text: Although the risks from cyber threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future and we continue to closely monitor cyber risk. For a detailed description of the risks related to cybersecurity, see Item 1A. "Risk Factors." of this Annual Report, which should be read in conjunction with this Item 1C.


text: Board Governance and Management The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership manages our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The corporate information security function is responsible for managing and continually enhancing our information security posture and information security infrastructure with the ultimate goal of preventing cybersecurity incidents and reducing their severity to the extent feasible, while simultaneously increasing our resilience in an effort to minimize the business impact should an incident occur.

companyName: TUCOWS INC /PA/

ticker: TCX

secItem: Item 1C


text: Senior leadership, including our CEO, who also has relevant experience in cybersecurity matters, regularly brief the Board of Directors on our cybersecurity and information security initiatives, and the Board of Directors is apprised of cybersecurity incidents deemed to have a material business impact.


text: Risk Management Strategy We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: Our cybersecurity risk management program includes: physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and customer, employee, bank partner and other third -party information stored on those systems, such as access controls, encryption, data handling requirements and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices;


text: the use of external consultants or other third -party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls;


text: annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information, such as consumer information; and a third -party risk management process that includes internal vetting of certain third -party vendors and service providers with whom we may share data and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third -party vendor or service provider or otherwise implicating the third -party technology and systems used.


text: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, results of operations or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, refer to Part I, Item 1A "Risk Factors."


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis, and supervises both our internal cybersecurity personnel and the relationship with our retained external cybersecurity consultants. Our Chief Information Officer's experience includes over 10 years of working in the cybersecurity field in various industries, including the financial services industry.


text: Management ' s Role Holley's information technology team, which is responsible for developing and implementing our cybersecurity program, currently operates under the oversight of our Chief Information Officer ("CIO"). The CIO is generally responsible for managing risks from cybersecurity threats, as well as overseeing the safeguarding and fortification of our networks and systems. The CIO reports directly to the Chief Financial Officer ("CFO"). Combined the two have a proven track record in developing and leading data science teams. The CFO's expertise in business, finance and technology enables him to guide the team in making strategic information technology investments that strike a balance between growth opportunities, risk mitigation and return on investment. The information technology team is comprised of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, penetration testing processes and methodologies, and risk communication and reporting. Our Chief Information Officer ("CIO") is overseeing our cybersecurity program and is responsible for the management and oversight of Holley's cybersecurity program.

companyName: Holley Inc.

ticker: HLLY


text: Technical Safeguards and Continuous Monitoring As part of our cybersecurity program, we regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. We utilize data analytics to detect anomalies and search for cyber threats. Our cybersecurity processes include a continuous monitoring system which supports comprehensive cyber threat detection and response capabilities and complements the technology, processes and threat detection techniques we use to monitor, manage and mitigate cybersecurity threats. Cyber partners are a key part of Holley's cybersecurity infrastructure. We partner with leading cybersecurity companies, leveraging third -party technology and expertise. We engage with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in our environment.


text: Training and Awareness We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access participate annually in required training, including privacy and security training designed to enhance employee awareness of how to detect and respond to cybersecurity threats. We have created an Incident Response Plan that provides our support team with a clear framework for effectively responding to significant incidents.


text: W e have not identified risks from cybersecurity threats that have materially affected us, including our financial position, results of operations, cash flows, or reputation, although certain risks, if realized, are reasonably likely to materially affect us. For more information regarding the risks we face from cybersecurity threats and how those risks could affect us, please see Item 1A. "Risk Factors. "


text: Risk Management and Strategy. The Company relies extensively on various information systems and other electronic resources to operate its business. In addition, nearly all of the Company's customers, service providers and other business partners on whom the Company depends, including the providers of the Company's online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including by employees, customers and other individuals who are authorized to use them, and bad actors using sophisticated and constantly evolving set of software, tools and strategies to do so. The nature of the Company's business, as a financial services provider, and the Company's relative size, make the Company and its business partners high-value targets for these bad actors to pursue. See Item 1A. Risk Factors—Operational, Strategic and Reputational Risks of this Form 10-K for additional information.

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: Accordingly, the Company has devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, as noted below:


text: Identifying and assessing cybersecurity threats: The Company regularly evaluates its systems and data for potential vulnerabilities and analyzes the evolving cyber threat landscape, to ensure it proactively addresses risks before they materialize. The Company employs monitoring tools that can detect and help respond to cybersecurity threats in real-time.


text: Integration with Overall Risk Management: Cybersecurity risks are seamlessly integrated into the Company's broader risk management framework, ensuring a holistic view and prioritized mitigation strategies.


text: Management of Third-Party Risk: The Company's comprehensive third -party management process includes rigorous due diligence, oversight and identification of cybersecurity risks associated with vendors and service providers.


text: Team: The Company has an internal cybersecurity team that is responsible for conducting regular assessments of its information systems, existing controls, vulnerabilities and potential improvements.


text: Engagement of Expert Assistance: The Company leverages the expertise of independent consultants, legal advisors, and audit firms to evaluate the effectiveness of our risk management systems and address potential cybersecurity incidents efficiently. Training: The Company conducts periodic cybersecurity training for its workforce.


text: This information security program is a key part of the Company's overall risk management system, which is administered by the Director of Information Security. The program includes administrative, technical and physical safeguards to help protect the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of the Company's businesses and geographic locations.


text: From time-to-time, the Company has identified cybersecurity threats and cybersecurity incidents that require the Company to make changes to its processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected the Company, it is possible that threats and incidents the Company identifies in the future could have a material adverse effect on its business strategy, results of operations and financial condition.


text: Governance. The Company's management team is responsible for the day-to-day management of cybersecurity risks it faces, including the Company's Executive Vice President and Chief Operating Officer and Director of Information Security. The Company's current Director of Information Security has over 29 years of experience. For the past 8 years, the Company's Director of Information Security has successfully managed teams, implementing and maintaining robust cybersecurity and data protection controls to safeguard the Company's information assets. The Company's Director of Information Security reports directly to our Executive Vice President and Chief Operating Officer, who possesses extensive expertise gained through over 30 years in various risk, operations and leadership roles. This combined experience ensures exceptional guidance and oversight of our cybersecurity program.


text: In addition, the Board, both as a whole and through its Risk Committee (the "Risk Committee"), is responsible for the oversight of risk management, including cybersecurity risks. In that role, the Board and the Risk Committee, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, both the Board and the Risk Committee receive quarterly reports from the Company's management team regarding cybersecurity risks and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents.


text: The Company's Board of Directors has ultimate oversight of cybersecurity-related risks and it is assisted in this role by the Technology Committee and the Audit & Risk Committee. Processes for identifying, assessing, and managing cybersecurity-related risks are integrated into the Company's overall enterprise risk management process, which is overseen by the Audit & Risk Committee. The Audit & Risk Committee is responsible for monitoring risks that are being taken by the Company, understanding the enterprise-wide effect of those risks and reporting such risks to the Board. In fulfilling this role, the Technology Committee has primary oversight responsibility over management's efforts to manage and mitigate cybersecurity-related risk and reviews and approves the Company's cybersecurity strategy for protecting the Company's information assets and technology platforms. The Audit & Risk Committee oversees the Company's outsourced Internal Audit Department, which conducts reviews and assessments related to information security. Management provides periodic reports to the Technology Committee and the Audit & Risk Committee, both of which provide reports of their meetings to the full Board. These reports to the Board and its Committees address the threat environment, vulnerability assessments, specific cyber incidents and management's efforts to monitor, detect and prevent cyber threats.

