicable regulations and to stay up to date with the changing IT security landscape.


text: The IT Manager works closely with the Company's management and executive team to determine the Company's IT-related needs, to evaluate the sufficiency of the Company's data-governance policies and practices, to keep the Company's management informed of notable cybersecurity-related updates, to review its security-related policies, and to identify ways to strengthen the systems and procedures implemented by the Company to detect, assess, and manage data risks.


text: In the event of the detection of an actual or suspected cybersecurity incident, the Company's IT Team, lead by the IT Manager, assesses the incident as "minimal", "low", "moderate" or "high". Incidents assessed at a minimal or low risk are reported to Company's management and the Executive Chairman of the Board and the Executive Chairman of the Board may share this information with the Board. Incidents assessed at a moderate or high risk are reported to Company's management, the Executive Chairman of the Board, and the Company's Board of Directors.


text: Notwithstanding the Company's cybersecurity-related policies, procedures, and governance framework, the ever-present threat of a cyber-attack, data breach, or other security incident is pervasive. The increasingly sophisticated nature of the tactics used to circumvent IT security safeguards makes cybersecurity threats increasingly difficult to detect and respond to. While the Company does not believe its business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity threats or incidents, there is no assurance that the Company will not be materially affected by such threats or incidents in the future. Accordingly, the Company will continue to monitor cybersecurity risks and strive to invest in and strengthen its cybersecurity infrastructure.


text: Risk management is an essential component of our culture and business model. Guarding against the specific risks posed by cybersecurity threats has been and will continue to be very dynamic in nature, requiring that we remain agile and aware of internal and external changes. We recognize that cybersecurity threats can be among the most critical risks facing large companies. As a result, cybersecurity is treated as a Board-level matter and overseen by the Board. However, both the Board and management have an integral role in the identification, assessment and management of cybersecurity risk.

companyName: US Alliance Corp


text: Management engages third parties with relevant expertise in assessing and managing cybersecurity threats. As a general matter, we take a proactive approach to assessing and monitoring cybersecurity-specific risks that is oriented around monitoring emerging external threats, ensuring controls are in place to identify and manage risk within our technology environment and creating a culture of vigilance across the organization. Annually we hire a third party to test for and resolve weaknesses and vulnerabilities within our systems and applications by using network and infrastructure vulnerability testing.


text: Our awareness and training program creates a risk-aware culture to ensure employees understand cybersecurity threats and are accountable for completing required training. We have an enterprise incident management plan that provides a framework for preparing for, managing and responding to cybersecurity incidents that may arise.


text: No risks from any known cybersecurity incidents have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further discussion related to how cybersecurity risks may impact our performance in the future, see Item 1A. "Risk Factors."


text: Risk Management and Strategy Our business heavily relies on various IT and application systems, which contain proprietary and confidential information about our operations, employees, customers, and our customers' customers, including personally identifiable information. These systems are connected to and/or accessed from the Internet and, as a result, are susceptible to cyber-attacks. We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. Our process is supported by both management and our Board of Directors. Organizationally, our businesses are structured as three operating and reportable segments: Ting, Wavelo and Tucows Domains. These segments are decentralized; management and cybersecurity resources are organized both at the parent company level and within each decentralized segment. Each segment has dedicated liaisons for cybersecurity, compliance, and risk management activities.

companyName: TUCOWS INC /PA/

ticker: TCX


text: We maintain and continue to expand our investment in the development of our information security management system ("ISMS"). Our ISMS leverages a risk-based approach and is informed by industry standard guidance, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization for Standardization ("ISO") 27001 Information Security Management System Requirements. A material cyber-attack on Company systems, distribution partners and their key operating systems, or any other third-party partners or vendors and their key operating systems may interrupt the ability to operate the Company's business, damage the Company's reputation, or result in monetary damages. The development of the ISMS is focused on the protections of the confidentiality, integrity, and availability of the Company's information system infrastructure as well as the data in the Company's care, custody and control. The Company engages third parties to evaluate certain aspects of the ISMS, provide threat intelligence, and perform vulnerability assessments and other services as needed.


