text: Following these risk assessments, we evaluate how to appropriately implement and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We have implemented cybersecurity tools, conducted employee training, and monitored emerging laws and regulations related to data protection and information security. We may a lso obligate certa in third -party business partners to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect the Company.


text: We have not, to date, experienced a cybersecurity incident that was determined to be material, although, as a technology provider, we have experienced incidents in the past. Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to "Item 1A, Risk Factors" in this Annual Report on Form 10-K.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI

secItem: Item 1C


text: Our Chief Executive Officer and Chief Financial Officer are principally responsible for overseeing the cybersecurity risk management program, in partnership with outside consultants, as well as managing and responding to material cyber incidents if any occur. Our CFO also serves as a board member at a cybersecurity and mobile IT solutions company. Although our CEO and CFO do not otherwise have cybersecurity expertise, their many years in Company management and risk oversight more generally position them well to oversee the cybersecurity risk management program, which they do in partnership with outside consultants. They provide periodic briefings to the Audit Committee and to the Board of Directors about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, our policies for managing and responding to cybersecurity incidents include procedures for appropriate escalations to our Audit Committee Chair.


text: The use of these third -party providers is regularly reviewed and monitored by the appropriate members of management. We conduct thorough assessments of all third -party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.

companyName: Planet 13 Holdings Inc.

ticker: PLNH


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impacted our strategic plan, operations, or financial standing. For additional information, see "Risk Factors."


text: Our cybersecurity program is managed by our Vice President of Operations ("VP Operations") and our Director of Information Technology ("IT Director"), whose team ("Cybersecurity Team") is responsible for facilitating the enterprise-wide cybersecurity program. Our VP Operations and IT Director have experience with large information technology footprints, including cybersecurity. Their in-depth knowledge and expertise are instrumental in supporting our cybersecurity program and policies and overseeing our governance and compliance programs. The Audit Committee of our Board of Directors oversees management's process for identifying and mitigating risks, including cybersecurity risks. The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106 (a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Usio, Inc.

ticker: USIO


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third -party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our consumer products) and implement appropriate changes.


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. As of 2024, our Information Security Management System has been certified to conform to SOC 2 Type 2 and PCI, and are working to conform to ISO 27001.


text: Our risk management program also assesses third party risks, and we perform third -party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third -party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third -party service providers and potential fourth -party risks when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform risk management during third -party cybersecurity compromise incidents to identify and mitigate risks to us from third -party incidents.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " If our security applications are breached by cyberattacks or are not adequate to address changing market conditions and customer concerns, we may incur significant losses and be unable to sell our services " included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10 -K.


text: The Board of Directors is responsible for overseeing the Company's enterprise risk, and has established its Risk and Cybersecurity Committee with specific responsibility for overseeing cybersecurity threats, among other things. The Company's cybersecurity organization is led by the CTO, who is responsible for assessing and managing material risks from cybersecurity threats and reports to Usio's CEO, CAO, and Legal team, as well as to the Risk and Cybersecurity Committee. The CTO has served in this role for 17 years, and more than 21 years with the Company developing, maintaining, and securing our corporate network and information technology systems. The CTO holds a bachelor's degree in information technology from the University of Texas at San Antonio with over 11 years of previous software and hardware systems engineering experience.


text: The CTO and the Risk and Cybersecurity Committee monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of the Company's incident response plans, which include escalation to the CTO and the Risk and Cybersecurity Committee, as appropriate. As discussed above, the CTO reports out to the Risk and Cybersecurity Committee about cybersecurity threat risks, among other cybersecurity related matters, at least quarterly.


text: We rely on information technology and data to operate our business and advance our pipeline of product candidates. Our critical information technology includes computer networks, third-party hosted services, communication systems, software and infrastructure and our critical data includes confidential, personal, proprietary and sensitive data (collectively, Information Assets). Accordingly, we maintain a process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We routinely assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our Information Assets and mitigate harm to our business.

companyName: BioCardia, Inc.

ticker: BCDA


text: To operate our business, we utilize certain third-party service providers to provide a variety of functions, such as outsourced business functions, professional services, software-as-a-service platforms and encryption and authentication technology. Depending on the services provided, the sensitivity and quantity of information processed and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, or requiring that the vendor certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with its work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: As part of our risk management system, we track and log privacy and security incidents to facilitate our efforts to remediate and resolve any such incidents. Any significant incidents are reviewed with our Chief Financial Officer and incidents that are assessed as potentially being or potentially becoming material are escalated within the appropriate members of management and reported to our executive leadership team. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our executive leadership team makes the final materiality determinations and disclosure and other compliance decisions.


text: The Board of Directors has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. Our executive leadership team regularly discusses cyber risks and trends and, should they arise, any material incidents with the Board of Directors.


text: Cybersecurity Risk Management and Strategy We face cybersecurity risks, as a small company, due to the breadth of networks and systems we utilize to design, develop, produce and sell our LMR products. We also use third-party products, services and components to produce our LMR products. We are committed to maintaining robust governance and oversight of these risks and implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in our incurring significant costs related to rebuild our internal systems, implement additional threat protection measures, provide modifications or replacements to our products, respond to regulatory inquiries or actions, pay damages, provide customers with incentives to maintain a business relationship with us, or take other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures.

companyName: BK Technologies Corp

ticker: BKTI


text: We seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes, tools and changes or updates to our products; however, we remain potentially vulnerable to known or unknown threats. In some instances, we, our suppliers, our customers and the users of our products can be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Risk Factors" for more information on our cybersecurity risks and product vulnerability risks.


text: As a supplier of LMR products to federal, state and municipality agencies, our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. We have retained the assistance of a Cybersecurity expert consultant, to assist internal management to evaluate processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our products and have processes to assess those issues for potential cybersecurity impact or risk. We are also implementing a process to manage cybersecurity risks associated with third -party service providers. We impose security requirements upon our suppliers, including maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident.


text: Cybersecurity Governance Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program and our use of and risks related to artificial intelligence with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least twice annually, or more frequently as determined to be necessary or advisable.


text: Our cybersecurity program is run by our Chief Information Security Officer (CISO) and Chief Financial Officer (CFO), who reports to our Chief Executive Officer (CEO). Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our IT Director and the Cybersecurity consultant expert. Our CISO reports to the Audit Committee or the Board of Directors on cybersecurity risks and timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Regular risk assessments by management, including our Director of Information Technology, and audits to identify vulnerabilities and areas for improvement. The Company performs annual financial and risk assessment audits aimed at identifying potential security threats. The Board has responsibility for oversight of potential threats relating to cybersecurity. In furtherance of such responsibility, the Director of Information Technology reports to the Board as needed on information about such threats, which may include the current cybersecurity threat landscape, defensibility measures implemented by the Company, the health of the Company's information security system, and the effectiveness of the Company's cybersecurity controls. Clear delineation of roles and responsibilities within the organization for cybersecurity-related tasks.

companyName: HG Holdings, Inc.