companyName: MainStreet Bancshares, Inc.

ticker: MNSB


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use their own electronic information systems. Any of these systems can be compromised, including by employees, customers and other individuals who are authorized to use them, and bad actors using sophisticated and a constantly evolving set of software, tools and strategies to do so. The nature of our business, as a financial-services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. See "Risks Related to Information Security and Business Interruption" section of the Risk Factors included in Item 1A of this 2024 Form 10-K for additional information. Implementing an Information Security Program that establishes policies and procedures for security operations and governance;

companyName: SECURITY FEDERAL CORP

ticker: SFDL


text: Establishing an Information Technology Steering Committee that is responsible for security administration, including conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; Implementing layers of controls and not allowing excessive reliance on any single control; Employing a variety of preventative and detective tools designed to monitor, block and provide alerts regarding suspicious activity; Continuously evaluating tools that can detect and help respond to cybersecurity threats in real-time; Leveraging people, processes and technology to manage and maintain cybersecurity controls; Maintaining a third party risk management program designed to identify, assess and manage risks associated with external service providers; Performing due diligence with respect to our third -party service providers, including their cybersecurity practices;


text: Engaging third -party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; and Conducting periodic cybersecurity training for our employees and the Company's Board.


text: From time-to-time, we have identified cybersecurity threats that require us to make changes to our processes and to implement additional safeguards. While we have not experienced cybersecurity incidents that have materially affected our business, operations, or financial condition to date, we recognize that evolving cyber threats present a continuing risk. A successful cybersecurity breach, particularly one affecting our critical systems or third-party service providers, could result in operational disruptions, financial losses, reputational damage, legal or regulatory consequences, and loss of customer confidence. For example, unauthorized access to our systems could lead to data theft, fraud, or extended downtime impacting our ability to provide financial services. If such an event were to occur, it could have a material adverse effect on our results of operations and financial condition.


text: As part of the Company's approach to cyber risk management, the Company performs internal audits of internal processes and controls relating to cybersecurity. Every year, the Company engages third -party experts to conduct cyber penetration testing. Based on their findings and recommendations, the Company makes the appropriate updates to its cybersecurity software.

companyName: NATIONAL PRESTO INDUSTRIES INC

ticker: NPK


text: Although the Company has designed its cybersecurity program and oversight to mitigate cybersecurity risks, the Company faces unknown cybersecurity risks, threats, and attacks. On March 1, 2025, the Company experienced a system outage caused by a cybersecurity incident. Upon discovery, the Company activated its incident response team, comprised of internal personnel and external cybersecurity experts retained to assist in addressing the incident. While the full scope of the impact is not yet known, the incident could have the potential to have a material impact on the Company's financial condition and results of operations. The Company is continuing its forensic investigation and analysis to assess the potential impact.


text: There can be no assurance the Company will not experience material effects from security breaches in the future. As cyber threats develop and grow, the Company may need to make significant further investments to protect data and its infrastructure, including the implementation of new computer systems or upgrades to existing systems, deployment of additional personnel and protection-related technologies, engagement of third -party consultants, and training employees. See Item 1A - Risk Factors above for additional discussion of various cybersecurity risks.


text: Our cybersecurity risk management program includes: physical, technological, and administrative controls intended to support our cybersecurity and data governance framework, including protections designed to protect the confidentiality, integrity, and availability of our key information systems and customer, employee, partner, and other third -party information stored on those systems, such as access controls, encryption, data handling requirements, and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices;

companyName: CREATIVE REALITIES, INC.

ticker: CREX


text: the use of external consultants or other third -party experts and service providers, where considered appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls; and.


text: During the year ended December 31, 2024, we did not identify risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents we have experienced from time to time, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material adverse effect on our operations, business strategy, operating results, and financial condition. For more information regarding cybersecurity risks that we face and potential related impacts on our business, see the section titled "Risk Factors" in Part I, Item 1A of this Report.


text: Aemetis utilizes a third -party cybersecurity and information security awareness training programs. Training is administered and tracked through online learning modules and ongoing phishing simulations. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues.

companyName: AEMETIS, INC

ticker: AMTX


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe our controls are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.


text: SharpLink has established policies and processes for assessing, identifying and managing material cybersecurity risks, and have integrated these processes into our overall risk-management processes. We have also established policies and processes for managing and responding to material cybersecurity incidents.

companyName: Sharplink, Inc.

ticker: SBET


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We devote appropriate resources and designate members of our management, including our Chief Executive Officer and Chief Financial Officer, to manage the risk assessment and mitigation process.


text: Employees are provided specific guidance to mitigate the risk of a cybersecurity attack. This guidance includes safeguards over confidential data, being aware of suspicious emails, choosing and changing passwords, protection of Company issued and use of personal devices, managing large data transfers and use of VPNs when outside the office. Employees are directed to immediately contact either the Chief Financial Officer and Vice President of Affiliate Marketing if they encounter any suspicious activity.


text: We also require appropriate third -party service providers to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect our company. We oversee and identify risks from cybersecurity threats associated with our use of service providers through an onboarding vendor risk management program, including an inherent risk assessment.


text: We have not, to date, experienced a cybersecurity incident which was determined to be material, although, like any technology provider, we have experienced incidents in the past. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K under the heading "Despite our security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. Any such breach could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, and regulatory penalties, disruption of our operations and the services we provide to clients, damage to our reputation, and a loss of confidence in our products and services, each of which could adversely affect our business, financial condition, results of operations and prospects," which should be read in conjunction with the information above.


text: Our Chief Financial Officer and Vice President of Affiliate Marketing are responsible for assessing and managing material risks from cybersecurity threats, as well as managing, responding to and reporting material cyber incidents if any occur. They will provide periodic briefings, as required, to the Audit Committee and to the Board of Directors about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, our policies for managing and responding to cybersecurity incidents include procedures for appropriate escalations to our Audit Committee Chair.