text: The Company follows an established process to identify and evaluate risks from cyber security threats that may arise internally or through the introduction of third parties to the ISMS. This evaluation is part of the Company's risk management process. The process may include, but is not limited to, evaluating the third party's cybersecurity maturity and/or imposing certain contractual conditions.


text: Operationally, the Company maintains Security and Network Operations Centers, which provide 24/7 coverage and support of on-call cybersecurity and network professionals to triage and respond to immediate cybersecurity threats and outages. The Company also assesses cybersecurity risks on a quarterly basis and ranks them according to their risk profile. These risks are communicated to management and to the Board of Directors as part of the normal course of operations.


text: Cybersecurity incidents are responded to in accordance with the Company's established Cybersecurity Incident Response Plan ("IRP"). In the event of an incident, we follow our IRP, which includes evaluation of the severity of the incident based on factors such as the number of assets affected, the extent of the incident, the likelihood of inappropriate data exposure, operational impact and/or reliability impact. Dependent upon the severity of an incident, the incident is escalated to the senior leadership, including the CEO and CISO. Senior leadership then determines whether, based on various factors, the incident requires immediate escalation to the Board of Directors and to third-party incident response organizations and notification to functional areas, such as legal and finance, as well as senior leadership and the Board, and external entities, as appropriate and required. We maintain relationships with third-party Digital Forensics and Incident Response ("DFIR") service providers to strengthen our incident response capabilities in the event that we determine the need to augment our effort during an incident and to provide us additional assurance that our responses to complex incidents or highly sophisticated threat actors have been effective and complete.


text: Although the risks from cyber threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future and we continue to closely monitor cyber risk. For a detailed description of the risks related to cybersecurity, see Item 1A. "Risk Factors." of this Form 10-K, which should be read in conjunction with this Item 1C.


text: Board Governance and Management The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our corporate information security function, led by our Chief Information Security Officer ("CISO"), is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The current CISO has an extensive information technology and cybersecurity background gained through years of industry experience and leadership. The corporate information security function is responsible for managing and continually enhancing our information security posture and information security infrastructure with the ultimate goal of preventing cybersecurity incidents and reducing their severity to the extent feasible, while simultaneously increasing our resilience in an effort to minimize the business impact should an incident occur.


text: Senior leadership, including our CEO, who also has relevant experience in cybersecurity matters, and our CISO, regularly brief the Board of Directors on our cybersecurity and information security initiatives, and the Board of Directors is apprised of cybersecurity incidents deemed to have a material business impact.


text: Disclosure of Risk Management, Strategy, and Governance Regarding Cybersecurity Risks Our Board of Directors engages in regular discussions to address our Company's principal risks, including those related to cybersecurity, ensuring comprehensive management and oversight. In alignment with this commitment, our cybersecurity leadership, comprising the Chief Operating Officer, Senior Systems Architect, DevOps Engineer, and Senior Technical Project Manager, forms a core committee dedicated to the review and strategic planning of our cybersecurity initiatives. This team's collaborative efforts are instrumental in steering our Company's approach to identifying, evaluating, and mitigating cybersecurity risks.

companyName: PAID INC

ticker: PAYD


text: Cybersecurity Risk Management and Strategy The designated committee oversees our cybersecurity risk assessment and mitigation strategies through various means, including but not limited to: Conducting internal evaluations and leveraging technological tools to fortify our cybersecurity posture. Implementing rigorous cybersecurity training for all employees to heighten awareness and preparedness against cyber threats. Ensuring the robustness of our cyber defenses with comprehensive antivirus solutions and adherence to cybersecurity best practices.


text: Our reliance on third-party service providers, such as Google Cloud for server hosting and Stripe for payment processing, incorporates a level of inherited security measures. Nonetheless, our commitment extends to continuously assessing and enhancing our cybersecurity frameworks to align with evolving industry standards and best practices.