ticker: STLY


text: Cybersecurity is a top priority for us and we are dedicated to continuously improving our cybersecurity posture to protect our systems and data from evolving threats. By implementing robust governance, policies, technologies, and compliance measures, we strive to maintain the trust and confidence of our stakeholders in our ability to safeguard their information. Pursuant to the Company's cybersecurity policy, the Board will be promptly notified of any material cybersecurity incident required to be disclosed under Item 1.05 of Form 8 -K and shall oversee the Company's response to such matter.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Item 1A. Risk Factors – Risks Related to the Company - Cybersecurity risks and cyber incidents may adversely affect our business in the event we or any other party that provides us with essential services experiences cyber incidents" in this Annual Report on Form 10-K.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. To this end, our processes are designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems (including such risks associated with the use of any third-party service providers) that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by third-party experts under supervision of management, and, where necessary or desired, include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. We may also consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: FITLIFE BRANDS, INC.

ticker: FTLF


text: Risk Management and Strategy We recognize the paramount importance of cybersecurity in preserving the integrity, confidentiality, and availability of our systems, data, and operations. Our cybersecurity program is designed to identify, assess, monitor, and manage material risks from cybersecurity threats. We have developed a comprehensive approach based on recognized frameworks including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and industry best practices.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: Advanced endpoint protection solutions Next-generation firewalls and intrusion detection/prevention systems Data loss prevention tools and encryption for sensitive data Multi-factor authentication for all critical systems and applications Regular vulnerability scanning and penetration testing Continuous monitoring of our network and systems We conduct regular risk assessments of our infrastructure, applications, and processes to identify vulnerabilities and implement appropriate controls. These assessments incorporate:


text: Identification of reasonably foreseeable internal and external threats Assessment of the likelihood and potential impact of identified threats Evaluation of the sufficiency of policies, procedures, and technical measures to manage risks Regular testing and auditing of our security controls All employees undergo mandatory security awareness training upon hiring and annually thereafter. This training covers best practices, emerging threats such as phishing and social engineering, and incident response procedures. We also conduct regular phishing simulation exercises to reinforce training and identify areas for improvement.


text: Active participation in industry-specific information sharing organizations Membership in cybersecurity forums and communities Strategic partnerships with third -party security providers who maintain current certifications and specialize in emerging threat detection and response Subscription to threat intelligence services that provide real-time updates on evolving threats Regular review and incorporation of updated guidance from organizations such as CISA, NIST, and industry regulatory bodies Engagement with cybersecurity thought leaders and experts through conferences and professional development Regular assessments of our security program against industry benchmarks and frameworks to identify improvement opportunities


text: Third-Party Risk Management Our third -party risk management program is integrated into our overall cybersecurity strategy. We recognize the significant challenges posed by the need to govern third -party service providers and vendors, and have implemented robust processes to oversee and manage these risks:


text: Security assessments of all third -party providers proportional to the risks present, before or soon after engagement, and periodically thereafter Contractual requirements for security and privacy protections Continuous monitoring of critical third -party services Incident response coordination with key vendors Regular audits of third -party security controls for those handling sensitive data Before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, we conduct thorough information security assessments. All third parties with access to our information systems must review and acknowledge our acceptable use policy before access is granted.


text: Incident Response and Business Continuity We maintain a formal incident response plan with clearly defined roles, responsibilities, and procedures for: Identifying a cybersecurity incident Assessing its nature and scope Minimizing and containing the impact


text: Investigating the root cause Communication and reporting to stakeholders Recovering and restoring affected systems Our incident response procedures include escalation protocols to notify appropriate members of senior and executive management, the Board, and regulatory authorities in a timely manner based on the criticality of the cybersecurity incident. We conduct regular tabletop exercises and simulations to test the effectiveness of our response capabilities.


text: We also maintain business continuity and disaster recovery plans to ensure operational resilience in the event of a significant cybersecurity incident. These plans are regularly tested and updated based on lessons learned from exercises and actual incidents.


text: Cybersecurity Governance and Personnel The Audit Committee of our Board of Directors provides oversight of our cybersecurity program. The committee receives annual briefings from IT management on:


text: The state of our cybersecurity program Significant security incidents and their resolution Results of security assessments and audits Progress on security initiatives and investments Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our Senior Vice-President of IT, who has over 20 years of experience in information technology and cybersecurity, including a Bachelor of Science degree. Our SVP of IT reports directly to our Chief Executive Officer on a monthly basis and is responsible for updates to the Audit Committee regarding our cybersecurity posture and initiatives.


text: Our IT department includes staff members who hold certifications in security, networking, and systems administration. This team of qualified professionals works collaboratively to implement and maintain our comprehensive cybersecurity program. Their specialized expertise is supplemented by strategic partnerships with third -party security providers who hold additional industry-recognized certifications such as CISSP, CISM, CEH, and CompTIA Security+.


text: Managing incident response Providing regular reports to senior management and the Audit Committee In the event of a material cybersecurity incident, our SVP of IT is responsible for promptly reporting to the CEO and the Audit Committee. A special meeting of the Audit Committee or full Board may be convened as necessary to address significant cybersecurity matters.


text: Material Incidents As of December 31, 2024, we have not experienced any cybersecurity incidents that have materially affected our operations, business strategy, financial condition, or financial results. Our management has assessed known cybersecurity incidents for potential materiality and disclosure using formal documented processes.


text: While we have implemented extensive measures to fortify our defenses against cyber threats, it is important to acknowledge that the cybersecurity landscape is constantly evolving, with threat actors employing increasingly sophisticated tactics. Despite our best efforts, we cannot guarantee that our systems will be completely immune to cyber attacks. We remain vigilant in our efforts to protect our systems and data and continue to invest in our cybersecurity program to address emerging threats.


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board. Our cybersecurity policies, standards and practices follow recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We generally approach cybersecurity threats through a cross-functional, multilayered methodology, with specific the goals of: (i) identifying, preventing and mitigating cybersecurity threats to us; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our tenants, vendors and airport partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Sky Harbour Group Corp

ticker: SKYH


text: Risk Management and Strategy Consistent with overall ERM policies and practices, our cybersecurity program focuses on the following areas: we maintain cybersecurity threat operations with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response plans;


text: we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third -party systems;


text: we have established and maintain comprehensive incident response plans that fully outlines our response to, and recovery from a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are evaluated on an regular basis;


text: The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that our management implements to address risks from cybersecurity threats. The Board and the Audit Committee each participate in relevant discussions on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee will also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed, to the extent applicable.


text: Our Director of Information Technology is principally responsible for overseeing our cybersecurity risk management program, in partnership with other members of our management team. The Director of Information Technology works in coordination with the other members of our cybersecurity committee, which includes our Chief Financial Officer, Chief Accounting Officer and In-house Counsel. Our Director of Information Technology has served in various roles in information technology and information security for over 27 years. Our Director of Information Technology, in coordination with our cybersecurity committee, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Through the ongoing communications with our organization, the Director of Information Technology and the cybersecurity committee monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: Cybersecurity risk management, including our processes for assessing, identifying and managing material risks from cybersecurity threats, is an integral part of our overall enterprise risk management program.