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. We continuously work to enhance our cybersecurity risk management program.


text: Cybersecurity Risk Management Program Overview We recognize the critical role that properly managing cybersecurity risk plays in maintaining the trust and confidence of our stockholders, the patients in our clinical trials, our employees, our business partners and our other stakeholders. Accordingly, our cybersecurity program is designed to identify, assess, manage and mitigate material risks from cybersecurity threats through a variety measures, including risk assessments, implementation of security measures, and ongoing monitoring of systems and networks. In collaboration with our third-party IT service providers, a cross-functional team comprised of representatives from our administrative, finance and legal functions actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We also engage external experts, including IT experts, other consultants, and auditors to evaluate our cybersecurity measures and risk management processes.

companyName: CervoMed Inc.

ticker: CRVO


text: We also identify our cybersecurity threat risks by comparing our processes to industry standards and best practices as well as by engaging experts to manage our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, the activities we undertake include the following: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws, as applicable;


text: leverage threat intelligence available to us and our third party IT service provider to help us identify, protect, detect, respond and recover if there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Board Oversight of Cybersecurity Risk Management and Governance Our Board is responsible for general oversight of our risk environment and associated management policies and practices and has delegated to its Audit Committee the responsibility for oversight of certain major risk categories and exposures, including with respect to cybersecurity and management's processes to monitor and control them. The Audit Committee meets regularly throughout the year and, on no less than a quarterly basis, receives and reviews a report from management, including the Company's Chief Financial Officer and General Counsel, regarding the Company's IT, cybersecurity, data security, and physical security risk, including any suspected material or immaterial cybersecurity incidents during the preceding quarter, if any, and discusses such matters with appropriate management and other personnel. In addition, on a semi-annual basis, the Audit Committee receives a report from the Company's primary third-party IT and cybersecurity regarding the Company's IT environment, overall cybersecurity risk management program and strategy and education regarding emerging trends and threats.


text: We depend on and engage various other third parties, including suppliers, vendors, and service providers, to support key elements of our business including our IT infrastructure. We have implemented various control processes designed to address cybersecurity threat risks associated with our use of such third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, IT, and/or compliance personnel. In addition, cybersecurity risks and posture are, as appropriate and applicable, a factor considered in the selection process prior to our engagement of third-party service providers.


text: In response to an identified cybersecurity incident, a group comprised of appropriate management personnel, our third-party IT service provider and, depending on the scope and severity of the incident, additional third-party subject matters experts, will be assembled to develop and implement a response strategy to contain, control, and remediate the cybersecurity incident, including securing our affected systems and/or information, mitigating harmful effects of the incident, preventing further compromises, and communicating information to affected parties, regulatory agencies and law enforcement, as necessary. This group will also report any such cybersecurity incident to the Audit Committee of the Board.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis by both management and the Board, including how such risks could materially affect our business strategy, operational results, and financial condition, and from time-to-time the Company engages third-parties to provide independent risk assessments.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading Item 1A. Risk Factors – General Risks Related to the Company ' s Business and Operations, which disclosures are incorporated by reference herein.


text: For additional information, see Risk Factors – Risks Related to Our Business. Potential cybersecurity threats are changing rapidly and advancing in sophistication. We may not be able to protect our systems and networks, or the confidentiality of our confidential or other information (including personal information), from cybersecurity incidents and other unauthorized access, disclosure, and disruption.

companyName: Nuvera Communications, Inc.

ticker: NUVR


text: Cybersecurity Risk Management and Strategy Our cybersecurity program is built upon the National Institute for Standards and Technology and other best practice frameworks. We employ processes for assessing, identifying, and managing material risks from cybersecurity threats, including engaging an independent cybersecurity consultant to audit our systems and procedures, make recommendations for improvement and monitor remediation of any identified risks. We also conduct random vulnerability testing including network penetration testing, phishing, and social engineering tests. In addition, we also require Systems and Organization Control ("SOC") type reports from our service providers for our payroll and human resources system and stock administrator.


text: Although we maintain systems and controls designed to prevent cybersecurity breaches from occurring, and we have processes to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of a breach occurring cannot be eliminated entirely. As we engage in more electronic transactions with service customers and vendors, and rely more on cloud-based information systems, the related security risks will increase, and we will need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our internal information technology systems or those of our third-party contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational harm.


text: Cybersecurity Governance All employees of the Company have ownership in managing cybersecurity and data privacy risks, however, oversight responsibility is shared by our BOD, Audit Committee, and cybersecurity management team. The Audit Committee is responsible for implementing our cybersecurity policies and provides regularly updates to the BOD Our cybersecurity management team, in conjunction with our third-party chief information security officer ("CISO"), conduct regular assessment and management of material risks from cybersecurity threats, including review with our internal cybersecurity management team. All employees and consultants are directed to report to our cybersecurity management team any irregular or suspicious activity that could indicate a cybersecurity threat or incident.


text: Nuvera's Senior Information Technology and Transport manager and his staff have primary responsibility for identifying, assessing, and managing our exposure to cybersecurity threats and incidents, subject to oversight by the Audit Committee of the BOD of the processes we establish to assess, monitor, and mitigate that exposure. As members of Nuvera's Cybersecurity Committee, the Information Technology and Transport manager and his team bring a combined sixty years of information technology experience at Nuvera in security, incident response, and local and external network architecture. Executive, Finance and Compliance members of Nuvera's Cybersecurity Committee bring over twenty-five years of experience in risk management, regulatory and compliance. Nuvera relies on their CISO from FRSecure for recommendations and direction on strategy, policy, and process. FRSecure has a team with a combined three hundred years of experience in information security with thirty difference certifications.


text: If a potentially material cybersecurity threat or incident is identified or discovered, the Company's Cybersecurity Management Team will trigger our incidence response plan, including notifying our CEO, CFO, and other relevant business executives. Our Cybersecurity Management Team, along with our CISO, will work with the appropriate leaders and employees in any impacted business groups, as well as appropriate personnel in our finance, legal and other impacted departments, to assess the risks to the Company and potential impact while determining appropriate remediation steps. If executive management determines that a cybersecurity threat or incident could be material to the Company, our management will notify the Audit Committee, who will escalate the risk to our full BOD, depending on an assessment of the risk.


text: To mitigate material risks posed by cybersecurity threats to our critical networks, third -party services, and data assets, we have instituted a comprehensive suite of information security processes. These measures encompass the diligent identification, assessment, and management of potential risks, threat monitoring services, and vulnerability assessments.

companyName: Whitestone REIT

ticker: WSR


text: Cross-Functional Collaboration and Coordination: We foster collaboration among various departments, including our information security function, legal team, management, and third -party service providers, to effectively identify, assess, and manage cybersecurity risks.


text: Additionally, we engage third -party providers to augment our cybersecurity capabilities. These partnerships entail ongoing assistance for threat monitoring and mitigation, as well as targeted support for specialized security expertise.


text: As of December 31, 2024, we have not detected any cybersecurity threats, including prior incidents, that have materially impacted the Company, our business strategy, our financial results, or our financial health. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to our Risk Factors discussion in the section titled "We face risks relating to Cybersecurity attacks, loss of confidential information and other business disruptions" in this Form 10-K.