text: Our Board is advised of key cybersecurity matters through high-level briefings, ensuring strategic alignment and informed oversight of our cybersecurity endeavors. The Company's officers, along with the executive team, play a pivotal role in the dynamic landscape of cybersecurity risk management. This committee is not only responsible for the ongoing assessment and management of cybersecurity risks but also ensures that strategic cybersecurity initiatives are integrated within the broader operational framework of our Company.


text: Incident Response and Readiness Although our Company has not experienced cybersecurity incidents, we maintain a proactive stance through the implementation of an Incident Response Plan. This plan encompasses detailed procedures for addressing potential cybersecurity incidents, including scenario-based drills to test our preparedness. The escalation processes within the plan ensure swift communication to the executive leadership and, if necessary, to the Board of Directors, facilitating an agile and informed response to emerging cybersecurity threats.


text: Engagement with Third Parties Our engagement with third-party service providers incorporates a thorough consideration of cybersecurity risks. Through our diligent evaluation process, we ensure that our partners adhere to stringent cybersecurity standards, safeguarding our data and systems against potential threats. This collaborative approach towards cybersecurity underscores our commitment to maintaining a secure operational environment for our stakeholders.


text: Cybersecurity risk management and strategy Cybersecurity and risks associated with information security are operational risks included in the Company's Enterprise Risk Management ("ERM") Framework. Under the ERM Framework, the Company's Information Technology department and all employees are the first line of defense ("First Line"). Those in the First Line are each responsible for identifying and managing the information security risk associated with their activities. The Company's IT Steering Committee is part of the independent risk oversight of information security risk along with the Company's Compliance and ERM Committees, both of which are management risk oversight committees.

companyName: Oak Valley Bancorp

ticker: OVLY


text: The BOD and IT Steering committee are primarily responsible for monitoring management's implementation of operations and technology risk controls, including those relating to cyber security and information security. The Company maintains a data protection and information security program designed to ensure adequate governance and oversight is in place while evolving to meet changes in applicable laws and regulations, and best practices. The Company's information security controls and programs are designed to align with the National Institute of Standards and Technology ("NIST") standards for cybersecurity and the Federal Financial Institutions Examination Council ("FFIEC") examination guidelines, along with applicable privacy laws.


text: Information Security is the responsibility of the officers, employees, and agents of the Company with oversight by the Board of Directors ("BOD"). Our investment in people is critical to maintaining an effective cyber defense, which begins by developing and maintaining a robust Information Security function within the First Line. The Company's Chief Information Officer ("CIO") has over 25 years of network architecture, information technology and cybersecurity experience. Collectively, the Company's senior leadership in this area have nearly 80 years of experience. Each Company employee is responsible for an effective cybersecurity defense which is enforced with mandatory interactive cyber awareness training, periodic newsletters, executive security briefs and updates. Additionally, the BOD is informed about cybersecurity and the relevant risks posed to the Company via regular updates from the Company's CIO. The BOD is regularly informed and actively oversees the data security and privacy program and its policies. The BOD also receives regular education on innovative technology, cybersecurity, information systems/data management, fintech and privacy.


text: Cybersecurity assessments The Company engages external third parties to perform assessments on our adherence to the FFIEC's recommendations on cyber preparedness and NIST Cybersecurity Framework, as well as to review for best practices for the use of cloud services and FedLine requirements. To validate the effectiveness of the Company's overall information security controls, external third parties also perform full-scope external and internal penetration testing designed to mimic the tactics used by individual hackers or criminal hacking organizations. The Company also engages external third parties to perform ongoing adversarial simulation.


text: The Company conducts regular internal cybersecurity assessments intended to measure inherent risk and drive the adjustment of our security posture according to the latest threats. These assessments include alignment with the FFIEC's recommendations on cyber preparedness and GLBA Safeguards Rule to protect user data. The Company performs continuous internal and external vulnerability scanning to measure and react to new vulnerabilities and seeks conformance to industry best practices for both cloud-based and on-premises technology. The Company reviews vendor and partner security practices to ensure they maintain proper information security safeguards.