companyName: FOOT LOCKER, INC.


text: Cybersecurity risk management and strategy We use information technology and third -party service providers to support our global business processes and activities, which exposes us to cybersecurity risks.


text: Key Program Components To help manage cybersecurity risk, the Company uses cybersecurity frameworks and standards as a guide, such as the National Institute of Standards and Technology's Cybersecurity Framework, International Organization of Standardization ISO/IEC 27002, and Payment Card Industry (PCI) Security Standards. We use, and continue to improve, our cyber defense-in-depth strategy, which uses multiple layers of security for holistic protection.


text: Our cybersecurity risk management program includes: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including third -party network security reviews, scans, and audits, on at least an annual basis;


text: data protection and cybersecurity training for employees with access to information systems, certain individuals with privileged access, such as system administrators and developers, are subject to additional controls and monitoring activities; periodic phishing campaigns to train our employees to better identify, report, and avoid malicious content; a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; a disaster recovery plan and controls designed to protect against business interruption, including by backing up our critical systems; a third -party risk management process for service providers, suppliers, and vendors who have access to our information systems.


text: Cybersecurity Governance The Board of Directors has risk oversight responsibility regarding risks that could affect the Company. Oversight for certain risks is administered through committees of the Board. The Audit Committee of the Board is responsible for oversight over our enterprise risk management framework. Cybersecurity risk is included in our enterprise risk management program.


text: The Technology and Digital Engagement Committee of the Board has primary responsibility for oversight of the Company's cybersecurity risk. This Committee receives regular briefings from our Chief Operations Officer, Chief Technology Officer, Chief Information Security Officer, and outside experts on cybersecurity risks and cyber risk oversight. During these meetings, the Technology and Digital Engagement Committee and management discuss cybersecurity risks, risk management activities and efforts, best practices, the effectiveness of our security measures, and other related matters. The Technology and Digital Engagement Committee Chair reports on the committee's meetings, considerations, and actions to the Board at the next Board meeting following each committee meeting. The Audit Committee also discusses and receives updates on cybersecurity matters in connection with its oversight of enterprise risk management.


text: We maintain a security incident response plan that is utilized when cybersecurity incidents are detected. We conduct periodic tabletop exercises, in which different internal and external stakeholders, including from time to time our CEO, Non-Executive Chair, or Board of Directors, participate in a simulated cyber scenario. The purpose of these exercises is to test our security incident response plan, identify weaknesses or gaps, and ensure that all participants are aware of, and familiar with, their roles and responsibilities.


text: Our Chief Information Security Officer, with oversight from the Chief Technology Officer and Chief Operations Officer, is primarily responsible for assessing and managing cybersecurity risks. Our Chief Information Security Officer has extensive cybersecurity knowledge and skills gained from over 25 years' experience in the field. He holds a Certified Information Systems Security Professional certification, issued by ISC, which is a globally recognized credential demonstrating expertise in information security and risk management. Our Chief Information Security Officer stays up to date on developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition also informs our program of prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Several experienced information security professionals report to our Chief Information Security Officer and he is supported by a team of trained cybersecurity team members. In addition to our in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: The Company regularly updates and assesses its information security strategy and responses for new and emerging threats. To date, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations or financial position. Notwithstanding the breadth of the Company's information security program, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse impact. Also see "Risks Related to Technology, Data Security, and Privacy" included as part of Item 1A. "Risk Factors," which is incorporated by reference herein.


text: Risk management and strategy We assess material risks from cyber security threats on an ongoing basis, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As our Company grows, we plan to develop a more robust and detailed strategy for cyber security in alignment with nationally accepted standards.

companyName: ZION OIL & GAS INC

ticker: ZNOG


text: The company has not experienced a cyber security incident or a cyber security threat during 2024 nor in any prior years. The company's overall risk management systems and processes have followed the recommended guidelines of our cyber security insurance company. The Audit Committee has the board's oversight of risk from cyber security threats and the responsibility for reviewing the management processes. Management's role in assessing and managing material risks from cyber security threats is the responsibility of the Chief Financial Officer, who reports and coordinates any potential material risk to the Audit Committee.


text: Cybersecurity incidents continue to become more prevalent requiring adequate and continuous assessment, identification, and management of material risks associated with cybersecurity threats. These risks include, among other things, disruption of our business processes and proprietary software, and potential unwanted disclosure of protected personal information which may cause harm to our employees, and clients, violations of privacy laws and regulations, breach of confidentiality and other contractual obligations, litigation and legal action, and financial and reputational harm. We utilize cybersecurity technologies and established procedures and processes to identify, assess, and manage these material cybersecurity risks.

companyName: HireQuest, Inc.

ticker: HQI


text: Ongoing Activities To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, we undertake the following activities: All corporate machines are protected by anti-virus software and enterprise network protection; We require two -factor authentication on all corporate machines; We require two -factor authentication for all corporate email accounts; We require all corporate employees to complete quarterly cybersecurity training provided by a third -party; Our CIO and other members of our technology team proactively monitor all potential risks and immediately respond to threats; Our data is backed up in multiple offline air-gapped devices; We test all backups quarterly; We monitor regulations to ensure our policies and procedures are up-to-date and compliant.


text: Third-Party Risk Management Our polices and processes address cybersecurity threat risks associated with the use of third -party service providers, including those who access, use and/or store our client, candidate, associate and employee data or have access to our network and systems. Third-party risks are included within our enterprise risk management assessment program, as well as our information security-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third -party service providers. We perform due diligence on third parties that have access to our systems, data or facilities that house such systems or data. This allows us to identify high-risk providers and continually monitor for cybersecurity threat risks appropriately. Additionally, we require contracts with all third parties that have access to our network and systems to include baseline security requirements for adequate data handling, as well as to provide the company with audit rights. Such contractual requirements are reviewed during each subsequent contract renewal process.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information from cybersecurity threats. Cadiz Inc.

companyName: CADIZ INC

ticker: CDZI


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; offsite backup storage of critical systems and information; the use of external service providers to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process to identify and mitigate risks from third parties, such as service providers, suppliers, and vendors.


text: We use third -party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers, threat intelligence service providers, dark web monitoring services, and other cybersecurity software providers.

companyName: BOSTON OMAHA Corp

ticker: BOC


text: We use third -party service providers to perform a variety of functions throughout our business, including but not limited to application providers, hosting companies, contract manufacturing organizations and contract research organizations. We have a vendor management program to oversee, identify and manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for vendors that may include, depending on the vendor and nature of services being performed, security questionnaires, review of the vendor's written security program, review of security assessments, audits and reports, vulnerability scans related to the vendor, security assessment calls with the vendor's security personnel, and the imposition of certain contractual obligations on the vendor, among other elements, in accordance with the processes outlined in our internal vendor selection, management, and oversight process policy and other internal guidelines. More specifically, the level of assessment may depend on the following: the nature of the services provided and the data the vendors may collect, retain, and utilize, the sensitivity of the Information Systems and Data at issue, and the identity of the provider. Our board of directors addresses our cybersecurity risk management as part of its general oversight function.