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process for service providers, suppliers, and vendors. In the last three fiscal years, the Company has not experienced any material cybersecurity incidents.

companyName: SERVOTRONICS INC /DE/


text: Cybersecurity Governance The Board of Directors ("the Board") regularly receives reports from our executive officers and third parties on cybersecurity matters. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.


text: Cybersecurity threats continue to evolve as the threat landscape evolves. The Bank continuously works to evolve its cybersecurity practices with the changing landscape. Significant resources are devoted to protecting and enhancing the security of networks, computer systems, data storage devices, and other systems and technology. The Bank's security efforts and implemented controls are designed to protect against, among other things, cybersecurity attacks that can result in unauthorized access of confidential information, the destruction of data, disruptions to or degradations of service, the sabotaging of systems or other damage.

companyName: RBB Bancorp

ticker: RBB


text: Third parties with which the Bank does business, which facilitate the Bank's business activities, e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries are sources of cybersecurity risk to the Bank. Third-party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises could have a material adverse effect on the Bank, including in circumstances in which an affected third party is unable to deliver a product or service to the Bank or results in lost or compromised information of the Bank or its clients or customers.


text: Cybersecurity Risk Management The Bank maintains an Information Security and Cybersecurity Program to support the management of cybersecurity risk as a component of the Bank's Enterprise Risk Management ("ERM") framework. The information security and cybersecurity program is designed to manage risks relating to cybersecurity threats and leverages controls, best practices recommendations, and standards from the Federal Financial Institutions Examination Council ("FFIEC") and the National institute of Standards and Technology ("NIST") Cybersecurity Framework, and standards set by relevant legal and regulatory authorities.


text: The Information Security Officer ("ISO") oversees the Bank's Information Security and Cybersecurity Program and leads the Information Security team. Reporting to the Chief Risk Officer ("CRO") and Chief Information Officer ("CIO"), the ISO and his team are responsible for identifying, assessing and managing information security and cybersecurity risks, and for implementing and maintaining controls to prevent, detect and respond to cybersecurity threats and incidents, safeguarding the confidentiality, integrity and availability of the Bank's information systems and data.


text: As part of the Information Security and Cybersecurity Program, the Bank conducts periodic employee training to educate employees on information and cybersecurity risks and to reinforce security management practices and compliance with the Bank's security policies and standards. Training is mandatory for all employees and is supplemented by testing initiatives, including periodic phishing tests.


text: The Bank's policies and procedures concerning cybersecurity matters include processes to safeguard its information systems, monitor these systems, protect the confidentiality and integrity of its data, detect intrusions into its systems, and respond to cybersecurity incidents. Extensive technical controls are in place for identifying and managing cybersecurity risks and safeguarding Bank information systems and information. The Bank uses sophisticated industry-recognized monitoring and threat detection technologies that continuously monitor its information systems and provide threat detection alerts. The Bank's strategy for assessing, identifying, and managing cybersecurity risks and for evaluating the effectiveness of its cybersecurity program includes periodic risk assessments and testing of its systems, processes and procedures through audits, penetration testing, vulnerability scans, tabletop exercises, and other related exercises.


text: The Bank engages third parties on a regular basis to assess, test, audit or assist with the implementation of risk management strategies, policies, and procedures to enhance the detection and management of cybersecurity risks. Cybersecurity risk management strategies include, but are not limited to: consultants who assist with assessing risks, assessing systems alignment with NIST Cybersecurity Framework, and FFIEC, penetration testing, tabletop exercises and other regulatory agency requirements.


text: The IT Committee and Audit Committee are the principal board committees that oversee the Bank's assessment and management of cybersecurity risk, including oversight of the implementation and maintenance of appropriate controls in support of the Bank's Information Security and Cybersecurity Program. Both the IT and Audit Committees are comprised of professionals with risk management and information technology expertise to manage any material risk from a cybersecurity threat standpoint.


text: The membership of the IT Committee includes members of the executive management team as well as directors of the Bank. The CIO and ISO actively participate in all IT Committee meetings. The CIO has over 20 years of work experience in the development, operation and management of Information Technology at financial institutions. The ISO has over 10 years of work experience in building and overseeing cybersecurity programs at financial institutions. Both CIO and ISO have extensive experience and qualifications in various technology and information security disciplines, including relevant experience at the Bank. Additionally, the Audit Committee has oversight of the management of cybersecurity risk via validation and review of IT and cybersecurity risk assessments and audits. The ISO provides reporting metrics on cybersecurity risks to the IT Committee, which meets at least four times a year. The IT and Audit Committees assist the Board of Directors in its oversight.


text: Notwithstanding the Bank's efforts at cybersecurity, the Bank cannot guarantee that those efforts will successfully prevent or mitigate a cybersecurity incident that could have a material adverse effect on it. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Bank, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A. Risk Factors– Risks Related to Our Business.


text: Risk Management & Strategy Rocky Brands recognizes the critical importance of developing, implementing, and maintaining a robust information security program to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have established information security programs and policies, including processes for identifying, assessing, and managing risks arising from cybersecurity threats. These processes involve regular assessments of our information systems and infrastructure to identify vulnerabilities and threats. We focus on executing a centralized information technology and cybersecurity program. Our Company-wide approach is to be positioned as one security program, one posture and one roadmap for the enterprise. This platform is administered across our departments by our cybersecurity team led by our Vice President of Information Technology. Our information security programs and policies are aligned with those of the Center for Internet Security (CIS), Control Objectives for Information Technologies (COBIT), and National Institute of Standards Technology (NIST).

companyName: ROCKY BRANDS, INC.

ticker: RCKY


text: We are acutely aware of risks associated with third -party service providers and we incorporate cybersecurity into our third -party vendor management policy. We conduct thorough security assessment to determine the category of risk third parties pose to Rocky Brands, with a priority focus on vendors with products or services that will have access to private and sensitive information. Vendor assessments incorporate inputs, including for example, BitSight and Service Organization Control Type 2 ( "SOC2") information available for our third -party vendors. Our assessments and monitoring are designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Although no cybersecurity incidents during the year ended December 31, 2024 which had a material impact on our business strategy, results of operations or financial condition, the scope and impact of any future incident cannot be predicted. See Item 1A. - Risk Factors for more information about our information security and cybersecurity risks.


text: Our Board of Directors has established governance protocol over risk management, including general oversight of information technology security and cybersecurity risk. The Audit Committee is central to the Board's oversight of cybersecurity risks and is primarily responsible for this domain. The Audit Committee actively participates in discussions with management, external experts and amongst themselves regarding cybersecurity risks. The Audit Committee is comprised of Board members with broad expertise, including technology, risk management and finance, enabling them to effectively oversee and govern cybersecurity risks. One Audit Committee member is certified under the National Association of Corporate Directors Certificate in Cyber-Risk Oversight Program.


text: We have developed a robust organizational structure to manage and oversee our information technology and cybersecurity programs, including full-time information security associates dedicated to cybersecurity. These individuals possess relevant experience and expertise in cybersecurity and risk management. Our Director, IT Infrastructure & Security leads our information security, data privacy and protection, and information technology compliance programs. The Director stays current with security related topics by either webinars, training classes or cybersecurity conferences. Guided by management, our information technology teams maintain a detailed Cyber Incident Response Plan ("CIRP") and hold frequent meetings to ensure the proper communication and execution of our security controls and procedures. The Cybersecurity team has various expertise ranging in Associate of ISC2-CISSP certification and extensive training on current security products. The Director, IT Infrastructure & Security regularly reports to the Vice President of Information Technology and maintains ongoing dialog with the reporting structure to our CEO, CFO and COO, and Board of Directors regarding our information security programs. This reporting includes updates on matters evaluated under our CIRP, the current threat landscape, cybersecurity initiatives, and the effectiveness of our cybersecurity programs.