text: Cybersecurity operational measures Led by our CIO, the Company's data protection, information, cyber and technology services team collaborates with subject-matter experts throughout the business to identify, monitor and mitigate material risks, as well as to monitor compliance with the Company's security polices, applicable laws and regulations. The Company's security monitoring team manages the security of our systems through the ingestion of multiple external threat feeds and systems logs. Through the collection and integration of security-related IT infrastructure information, external threat intelligence and the expertise of trained security analysts, the Company works to identify and address potential indicators of compromise. Potential security events are identified and addressed through defined IT incident response activities and with support of the Company's Incident Response Plan. The Incident Response Plan is in place and updated regularly with the intent to reduce impacts to clients and the Company caused by a declared cyber incident, such as an event involving malicious code, unauthorized disclosure, loss of information or unauthorized use of information or systems. The Incident Response Plan organizes resources to manage and resolve events that harm or threaten the security of information assets. The Incident Response Plan includes involvement of the Company's Executive Leadership Team and BOD based on the severity of a cyber event, including the analysis of reporting requirements. The Incident Response Plan is tested annually and includes technical and executive management in simulated crisis management cybersecurity tabletop exercises.


text: As of the date of this report, other than the risks discussed in "Risk Factors," the Company knows of no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: SPAR Group Inc. recognizes the increased global cybersecurity threats and sophisticated, targeted computer crime and the risk it poses to our operations. We rely on information technology and data to operate our business and develop, market and deliver our products and services to our customers.

companyName: SPAR Group, Inc.

ticker: SGRP


text: Our cybersecurity risk management program is led by our Chief Information Officer ("CIO"), who is directly responsible for establishing cybersecurity strategies and structures and managing ongoing cybersecurity risk management activities. Our CIO is part of the executive management team, and updates our CEO and executive management on a monthly, or even more frequent, basis on cybersecurity enhancement and the development and implementation of our roadmap.


text: We have strategically embedded cybersecurity risk management within an enterprise-wide framework, ensuring that it permeates across various facets of our operations. This integrated approach encompasses administrative protocols, operational strategies, organizational structures, physical safeguards, and technical measures, all tailored to align with the scope and nature of our business.


text: Cybersecurity Risk Management and Strategy We believe this integrated approach allows cybersecurity considerations to be an integral part of our decision-making processes. Our day-to-day cybersecurity work is led by our CIO and Head of Infrastructure. Both are highly experienced professionals. This group works closely with our executive management to continuously evaluate and address cybersecurity risks in alignment with our business and operational needs.


text: Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third-party assessments, internal audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things:


text: Proactively review threat intelligence and other information obtained from governmental, public or private sources Perform network vulnerability scans, cyber-hygiene assessments, and continually evaluate and address perceived gaps. Conduct companywide cyber awareness training and on-going new employee cyber training. Deploy a wide array of industry leading 3rd party solutions to continuously monitor network and endpoints. On-going testing and evaluation of backup processes. Perform disaster recovery tabletop exercises to assess readiness for possible events.


text: As noted, to operate our business, we utilize certain third-party service providers to perform a variety of functions and provide certain security-related services, such as outsourced business critical functions, professional services, SaaS platforms, managed services, cloud-based infrastructure, data center facilities, content delivery to customers, encryption and authentication technology, corporate productivity services, and other functions; as well as third parties that assist us to identify, assess and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity software providers, penetration testing firms and other vendors that help to identify, assess or manage cybersecurity risks. Response, eradication and recovery, Post-incident analysis and future preparations.


text: The plan also provides the process and workflow of communication for escalation of incidents to executive leadership to determine incident classification, impact severity, and if and what further actions are warranted. Incident responses are overseen by leaders from our Software, Infrastructure Engineering, and Executive team.