text: Commencing in 2024, our Audit and Risk Committee, on behalf of the board of directors, is overseeing our cybersecurity risk management program.


text: Vigilance: The Company uses a reputable third -party managed service provider ("MSP") for cybersecurity support, which has operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. The Company's MSP is staffed with several security personnel, many of which have Certified Information Systems Security Professional ("CISSP") certifications.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third -party systems.


text: The Company's Co-Chief Information Officers are the members of the Company's management principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Co-Chief Information Officers work in coordination with the other members of the IRT, which includes our Co-Chief Information Officers, our Chief Operating Officer, and their designees. The Company's Co-Chief Information Officers have each served in various roles in information technology and information security for over 30 years, including in leadership positions with both small and large companies. The Co-Chief Information Security Officers each have extensive knowledge in technology and cybersecurity. The Company's President and interim Chief Financial Officer, Chief Operating Officer, and Chief Compliance Officer each hold undergraduate, and, in some cases, graduate, degrees in their respective fields, and each have over 20 years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.


text: Our information security program is managed through a dynamic enterprise-wide cybersecurity strategy, policies, standards, architecture, and processes. The Bank relies upon a formalized internal Information and Cybersecurity Program (the "Program") to safeguard confidential information, maintain the confidentiality of our customers' data and to ensure the integrity of financial transactions. The Program is approved by the Bank's Board of Directors or a committee thereof annually, and is designed to identify reasonably foreseeable internal and external threats, assess the likelihood and potential damage these threats could cause, and assess the appropriateness of policies, standards and procedures used to identify and mitigate risks associated with a material cybersecurity incident. The Program has been designed to align with industry best practices, as well as regulatory guidelines and laws and leverages the National Institute of Standards and Technology Cybersecurity framework ("NIST CSF") as its baseline. We are dedicated to cybersecurity and maintaining the trust and confidence of our customers and stockholders.

companyName: Bogota Financial Corp.

ticker: BSBK


text: Additionally, we maintain an Incident Response Plan that provides established procedures for timely reporting and escalation of significant cybersecurity incidents. Our commitment involves promptly notifying regulatory authorities, customers, and other stakeholders in the event of any material cyber incidents that may impact our operations or the security of sensitive information. The Incident Response Plan is coordinated through the Vice President of Information Technology ("VP of IT") and key members of executive management who are responsible for escalation as part of the Plan.


text: We use a layered defense management approach to managing cybersecurity. The Bank's cybersecurity operations function is headed by the VP of IT who is responsible for managing information security risks by developing and implementing information security strategies, architecture, and procedures and acts as the first line of defense. The VP of IT oversees a team of internal and external security professionals in safeguarding our critical data, systems, and assets against threats, breaches, and attacks. The VP of IT is also responsible for ensuring the confidentiality, integrity, and availability of information assets.


text: The information security program, policies, and standards are managed by the Bank's Information Security Officer (the "ISO"), who leads the enterprise wide technology risk management function. The ISO acts as the second line of defense and provides risk oversight for the Bank's technology operating infrastructure and operations. The ISO manages testing of technology controls, technology risk assessments, risk reporting, information security third-party due diligence, monitoring the implementation of risk mitigation actions, and tracking their effectiveness over time. The Bank's internal auditors and Board of Directors act as the third line of defense, providing the independent assurance function. In addition to the above risk management framework, we engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third -party specialists. We also maintain a third -party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. Additionally, we actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections for any portion of our workforce that has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to opine on their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: As part of our governance structure, the Board of Directors, Chief Executive Officer and VP of IT play an active role in overseeing our cybersecurity program. Regular briefings on cyber risk management and incident response activities are conducted, ensuring a high level of governance and accountability in addressing cybersecurity concerns. The Bank and its vendors provide periodic reports to our Board of Directors, or committee thereof, as well as to our senior management team as appropriate. These reports include updates on the Bank's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: Cyber partners are also a key part of our cybersecurity infrastructure. We utilize third -party software to provide continuous monitoring of our infrastructure and to coordinate the investigation and remediation of alerts. A program for staging incident response drills is intended to prepare support teams in the event of a significant incident.

companyName: LIQTECH INTERNATIONAL INC

ticker: LIQT


text: The Chief Financial Officer, who is responsible for assessing and managing our cyber-risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The Chief Financial Officer has experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants.


text: The Audit Committee of the Board of Directors is responsible for overseeing cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Management briefs the Audit Committee on the effectiveness of our cyber risk management program. In addition, cybersecurity risks are reviewed by the Board of Directors, at least annually.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows, or reputation. We have experienced, and will continue to experience, cyber incidents in the normal course of our business, however, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors – Risks Relating to Our Business – We may have risks associated with security of our information technology systems".


text: The Company approaches cybersecurity as an enterprise-wide risk and uses external resources to assess risk and manage its IT and 24x7 cybersecurity operations, including managed service providers who assist in the support of key business systems. The Company may also periodically engage external consultants to assist with cybersecurity incident management, particularly where advanced or specialized expertise may be required. If a material cybersecurity breach occurs, the incident will be reviewed by management to determine whether further escalation is appropriate. The Executive Chairman of the Board and Chief Executive Officer and the Chief Financial Officer have primary responsibility for this review and assessment. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive team, and if deemed necessary or appropriate, the Board of Directors. The Board Audit Committee is responsible for reviewing and discussing the adequacy and effectiveness of the Company's information security policies and the procedures and controls regarding information systems. In addition, we plan to consult with outside counsel as appropriate, including on materiality analyses and disclosure matters, and to assist in making the final materiality determination regarding disclosure and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents as appropriate.

companyName: Catheter Precision, Inc.

ticker: VTAK


text: The Company maintains a cyber liability insurance policy that is designed to cover certain expenses, business losses, business interruption, and fines and penalties associated with a data breach or other similar incident. Cyber liability insurance also provides coverage in the event of a ransomware attack.


text: To date, the Company has not had a cybersecurity event that materially impacted or is reasonably likely to materially affect its business strategy, results of operations, financial condition, or the security of its proprietary data.


text: Our ISC has expertise in the following areas which assist in assessing and managing applicable cybersecurity risk: 27 years of IT experience including endpoint detection, security, incident management and response, vulnerability management and response, event management and response, and network security segmentation. The ISC provides regular reports on ongoing risk and mitigation practices, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company, to our Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, and General Counsel, who then report to the Audit Committee and the Board.

companyName: PULSE BIOSCIENCES, INC.