text: Our Vice President of Information Technology has more than 35 years working as an IT professional, 13 years of which has been at the Company in various roles such as, Programming, Business Analysis, Systems Analysis, Operations, EDI Manager, and Applications Director.


text: Cybersecurity is an area of increasing concern to the management of and investors in CPS. While CPS has been International Traffic in Arms Regulations (ITAR) compliant for many years, that in itself does not mitigate the risks of a cybersecurity incident. The Company is currently also working towards full compliance with NIST 800 - 171 as well as CMMC compliance. In working towards this goal, CPS has retained an outside consulting firm to help us implement the policies, processes and procedures to further mitigate cybersecurity risks.

companyName: CPS TECHNOLOGIES CORP/DE/

ticker: CPSH


text: CPS generally keeps all employee personally identifiable information with its payroll service provider. Each year the provider furnishes us with their Service Organization Controls ("SOC") report which includes their cybersecurity policies and procedures.


text: Risk Management Strategy As a financial institution, cybersecurity presents significant risks that could materially impact the Company's operations, financial performance, and reputation. A successful cyberattack could result in operational disruptions, financial losses, regulatory scrutiny, legal liability, and reputational damage. Accordingly, the protection of customer and business information is a top priority. Cybersecurity risk management is a component of the Company's formal Information Security Program. The Information Security Program is incorporated into the Company's Enterprise Risk Management Program, ensuring a holistic approach to risk prevention, detection, mitigation, and remediation of cybersecurity threats.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: The Information Security Program is based on regulation and guidance established by agencies, including but not limited to, the Federal Financial Institutions Counsel ("FFIEC") and the FDIC. The Information Security Program begins with risk assessment. At least annually, the Company's Information Security team completes an information security risk assessment in accordance with regulatory guidance. While cyber threats are included in the overall information security risk assessment, a targeted cybersecurity risk assessment is also completed, utilizing the FFIEC Cybersecurity Assessment Tool ("FFIEC CAT"). The FFIEC CAT specifically assesses the maturity and effectiveness of the Bank's cybersecurity programs. In addition to the FFIEC CAT, the Bank partners with internal and external auditors to conduct various assessments throughout the year to identify, manage, and mitigate cybersecurity risks. The assessments conducted include but are not limited to: vulnerability assessments, penetration testing, social engineering, and onsite security assessments. Risk assessments consider size and complexity, are formally documented, and adapt to changes in the technology and organizational environment. Management and the Board of Directors use risk assessment data to make informed risk management decisions based on a full understanding of the risks. Management and the Board also consider the results of these assessments when overseeing operations. A strong, high-level risk assessment process provides the foundation for more detailed assessments within the functional risk management areas, as well as improves policy and internal control decisions across the organization.


text: Information Security Program Vendor Management. The Company maintains a formally documented Vendor Management Program that includes an information security review of all new and existing third -party vendor relationships. The Vendor Management team ensures initial and ongoing due diligence is performed on all third -party relationships according to policy. Quarterly Vendor Management program updates are provided, and the policy is reviewed and approved annually by the Audit Committee of the Board of Directors.


text: Independent Audit and Testing. The Company's Audit Department schedules and oversees a regular review of program design and effectiveness by independent third -party audit firms that specialize in technology and cybersecurity. Results are reported directly to senior management and the Audit Committee of the Board of Directors.


text: Cyber Insurance Coverage. The Company maintains a cyber insurance policy as part of its overall risk management strategy to mitigate financial losses in the event of a cybersecurity incident.


text: The Information Security team, engaged in enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes, ensures a complete approach to safeguarding the confidentiality, integrity, and availability of sensitive information. The Information Security team consists of experienced information security professionals and is led by the CIO. The CIO has more than 25 years of information technology and banking leadership experience and holds a Certified Information Systems Security Professional ("CISSP") designation. Reporting to the CIO is the Information Security Manager who has more than 10 years of cybersecurity experience in the Financial Institution industry and possesses a master's degree in information systems management with an emphasis in cybersecurity. Complementing the independent Information Security team, is the Information Technology (IT) team. The IT System Administration & Engineering Manager has over eight years financial institution technology experience and a master's degree in information systems management with a cybersecurity management specialization and the Systems Support Manager has over 20 years of financial institution technology experience, ensuring technology operations occur with a security-focused mindset. In addition to experienced information security and information technology teams, the Company engages with industry experts for managed security services. This collaborative effort includes threat intelligence gathering, firewall management, intrusion detection system monitoring, intrusion prevention services, and security information and event management monitoring, ensuring round-the-clock protection.


text: The Vendor Management team ensures compliance with the organization's Vendor Management Policy, including initial and ongoing due diligence of all third -party providers.


text: Audits and testing of program effectiveness are coordinated by the Company's Senior Vice President of Audit who oversees the Audit Department and reports to the Audit Committee of the Board of Directors, independent of the technology and cybersecurity functions. The Audit Department utilizes independent third -party audit firms with technology and cybersecurity expertise. Results of all audits and independent assessments are delivered directly to senior management and the Audit Committee of the Board of Directors by the SVP of Audit.


text: Cybersecurity Incidents As of the reporting period, the Company has not experienced any material cybersecurity incidents that have had a significant impact on operations, data integrity, or financial performance. However, the Company continuously monitors and evaluates cybersecurity threats, including those affecting third -party service providers. While some third -party vendors have reported cybersecurity events, none have materially impacted the Company's systems, computing environments, or customer data. The Company remains committed to enhancing its cybersecurity defenses through ongoing risk assessments, investment in technology, and adherence to industry best practices.


text: As part of the above process, we engage third -party services to provide 24 -hour, 365 -day monitoring, escalation, and response to cyber events. In addition to consulting on best practices, we leverage a third -party expert security firm for independent evaluations of our security controls through penetration testing. These evaluations test both the design and the operational effectives of security controls.

companyName: Eton Pharmaceuticals, Inc.

ticker: ETON


text: Our process also addresses material risks from cybersecurity threats associated with our use of third -party service providers, including those in our supply chain, our product development partners, or those who have access to sensitive data or our systems. Third-party risks are included within our broader overall risk assessment process, and cybersecurity considerations are considered during the selection and oversight of our third -party service providers.


text: As of the date of this Form 10-K, we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business, strategy, results of operations, or financial condition at this time. For further discussion of the risks associated with cybersecurity incidents, see Part I, Item 1A of this Form 10-K under the risk factor entitled "We rely significantly on information technology and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively."


text: Cybersecurity Risk Management and Strategy We have a multilayered framework for detecting and responding to reasonably foreseeable cybersecurity risks and threats. To protect our information technology ("IT") systems from cybersecurity threats, we use various tools that help prevent, detect, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. In the event of a material change to our systems or operations, we would assess the internal and external threats to the security, confidentiality, integrity, and availability of our data and systems, along with other material risks to our operations. We leverage technical safeguards intended to protect the Company's information systems from cybersecurity threats, including firewalls, threat monitoring, intrusion prevention and detection systems, anti-malware, access controls, privilege management, asset and endpoint management, and ongoing system security assessments. We oversee third -party service providers by conducting vendor diligence and reviews on a regular basis. We monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular network scans, system audits, and intelligence feeds. The results of these assessments are used to improve our security posture through remediation efforts.