ticker: PLSE


text: Presidio Property Trust uses a cross-departmental approach to addressing cybersecurity risk, including input from senior management, employees, external consultants, and our Board of Directors (the "Board"). Senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner, including providing periodic training to staff and an annual third-party review of the Company's current posture to protect against threats. The Audit Committee of the Board of Directors oversees the steps taken by Presidio Property Trust's management to monitor and mitigate cybersecurity risks. Senior management briefs the Audit Committee and the Board of Directors on cybersecurity matters on at least an annual basis.

companyName: Presidio Property Trust, Inc.

ticker: SQFT


text: The Company operates almost exclusively in a Software-as-a-Service (SaaS) IT environment. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third -party service providers. The internal business owners of the hosted applications are required to document quarterly user access reviews and obtain a System and Organization Controls (SOC) 1 and/or SOC 2 report from our SaaS vendors. With assistance from an external consultant, management conducts an annual review of third -party SOC reports with a specific focus on their data protection procedures. If a third -party vendor is not able to provide a SOC report, management takes additional steps to assess their cybersecurity preparedness and assess our relationship with them on that basis. Our assessment of risks associated with the use of third -party providers is a significant part of the Company's overall cybersecurity risk management framework.


text: The Company has also engaged a third -party managed service provider to manage server, network, and email security, including continuous monitoring and industry-leading antivirus software. Presidio Property Trust has robust business continuity and disaster recovery procedures in place, and an insurance policy that provides for network security liability, event response and recovery, direct business interruption, contingent business interruption, cyber extortion, social engineering, and computer fraud should an incident occur.


text: In addition, we have Company-wide policies and procedures concerning cybersecurity matters, including access security, system change management, development lifecycle, incident management and business continuity/disaster recovery policies. These policies go through an annual internal review process and are approved by appropriate members of management. Presidio Property Trust uses a third -party consultant to assess the Company's compliance with Sarbanes Oxley requirements.


text: Ongoing monitoring and evaluation of our cybersecurity posture and performance through regular vulnerability scans, simulated phishing tests, and penetration tests; Oversight of third -party service providers by conducting vendor due diligence upon onboarding and ongoing monitoring;

companyName: FutureFuel Corp.

ticker: FF


text: An incident response plan designed to coordinate the activities that we and our third -party security service providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate incidents, as well as to comply with applicable legal obligations and mitigate any reputational damage;


text: Our information security procedures are overseen by our Vice President of Risk Management, supported by our Chief Technology Officer and our IT Manager, who are responsible to provide regular reports to our Interim President and Chief Executive Officer and Chief Financial Officer as well as the Technology and Social Responsibility Committee and the Governance Committee of our Board. These procedures are responsible for identifying, assessing, and managing cybersecurity threats and risks and work to monitor and evaluate our threat environment and risk profile using various methods. These methods include evaluating our and our industry's risk profile, coordinating with law enforcement concerning select threats, and engaging with third parties to conduct external audits and threat assessments for certain systems.

companyName: Rekor Systems, Inc.

ticker: REKR


text: Our Information Security Policy and procedures are reviewed on an ongoing basis. These procedures are implemented by our Vice President of Risk Management, assisted by a managed service provider ("MSP"). Our MSP has over 15 years of experience and possesses various cybersecurity certifications. Third-party service providers can assist us from time to time in identifying, assessing, and managing material risks from cybersecurity threats, including for example cybersecurity consultants and software providers, managed cybersecurity service providers, threat intelligence service providers, forensic investigators, penetration testing firms, dark web monitoring services, and professional services firms, including legal counsel and auditors. By partnering with these specialized providers, we can leverage their insights and expertise to implement cybersecurity strategies and processes that are designed to align with industry best practices.


text: Our senior management evaluates material risks from cybersecurity threats against our overall business objectives and this evaluation and the management of material risks from cybersecurity threats is integrated into our overall risk management processes. This integration is designed to ensure that cybersecurity considerations are part of our decision-making processes.


text: See Risk Factors in this Annual Report on Form 10 -K for a description of the risks from cybersecurity threats that may materially affect us and how they may do so.


text: We have made cybersecurity and the protection of our customers' data a top priority. The critical areas that we consider for our evolving cybersecurity program include access control; data encryption; SSDLC/change management; BCP/DRP; endpoint security; patch management; vulnerability assessments; compliance management; data privacy; incident response; monitoring, alerting, and logging; employee training (ingrained in our onboarding process, and mandatory online and in person training annually); and cyber insurance (coverage areas include ransomware, and business interruption which are critical to our clients and availability of business operations).

companyName: Fluent, Inc.

ticker: FLNT


text: Risk Management & Strategy Our cyber risk management program is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. To help protect our company from a major cybersecurity incident that could have a material impact on operations or our financial results, we have implemented policies, procedures, programs and controls, including investments in technology that focus on cybersecurity incident prevention, identification and mitigation. These investments include best practice applications such as CrowdStrike, Okta, Intune and Kandji. These tools also strengthen our overall IT posture as well as our monitoring and alerting and patching processes. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the continuous monitoring such as National Institute of Standards and Technology ("NIST"). We execute an NIST 800-53 review annually and use the results of existing cyber risks to prioritize projects designed to address these gaps and create a go-forward strategy. Our internal and external auditors review our IT and cybersecurity controls annually for design and operating effectiveness.


text: Our Cybersecurity Program is governed by the Company's IT, Legal, and Compliance teams. Our Chief Technology Officer ("CTO") has over 20 years of experience in marketing technology and analytics. Our Vice President of IT Governance, Risk and Compliance ("VP of IT") has over 20 years of experience in IT internal and external audits, IT consulting, and governance, risk, and compliance. Our General Counsel regularly coordinates with the IT team on data security and compliance issues. The CTO and General Counsel report directly to the Chief Executive Officer ("CEO"), so any material issues are raised to the CEO, and a status update of key cybersecurity projects and any material breaches is provided quarterly to the Board's Audit Committee, which includes both an internal and external audit.


text: Incident Disclosure and Materiality Our incident management procedures include identification, evaluation, definition, and escalation based on the determination of materiality. This determination involves the Company's IT, Legal, and Compliance teams, executive officers, and cyber insurance provider. Breach notifications and escalation to the Audit Committee would also be based on the materiality determination. The collaboration among IT, Legal, and Compliance helps ensure and prevent gaps with laws and regulations. Each quarter, the VP of IT provides an update on key cybersecurity projects and any material breaches at the quarterly Audit Committee meeting, at which both the internal and external auditors are present.


text: While we did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition. See Item 1A. "Risk Factors" for more information on our cybersecurity-related risks.


text: Our management team is responsible for assessing and managing the material risks from cybersecurity threats and our Interim Chief Financial Officer leads these efforts on behalf of the management team. Our management team members have expertise in information systems, compliance and corporate governance, which we believe are disciplines that are effective in the management of the Company's cybersecurity risk. Our Interim Chief Financial Officer is well-informed on emerging cybersecurity risks and solutions used to mitigate and remediate loss due to cybersecurity incidents and is responsible for our internal cybersecurity programs and oversight of third-party cybersecurity vendors who monitor and execute on the prevention, detection, and mitigation of cybersecurity threats and incidents.