companyName: TaoWeave, Inc.

ticker: TWAV


text: Oblong's Director of IT is responsible for assessing and managing cybersecurity risks. It has extensive experience focused on increasing the organization's resilience to security threats and staying current on new developments by monitoring the cybersecurity landscape. The team monitors Oblong's IT environment for potential security threats, investigating and acting on security events to minimize potential risks to the environment.


text: Oblong's Audit Committee engages in oversight of Oblong's cybersecurity risks and receives regular updates from management on technology and security updates and Oblong's assessment of cybersecurity threats and mitigation plans. The Audit Committee oversees the processes over internal controls and financial reporting, including controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. In the event of a material cybersecurity incident affecting our IT systems or data management, the Audit Committee would promptly work to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity incidents.


text: The Chief Information Officer supervises the information security team, which is responsible for maintaining and implementing our enterprise-wide cybersecurity strategy, policy, standards, and architecture processes. The Information Security Officer, in coordination with compliance and human resources, conducts annual and ongoing company-wide information security awareness training. The Chief Information Officer and Information Security Officer have combined over 35 years of IT management experience. We have developed processes to identify and oversee risks from cybersecurity threats associated with third-party service providers, which include the information security team assessing cybersecurity robustness during third-party vendor onboarding, the inclusion of protective provisions in third-party vendor agreements, and risk-based monitoring of third-party vendors on an ongoing basis.

companyName: PLUMAS BANCORP

ticker: PLBC


text: The Board of Directors receives regular reports from the Chief Information Officer and the Information Security Officer on Plumas Bancorp's cyber risks and threats, the status of projects to strengthen Plumas Bancorp's information security systems, assessments of Plumas Bancorp's security program, and the emerging threat landscape. Additionally, the Chief Information Officer chairs the Technology Steering Committee, which drives awareness, ownership, and alignment across all business functions for effective cybersecurity risk management and reporting. In addition to conducting internal audits, Plumas Bancorp annually engages third parties to audit its information security programs, whose findings are reported to the Audit and Executive Committees of the Board. The Company also engages with key third-party vendors, industry participants, government agencies, and intelligence and law enforcement communities as part of our efforts, which are reported to the Technology Steering Committee and Board of Directors.


text: Risk Management and Strategy We have implemented cybersecu rity and data protection policies and procedures to assess, identify and manage risks from cybersecurity threats. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees receive awareness notices and are informed about new email threats and recent phishing attempts and email frauds. We have capable employees with significant expertise in cybersecurity related to our industry. We evaluate, create and deploy advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks. We also engage third -party service providers and consults to support our cyber risk management efforts, including through periodic security testing.

companyName: TABLE TRAC INC

ticker: TBTC


text: We use specialized IT tools and services, including with the support of third -party service providers, to understand, manage, mitigate and continually remediate identified threats. The Company logs identified cybersecurity threats and tracks corresponding risk management activities. Identified cybersecurity threats are discussed with management for resolution planning and escalation. Testing of our security controls in connection with the auditing of our financial systems is completed annually.

companyName: OCULUS INC.

ticker: OVTZ


text: We regularly evaluate the cybersecurity threats associated with third -party suppliers and service providers that have access to the Company's networks, confidential information, and information systems. We provide third -party vendors, consultants, and partners with detailed security requirements for securing their connections to our IT networks. In addition, we seek to make third -party service providers contractually responsible for identifying and remediating security issues within their technology and service environment.


text: Avalon faces various cyber risks, including, but not limited to, risks related to the storage of members' information, and security breaches could expose us to a risk of loss or misuse of this information, litigation and potential liability. We utilize a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cyber and information security. Additionally, we devote significant resources to protecting the security of our computer systems, software, networks and other technology assets. Our efforts are designed to adapt with the evolution of information security risks and appropriate best practices and include physical, administrative and technical safeguards. The risk assessment is discussed with the audit committee and board of directors on at least an annual basis. Our practices are generally developed from, and benchmarked against, recognized cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework. Our management team also engages certain outside advisors and consultants to assist in the identification, oversight, evaluation and management of cybersecurity risks on a regular basis, as well as to advise on specific topics. We have not experienced a material cybersecurity incident and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected the Company.

companyName: AVALON HOLDINGS CORP

ticker: AWX


text: Cybersecurity Risk Management and Processes The Company is actively working towards the integration of a cybersecurity risk management program into its comprehensive risk management framework to protect the confidentiality, integrity, and availability of its critical systems and information.

companyName: High Roller Technologies, Inc.

ticker: ROLR


text: Our cybersecurity risk management program is being designed based on various cybersecurity frameworks, including National Institute of Standards and Technology and the Center for Internet Security, as well as information security standards issued by the International Organization for Standardization, including ISO 27001 and ISO 27002. The Company uses these frameworks and information security standards as a guide to identify, assess, and management cybersecurity risks relevant to the business. Formalization and implementation of robust IT security policies; Conducting vulnerability assessments; Revision of user access request documentation to clearly define the roles and permissions assigned to users; Thorough review of the accuracy and completeness of user listings and access;


text: Preservation of evidence related to system modifications; and Continued collaboration with external specialists to aid in the ongoing evaluation of existing policies and procedures. Establishment of a dedicated cybersecurity governance committee; Standardization of cybersecurity incident response procedures and formats; Conducting penetration tests on a quarterly basis; Enhancement of segregation of duties to mitigate the risk of self-review of transactions within the system;


text: The Company has not identified any risks from known cybersecurity threats and did not have any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company.


text: Cybersecurity Governance The Board of Directors actively collaborates with management to supervise cybersecurity risks. In its risk oversight role, our Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Management considers cybersecurity risk as part of its risk oversight function and is in the process of establishing a cybersecurity governance committee. Once established, the cybersecurity governance committee will oversee the management's implementation of the cybersecurity risk management program.


text: As of December 31, 2024, and through the date of the filing of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual report on Form 10-K.

companyName: Moleculin Biotech, Inc.

ticker: MBRX


text: Our Chief Financial Officer and Head of IT and Cybersecurity, a consultant, are primarily responsible for assessing and managing our material risks from cybersecurity threats. In this regard, our Chief Executive Officer and Head of IT and Cybersecurity have assistance from service providers, other consultants and third parties. Our Chief Financial Officer has served as an executive officer for over twenty-five years, including over fifteen years as an executive officer of public companies. Our Head of IT and Cybersecurity has served as an information technology professional for over nine years and has held senior IT positions at multiple companies, where his primary responsibilities included maintaining direct oversight over his companies' cybersecurity risks.


text: Cyber Risk Management and Strategy Our cybersecurity risk management processes are integrated into our overall risk management processes. Our strategy consists of utilizing a combination of employee education, preventative controls, detective controls, and periodic third-party cybersecurity testing. We engage with external cybersecurity experts, including assessors, consultants, and auditors, to enhance our cybersecurity measures and ensure compliance with industry best practices. We have established processes to oversee and manage cybersecurity risks associated with our use of third-party service providers, ensuring they adhere to our security standards. We review third-party service provider contracts to ensure they contain data privacy and security provisions, aligning with our standards and regulatory requirements. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks.