companyName: AVENUE THERAPEUTICS, INC.

ticker: ATXI


text: Risk Management and Strategy As of December 31, 2024, we have implemented a set of cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities. Our employees have received cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. Important security measures such as multifactor authentication, firewalls, Endpoint Detection and Response (EDR), encryption, etc. have been implemented. We continue to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Currently we are in the process of expanding our risk management procedure to include a broader cybersecurity risk management process. The updated risk management process will include annual review by our board of directors.

companyName: Allarity Therapeutics, Inc.

ticker: ALLR


text: Our board of directors are currently implementing as oversight procedure for IT governance and cyber security risk management. It is expected that IT governance and cybersecurity will be included in the company's quarterly management review meetings under the supervision of our senior leadership, including our Chief Executive Officer and Chief Financial Officer, with regularly meets with and provides periodic briefings to our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Cybersecurity Threat Disclosure To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. For further discussion of cybersecurity risks, please see Item 1A, "Risk Factors."


text: Risk management and strategy With the assistance of our IT vendor, we established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an information technology ("IT") consultant who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process. Our Board of Directors provides oversight to our cybersecurity efforts to ensure effective governance in managing risks associated with cybersecurity threats. Our CFO provides periodic updates to the Board of Directors regarding our cybersecurity program, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company.

companyName: Harvard Apparatus Regenerative Technology, Inc.

ticker: HRGN


text: Following these risk assessments, responses may include re-design, implementation, and maintenance of reasonable safeguards to minimize identified risks and address any identified gaps in existing safeguards and regularly monitoring of the effectiveness of our safeguards.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to " Cyber-attacks or other failures in telecommunications or information technology systems and deficiency in our, or those of third parties upon which we rely, cybersecurity could result in information theft, data corruption and significant disruption of our business operations. " under Item 1A, "Risk Factors," in this annual report on Form 10 -K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our full board of directors directly administers its cybersecurity risk oversight function and our audit committee provides additional oversight of maintaining and monitoring cybersecurity risks.


text: Our Chief Financial Officer is primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third -party service providers.


text: We utilize a range of internal and external resources to assess and identify cybersecurity threats and vulnerabilities. We access and utilize information drawn from a variety of publications, reports and services to assess our cybersecurity risk profile, develop awareness of emerging cybersecurity threats and threat actors and identify risk factors that are particularly relevant to the biotechnology and pharmaceutical sector and to our company. We also work with third parties that assist us to identify, assess and manage cybersecurity risks, including external auditors, consulting firms, managed security service providers and penetration testing firms.

companyName: OMEROS CORP

ticker: OMER


text: Our Corporate Counsel has 20 years of experience in information technology, including cybersecurity, audit, compliance, and cybersecurity. In addition, we have an Enterprise IT Operations Engineer ("Ops Engineer") with requisite knowledge and experience in information technology and cybersecurity, and maintains IT and Ops professional certifications.

companyName: Super League Enterprise, Inc.

ticker: SLE


text: The Ops Engineer may call upon other business and legal stakeholders across our company to help manage cybersecurity threats and incidents. Our Audit Committee is responsible for oversight of our programs, policies, procedures, and risk management activities related to information security and data protection. The Audit Committee meets periodically with our Corporate Counsel and executive management to discuss threats, risks, and ongoing efforts to enhance cyber resiliency, as well as changes to the broader cybersecurity landscape. Our Board periodically participates in presentations on cybersecurity and information technology from internal leadership. In addition to periodic presentations, management promptly updates our Board and Audit Committee regarding significant threats and incidents as they arise.


text: Risk Management and Strategy As part of our overall Enterprise Risk Management strategy, we maintain a robust Information Technology and Security Management Program ("ITSM"), which includes processes to assess, identify, monitor and manage cybersecurity risks. The program includes provisions for annual cybersecurity risk assessments, ongoing monitoring and testing, as well as annual training for employees, executives, and Board Members. We use the Federal Financial Institutions Examination Council's ("FFIEC") cybersecurity assessment tool to identify risks and ascertain cybersecurity preparedness and the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework to benchmark our internal policies and procedures against best practices. We engage consultants and auditors to assist in the completion of our annual risk assessment and review of controls related to the ITSM.

companyName: Provident Bancorp, Inc. /MD/


text: The Company also maintains a robust Vendor Risk Management program to manage risks related to third -party relationships in a manner that is consistent with the Company's strategic goals, organizational objectives, and risk appetite. This includes comprehensive risk and control assessments with respect to the appropriate safeguarding of sensitive information.


text: We maintain cybersecurity insurance coverage to mitigate potential financial impacts from cyber incidents, such as data breaches and system disruptions. However, such insurance may not cover all types of damages, and we cannot guarantee that our coverage will be sufficient to fully protect us from the financial consequences of a cyberattack.


text: To date, there have been no cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, the Bank, our business strategy, results of operations, or financial condition.


text: The Board of Directors is responsible for overseeing the development, approval, implementation and maintenance of the ITSM, including overseeing the program's execution in accordance with the overall strategic goals of the Bank. The Board conducts oversight, in part, through the use of committees. The Risk Management Committee ("RMC") of the Board of Directors is charged with monitoring and reviewing risk assessments, assurance, testing, and training as well as overseeing the correction of identified deficiencies as they relate to the ITSM. The Company's Information Security Team is comprised of the information security officer ("ISO") and a cyber-risk analyst. With input from the Information Technology and Risk departments, the Information Security Team is responsible for incident management, disaster recovery, business continuity and cybersecurity programs and policies. The Bank's Incident Response Manual and Cyber Incident Policy outline how potential cybersecurity threats or incidents are communicated to the RMC. The RMC is responsible for determining if cybersecurity incidents or threats should be escalated to the Board of Directors. The Information Security Team and the RMC work together to mitigate cybersecurity threats or incidents.


text: The ISO is responsible for cybersecurity under the ITSM and holds a Certified Information Security Manager certification and was a former Chief Information Security Officer ("CISO") for the United States segment of a multi-national bank. The ISO reports directly to the Executive Vice President, Chief Risk Officer of the Bank who is a member of the executive team. The Chief Operating Officer, who is a member of the executive team, is a former CISO and holds both a Certified Fraud Examiner and Certified Information Security Manager certification. The Chair of the RMC of the Board also has multiple certifications in information and cybersecurity, including a Certified Information Systems Security Professional certification.


text: In the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program, which is comprised of a wide array of policies, standards, architecture, and processes. The cyber risk management program falls under the responsibility of our Chief Financial Officer, who has more than 15 years of experience, including cross-functional expertise in business operations and technology strategy. Under the guidance of our Chief Financial Officer, we develop, maintain, and evidence the policies, standards, and processes in a manner consistent with applicable legal requirements. We also utilize a variety of cybersecurity software from reputable vendors in cybersecurity.