companyName: NextPlat Corp

ticker: NXPL


text: Risk Management Oversight and Governance Our Chief Compliance Officer and the Chief Financial Officer lead the oversight of company-wide cybersecurity strategy, policy, standards and processes. We utilize third-party IT consultants to help manage cybersecurity risks. Our Chief Compliance Officer and Chief Financial Officer have the requisite experience in risk assessment and a strong understanding of business operations, including experience with security frameworks, compliance regulations, and the ability to communicate effectively with both technical and non-technical stakeholders. Our consultants have the requisite combination of technical experience in network security, system administration, and incident response.


text: Our Audit Committee liaises with our management team to communicate with and monitor management's mitigation efforts to reduce cybersecurity risks by monitoring incident response, discussing and assisting with identifying potential cyber threats, analyzing vulnerabilities, and prioritizing risks.


text: The goal of the Company's cybersecurity risk management strategy is to mitigate cybersecurity risks. Cybersecurity risks include the potential misappropriation of assets or confidential information, corruption of data, disruptions to operations, or regulatory developments that could materially impact the Company's privacy and cybersecurity risk exposure, and similar threats that could have a material impact to the Company's business, reputation, results of operations and financial condition. To this end, management has implemented processes which seek to identify, assess, and manage material cybersecurity risks, and which include (i) monitoring of cybersecurity threats in the current environment, (ii) training employees on a regular basis in cybersecurity prevention, including social engineering and phishing techniques used by hackers, (iii) requiring multifactor authentication to access the Company's networks, (iv) updating applications on an on-going basis to patch or remediate security vulnerabilities, and (v) the encryption of confidential data and critical servers. The Company has in-place security information and event management tools for the purpose of detecting, analyzing, and responding to security threats in an effort to prevent or reduce potential harm to business operations. These tools include: (i) antivirus applications to detect threats, (ii) end point detection and response applications to record and store on-line user behavior for the purpose of detecting, investigating, and blocking suspicious activities, and (iii) third party monitoring applications. The Company has also adopted a network segmentation strategy intended to divide networks into smaller parts to improve security and efficiency, and the Company also maintains redundant back-up copies of its networks that are stored in multiple locations, including cloud-based backups that are performed daily. Further, on an annual basis, the Company hires a consultant to perform penetration tests against the Company's security infrastructure with the goal of identifying security vulnerabilities and making recommendations for security improvements. The Company also has business continuity and incident response programs in place to respond to and mitigate cybersecurity attacks. The Company conducts periodic exercises in an effort to improve its cybersecurity business continuity and incident response plans and updates the plans if new threats are identified or ongoing reviews of the plans suggest an update is needed.

companyName: BBX Capital, Inc.

ticker: BBXIA


text: Our cybersecurity policies and procedures have been developed to ensure an adequate and consistent approach to the management, control, and protection of our information ("Information Assets"). Our Information Assets include business information, customer information and external business partner information, including, without limitation, classified information, information relating to research, intellectual property, personally identifiable information, business and product development, clinical test and evaluation data, and business plans, customer and supplier information, supply chain, manufacturing, distribution, finance, human resources, consulting, partnerships, contracts, and corporate transactions, maintained in any form or format or location, including audio, video, paper, magnetic, electronic and optical.

companyName: Clene Inc.

ticker: CLNN


text: To mitigate risk, we utilize (i) firewalls to protect our network and Computing Equipment, (ii) anti-malware software to protect our Computer Equipment, (iii) device monitoring, (iv) physical security, (v) security and application lifecycle security, (vi) security updates and backups, and (vii) vulnerability and risk assessments.


text: Firewalls. Our network and Computer Equipment is protected by one or more authorized firewalls, with any changes requiring approval from authorized personnel including the review and approval of an information technology ("IT") change control document. Administration of firewalls is restricted to a minimum number of authorized personnel as necessary. We also employ intrusion detection at critical points of our network. All external access to our network, or to any computing resource on our network connected to a non-Clene network (including, but not limited to the internet) must pass through a hardware firewall, appliance, or equivalent device, where all traffic between our network and external networks can be continuously controlled, monitored, and examined for any access violations.


text: Real-Time Monitoring. We engage a third -party security operations center that actively monitors our environment and detects and remediates security threats in real-time.


text: Physical Security. We control physical access to our facilities, areas within our facilities, data centers, server rooms, and equipment. Installation, maintenance, and repair of equipment is restricted to authorized personnel. We protect our Computer Equipment from power failure, surges, and other electrical anomalies, and cabling is protected from unauthorized access or damage. Access to our network services is restricted to authorized individuals and granted only following individual identification and authentication. Local wireless access is limited to authorized entry points, with various forms of authentication required before access is granted to authorized individuals.


text: Security Updates and Backups. We monitor security bulletins, software updates/patches, and functional software updates/patches and apply them in accordance with the timeline prescribed in our policies and based upon recommendations from third -party vendors, as applicable. Systems that no longer provide security updates/patches are discontinued. We research, test, and verify functional software updates/patches before installation. We perform data backups periodically based on business requirements to maximize data availability and prevent information loss, including before any system upgrade or maintenance. Encrypted data remains encrypted throughout our backup processes. Data backups are stored in geographically separate facilities.


text: Change and Configuration Management Our change and configuration management policy and procedures enable the effective management of changes to Information Systems ("Changes") to ensure the confidentiality and integrity of Information Assets and the continued availability of both the Information Systems and IT services. The policies and procedures apply to all changes to Information Systems managed by the Company or its IT external business partners.


text: Once a risk is identified, we analyze the risk and assign a risk classification based upon a combination of factors, including data volume, legal and regulatory requirements, privacy considerations, and intellectual property considerations. Risks are classified as (i) Low Risk, where unauthorized disclosure could be expected to have a limited adverse effect on operations, assets, or individuals; ( 2) Medium Risk, where unauthorized disclosure could be expected to have a serious adverse effect on operations, assets, or individuals; or ( 3) High Risk, where unauthorized disclosure could be expected to have a severe or catastrophic adverse effect on operations, assets, or individuals. Before granting access to Information Assets, we assess the relationship of the user and associated risks of the Information Assets to determine if access is appropriate, and we periodically review access rights to ensure compliance and prevent unauthorized access.