companyName: Genprex, Inc.

ticker: GNPX


text: For further information regarding cybersecurity risks, please refer to "Risk Factors – Risks Related to Development and Commercialization of Our Current and Future Product Candidates" and other risks described in the "Risk Factors" section of this Annual Report on Form 10 -K.


text: Securing the Company's IT systems is integral and foundational to its everyday operations. The Company's Security Steering Committee is comprised of cross-functional executive management team members that collectively possess a high level of cybersecurity and technology operations expertise. The mission of our Security Steering Committee is to focus on defining and deploying its information security strategy, sustaining a robust employee cybersecurity awareness and training program, executing security engineering, providing continuous monitoring of the Company's information security strategy, responding and coordinating the response and investigation of cyber threats, building and testing its disaster recovery plans in support of its businesses' continuity plan requirements, and developing its cyber and information security policies.

companyName: ULTRALIFE CORP

ticker: ULBI


text: The Company utilizes third-party service providers to perform a variety of functions to assist in operating its business. The cybersecurity risks associated with the use of certain providers are covered under a vendor management process. Depending on the nature of the services provided and the sensitivity and/or quantity of information processed, the vendor management process may include reviewing cybersecurity practices of these providers, contractually imposing obligations on the provider, inspecting independently audited reports, and/or conducting its own security assessments of their services.


text: Notwithstanding the focus and emphasis on cybersecurity, the Company has experienced and will continue to experience cybersecurity incidents, and there can be no guarantee that future incidents will not have a material adverse effect on its business. See Risk Factor " Breaches in security, whether cyber or physical, and related disruptions and/or our inability to prevent or respond to such breaches, has previously, and in the future could diminish our ability to generate revenues or contain costs, compromise our assets, and negatively impact our business in other ways " for more information on the Company's cybersecurity risks.


text: We depend on information technology and systems for various operations (including refinery processes and refined product loading) and for capturing accounting, technical, and regulatory data for reporting, analysis, and archiving. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. As of the filing date of this report, our risk monitoring process related to cybersecurity includes conducting periodic vulnerability assessments using a combination of internal and third-party capabilities to perform technical assessments, vulnerability scanning, and incident and event monitoring. We are working to: (i) identify and assess threats and (ii) establish a thorough, risk-based cybersecurity program, including the potential adoption of a formal cybersecurity policy if deemed necessary by the Board, aimed at safeguarding our data, along with the data of our customers and partners. We anticipate that such a program will follow well-organized cybersecurity frameworks and be managed by a central control figure with Board oversight.

companyName: BLUE DOLPHIN ENERGY CO

ticker: BDCO


text: We did not experience a significant cybersecurity breach or associated expenses, penalties, or settlements for the twelve months ended December 31, 2024 and 2023.


text: The Company will designate a Chief Information Security Officer (the "CISO"). The Program will be implemented and managed by the Company's executive management under the leadership of the CISO. The Company will contract with third-party service providers to support aspects of the Program implementation, operations, and review of information technology operations and cybersecurity technologies.

companyName: Elite Health Systems Inc.

ticker: EHSI


text: Managing Material Risks and Integrated Overall Risk Management We have integrated cybersecurity risk management into our risk management processes. This integration is intended to ensure that cybersecurity considerations are part of our decision-making processes. We continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: FIREFLY NEUROSCIENCE, INC.

ticker: AIFF


text: Engaging Third Parties on Risk Management We engage a range of external experts, including consultants, auditors, and cybersecurity assessors, who assist us in evaluating and testing our cybersecurity systems and processes. These partnerships are intended to give us access to specialized knowledge and insights that can inform our cybersecurity strategies and processes, including as to industry-standard control frameworks and applicable regulations, laws, and standards.


text: Overseeing Third-Party Risk As part of our evolving cybersecurity roadmap, we plan to implement and conduct security assessments of all third -party service providers before engagement and maintain ongoing monitoring to ensure compliance with relevant cybersecurity standards.


text: Risks from Cybersecurity Threats We have not experienced any material cybersecurity incidents. As a result, we do not believe that risks from cybersecurity threats, have materially affected us, our results of operations and financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to us, including potentially to our results of operations and financial condition. See also "Risk Factors — Failure to protect our information technology infrastructure against cyber-based attacks, network security breaches, service interruptions, or data corruption could significantly disrupt our operations and adversely affect our business strategy and operating results." As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we may expend greater resources to continue to modify and enhance protective measures against such security risks Governance Board of Directors Oversight Our board of directors oversees the management of risks associated with cybersecurity threats.


text: Management ' s Role Managing Risk The Company's management is primarily responsible for assessing, monitoring and managing our cybersecurity risks. Management must ensure that all industry standard cybersecurity measures are functioning as required to prevent or detect cybersecurity threats and related risks. Management oversees and tests our compliance with standards, remediates known risks, and leads our employee training program.


text: Monitoring Cybersecurity Incidents The Company's management is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Management implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of industry-standard security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, management will implement an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: The Company's NIDSP Guidelines and policies apply not only to the Company's employees and consultants but also to any third parties that access or utilize the Company's information and systems. Such third parties may include the Company's service providers, customers, suppliers, contractors, consultants, and any other individuals the Company conducts business with. The IT infrastructure that the Company has developed in accordance with the NIDSP Guidelines is designed to monitor both internal and external cybersecurity risks. The NIDSP Guidelines equip the Company with the tools and systems necessary to recognize, address, and protect against risks associated with its third -party interactions.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: Risk Management and Strategy We have implemented an enterprise-wide information security program designed to identify, protect, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our primary objectives are to safeguard information assets, prevent their misuse or loss, and minimize business disruptions, through a comprehensive cybersecurity program intended to detect, analyze, contain and address cybersecurity risk exposures, threats and incidents. Our program utilizes various security tools to safeguard our information systems, aiding in prevention, identification, escalation, investigation, resolution, and recovery from vulnerabilities and security incidents. Examples of such security tools include internal reporting systems, monitoring and detection tools, third-party penetration testing and security assessments and a bug bounty program engaging security researchers. In addition, we have adopted a comprehensive incident response plan and process for detecting, mitigating, and investigating cybersecurity incidents, which employees, under the leadership of the Company's Chief Information Security Officer ("CISO"), regularly test through table-top exercises, testing of our security protocols through additional techniques such as penetration testing, debriefing after security incidents to improve our security and responses, and regular briefing to our directors and officers on our cybersecurity risks and preparedness.

companyName: Skillsoft Corp.

ticker: SKIL


text: Our Board has oversight of our strategic and business risk management, including cybersecurity risk management, with support from our Audit Committee as described under "Governance" below. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Our global information security program is led by our CISO, who brings over 20 years of industry experience.


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. Despite our continuing efforts, however, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive, or business harm or damage to our Company, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "We are regularly subject to cybersecurity and other similar attacks. If our security measures are breached or unauthorized access to customer data is otherwise obtained, our platforms may be perceived as insecure, we may lose existing customers or fail to attract new customers, our reputation may be harmed, and we may incur significant liabilities."


text: The Audit Committee is responsible for evaluating the Company's major financial risk exposures and the steps management has taken to monitor and control such exposures. The Audit Committee's charter also requires it to discuss guidelines, policies and steps to govern the process by which risk assessment and management is undertaken (including risks related to information security, cybersecurity and data protection) and the establishment and management of appropriate systems to manage such risks. The Audit Committee reviews cybersecurity risks through quarterly reports from the CISO, and monitors the status of existing information security controls and practices to mitigate the potential risk from evolving cybersecurity threats. Regular reports on cybersecurity threats, assessments, and findings are also provided by the CISO to senior management and relevant teams.


text: Our team is informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third -party security software and technology services. In addition, we use third -party security solutions, monitoring, and alerting tools and resources, designed to monitor, identify, and address risks from cybersecurity threats. We also have implemented processes and technologies for network monitoring and data loss prevention procedures, and from time to time review such processes and technologies.

companyName: MILESTONE SCIENTIFIC INC.

ticker: MLSS


text: Disclosure of Risk Management, Strategy, and Governance Regarding Cybersecurity Risks Our Board of Directors engages in regular discussions to address our Company's principal risks, including those related to cybersecurity, ensuring comprehensive management and oversight. In alignment with this commitment, our cybersecurity leadership, comprising the Chief Operating Officer, DevOps Resource Manager of Security, Senior Systems Architect, DevOps Engineer, and Senior Technical Project Manager, forms a core committee dedicated to the review and strategic planning of our cybersecurity initiatives. This team's collaborative efforts are instrumental in steering our Company's approach to identifying, evaluating, and mitigating cybersecurity risks.

companyName: PAID INC

ticker: PAYD


text: We employ a suite of tools and services that support the continuous surveillance and reduction of cyber risks. Our internal teams undertake regular audits and penetration testing throughout the year. External third -party experts are enlisted annually to assess our cybersecurity maturity and conduct risk evaluations, besides offering specialized knowledge on various cybersecurity matters. Our security operations center operates 24/7 to identify, lessen, and react to cyber threats promptly. Defined protocols are in place to manage and mitigate any detected cybersecurity incidents swiftly, with regular reviews of our policies and procedures to ensure compliance with evolving regulatory standards and the dynamic threat landscape.

companyName: BUILD-A-BEAR WORKSHOP INC

ticker: BBW


text: We evaluate cybersecurity risks as part of our overall enterprise risk management. A steering committee of senior executives meets quarterly to evaluate any changes to the Company's exposure to cybersecurity risks, discuss potential mitigation plans, and provide updates on mitigation efforts already underway. Our cybersecurity team keeps up to date on the latest threats and risks through multiple channels and is also involved in evaluating risks associated with any new proposed service providers. We employ a Cybersecurity Engineer, reporting directly to our Chief Technology Officer, who manages our cybersecurity team that is comprised entirely of security professionals with industry recognized certifications. The cybersecurity team within BIO-key is responsible for assessing and managing risks associated with both our internal operations and our use of third-party service providers and informing/gaining feedback from the cybersecurity steering committee.

companyName: BIO KEY INTERNATIONAL INC

ticker: BKYI


text: Additionally, our cybersecurity team maintains a comprehensive set of cybersecurity policies and standards, including a security incident response framework. The framework is a set of coordinated procedures and tasks that our incident response team executes to ensure timely and accurate reporting and resolution of computer security incidents. The framework details who, how and when appropriate persons or committees, including the Board of Directors and Audit Committee are kept informed on the status of potential cybersecurity incidents. A summary of recent incidents is also presented by the Chief Law Officer ("CLO") at each regular Audit Committee meeting. Our policies and standards were developed in collaboration with a wide range of disciplines, including information technology, cybersecurity, legal, compliance and business. Our cybersecurity strategy and policies are continually reassessed to ensure they attempt to identify and proactively address the constant changes in the global threats. Decision makers such as the CLO, executive team, and Audit Committee are regularly kept up to date on cybersecurity trends. Ongoing collaboration with stakeholders throughout the business also helps to build continued awareness and visibility of future needs.


text: Also, as part of our cybersecurity program, we partner with a third -party information technology firm to support and evaluate our cybersecurity and informational security program. This third -party service includes product and software security for data protection and cyber defense, to monitor, detect, prevent, and protect our Company against potential cybersecurity threats.

companyName: MIND TECHNOLOGY, INC

ticker: MIND


text: Risk Management and Strategy The Company's policies and practices are based on frameworks and standards that address risks through a comprehensive, cross-functional approach that assess, identify, monitor, and mitigate material risks from cybersecurity threats as part of the overall enterprise risk management ("ERM") process. This includes the collection and storage of data and being responsive to incidents as they occur. Further, the Company's processes and technology are utilized to develop, implement, and maintain appropriate measures to safeguard information systems in protecting the integrity, availability, and confidentiality of data. Additionally, the Company engages certain third parties to assist in network monitoring and control testing, among other functions of similar capacity.

companyName: Perma-Pipe International Holdings, Inc.

ticker: PPIH


text: Technological safeguards that are designed to protect the Company's information systems from cybersecurity threats, including the prevention and detection of system applications, access controls, and firewalls, which the Company assesses the vulnerability and severity of potential cybersecurity threats and makes necessary improvements. Utilization of third parties as part of the Company's risk-based approach in identifying and overseeing cybersecurity risks.


text: The Audit Committee of the Board of Directors has the responsibility of overseeing the Company's cybersecurity risks. The Director of Information Technology provides periodic updates to the Board of Directors regarding actions taken to mitigate the Company's exposure and protection from cybersecurity risks. Management routinely evaluates the Company's security processes, procedures, and systems to determine if enhancements are needed to reduce the possibility of a future cybersecurity event. This includes safeguards implemented by the Company, such as a multi-factor authentication process; restricted firewall settings; network monitoring, email phishing tests, and enhancing the Company's backup recovery strategy, among others.


text: The Director of Information Technology, along with members of management, inform the Audit Committee on cybersecurity risks by providing periodic updates regarding (i) Status of ongoing cybersecurity initiatives and strategies, (ii) The overall state of the Company's security program and potential exposure to risks, and (iii) Incident reports and learning from any cybersecurity events. Further, the Director of Information Technology maintains an open dialogue regarding any significant developments in cybersecurity risks, ensuring the Audit Committee's oversight is proactive and responsive. In addition to periodic updates to the Audit Committee, the Director of Information Technology, in his capacity, regularly informs the Chief Executive Officer ("CEO") and the Chief Financial Officer ("CFO") regarding matters related to cybersecurity risks and incidents. This ensures the highest level of management are informed of potential risks associated with cybersecurity that could have a material and adverse effect on the Company.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property.

companyName: STREAMLINE HEALTH SOLUTIONS INC.