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our overall risk management program. Our CEO, General Counsel, and Vice President of Quality and Technical Operations ("VP of Quality") directly oversee the development, implementation, operation, and revision of our cybersecurity policies and procedures, and are primarily responsible for the oversight of risks from cybersecurity threats and any security incidents that may occur. These officers have more than 24 years of combined experience in managing IT, operations, and information risk and security. Our VP of Quality has experience developing comprehensive information security programs for organizations, and brings extensive experience in the private sector and is a specialist in IT governance strategies, risk management protocols, and compliance frameworks. All security incidents are managed by our VP of Quality and reported to management, including our CEO, General Counsel, and other personnel based upon the specifics of the incident and its impact. Additionally, if a known or suspected security incident occurs at the Company, based upon its risk classification and if we assess the impact to be critical, the incident is escalated in a timely manner to the Audit Committee of the Board of Directors for oversight of the monitoring, reporting, and response process. The Audit Committee also oversees the implementation of our policies and procedures to prevent or reduce cybersecurity risks on an ongoing basis during the performance of its general committee duties.


text: We face a number of cybersecurity risks in connection with our business and have from time-to-time experienced cybersecurity incidents, which to date have not had a material impact on our financial condition or results of operations. For more information about the cybersecurity risks we face, see Item 1A—Risk Factors "Our internal computer systems, or those used by any CROs or other third -party contractors or consultants we may engage, may fail or suffer security breaches."


text: As required by federal banking laws and regulations, the Bank's cyber/information security risk management practices include risk assessments, controls and practices specifically for cybersecurity, information technology deployment and third -party information technology vendor risk management.

companyName: BankFinancial CORP


text: Information Security Management. To prepare and respond to incidents, the Bank maintains implemented multi-layered cybersecurity protocols, integrating people, technology, and processes as part of the Bank's Information Security Program. The Information Security Program is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity, third -party vendor management and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities, deploys current information security technologies and ensures awareness, accountability, and oversight for data protection throughout the Bank and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Company engages qualified third -party vendors, consultants and independent auditors to, among other things, conduct network penetration tests and perform cyber/information security audits.


text: The Information Services Division of the Bank is primarily responsible for identifying, assessing and managing material risks from cyber/information security threats. Information security management is conducted by the Chief Information Officer (CIO) and Chief Information Security Officer (CISO) of the Bank. The CIO has over ten years' experience with the Bank, including information security technology deployment and previous information technology audit experience. The CISO has more than 15 years of experience with the Bank, with expertise in large-scale systems information security and customer data privacy management.


text: The Bank maintains policies, controls and training programs concerning customer information security, including transaction processing. The Bank deploys universal conditional access policies, requires multi-factor authentication for external network access and on-line banking access by Bank customers, and maintains additional access controls for network security and transaction processing. The Bank also has policies and controls to identify, classify and limit access to non-public customer information, including a comprehensive third -party vendor management cyber/information security risk management program.


text: For purposes of the following disclosure, the terms "cybersecurity incident" and "cybersecurity threat" have the meanings given to such terms in Item 106 (a) of Regulation S-K promulgated under the Securities Exchange Act of 1934.

companyName: PARKERVISION INC

ticker: PRKR


text: Given the small size of our organization, we leverage a third-party information technology ("IT") service provider for management of our information systems needs. Our IT service provider works closely with executive management in the assessment, identification and management of cybersecurity threats. Cybersecurity threats are prevented and detected by multiple approaches, including perimeter defense, vulnerability management, intrusion testing, multifactor authentication and data protection. We have also implemented a formal cybersecurity awareness program that includes cybersecurity training for all employees and relevant contractors and is integrated with our overall risk management process. Material risks from cybersecurity threats, including those associated with the use of third-party service providers, are assessed during our annual review of our enterprise risks and related controls.


text: We rely on technology in all aspects of our business, including information systems of our third -party service providers. The information systems upon which we depend have been, and likely continue to be, subject to cybersecurity threats such as unauthorized access attempts, business email compromise, phishing, malware, ransomware, hacking and other cyberattacks attempting to disrupt operations. Our dependence on these information systems exposes us to cyberattacks, both directly and through cyberattacks impacting our service providers. A significant cybersecurity incident could result in service interruptions, security events, regulatory compliance failures, the inability to protect employee or corporate information or assets against unauthorized access or use, or other operational difficulties. As described above, we continuously monitor our cybersecurity threats, including risks associated with our use of service providers. We are not aware of any risks from cybersecurity threats, or previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "Risks Related to Information and Cyber Security," which should be read in conjunction with the information above. The Audit Committee, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. The Audit Committee receives reports regarding such risks from management, including our Chief Technology Officer, and reports to the Board at least quarterly. The Audit Committee also oversees the Board's response to any significant cybersecurity incidents. Our Chief Technology Officer, who has extensive cybersecurity knowledge and skills gained from over ten years working in the technology industry, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at Aterian, working closely with our General Counsel who has a certification in Data Security and Privacy Policy from Cornell University. Both our Chief Technology Officer and General Counsel report directly to our CEO.

companyName: Aterian, Inc.

ticker: ATER


text: In July 2023, the SEC adopted a new rule, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, which requires registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. For registrants, the final rules were effective September 5, 2023, with the new disclosures required beginning in annual reports for fiscal years ending on or after December 15, 2023. With respect to compliance with the incident disclosure requirements, all registrants other than smaller reporting companies must begin complying on December 18, 2023, with smaller reporting companies being given an additional 180 days, or June 15, 2024. The Company adopted these new cybersecurity disclosure requirements in the prior fiscal year, as detailed below.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners, and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized cybersecurity industry frameworks established by the National Institute of Standards and Technology, and other applicable industry standards. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Additionally, we utilize internal and external independent controls to monitor and mitigate the risk of these threats, including a Security Incident Response Plan ("SIRP") and periodic Information Technology training for all employees.


text: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by external resources accessing the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third -party systems.


text: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, EDR tools, and PEN test exercises that focus on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the executive management team and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: We experienced a cyberattack in January 2023. We believe the incident has not had nor will have a material impact on our business, operations, ability to serve our customers, or financial results. At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. The impact of potential cybersecurity threats is difficult to predict, but one or more of them could result in the loss of information or capabilities, harm to individuals or property, damage to our reputation, loss of business, regulatory actions, and potential liability, any of which could have a material adverse effect on our financial position, results of operations and/or cash flows. These threats could lead to losses of sensitive information or capabilities, harm to personnel, infrastructure, or products, and/or damage to our reputation as well as our vendor's ability to perform on our contracts. See "Risk Factors - Cyberattacks, like our 2023 cybersecurity incident that was previously disclosed, can lead to disruption of business, reduced revenue, increased costs, liability claims, or harm to our reputation or competitive position."


text: The executive management team and the Board oversee the Company's ERM process, including the management of risks arising from cybersecurity threats. The executive management team and the Board each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The executive management team and the Board also receive prompt and timely information regarding any cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the executive management team and the Board discuss the Company's approach to cybersecurity risk management to monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time.


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program, and cybersecurity is a critical element of this program.

companyName: Firsthand Technology Value Fund, Inc.

ticker: SVVC


text: Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. In general, the Adviser seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Adviser's information systems or the information that the Adviser collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106 (a) of Regulation S-K. These risks include, among other things, operational risks, the risk of intellectual property theft, fraud, harm to employees or third parties with which we conduct business and violation of data privacy or security laws.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments when there is a material change in our business practices that we believe could affect information systems that are vulnerable to cybersecurity threats. These risk assessments include identifying reasonably foreseeable internal and external risks and the potential harm if the risks were to materialize. We conduct these risk assessments directly and also periodically engage third -party providers to support these processes.