text: We did not identify any cybersecurity incidents during the year ended December 31, 2023 that have materially affected or are reasonably likely to materially affect Solitario's business strategy, results of operations, or financial condition.


text: Despite the low accessibility of our server and system and the resultant low cybersecurity risks that we face, we recognize that no system is completely protected from cyber threats, that cybersecurity risks are increasingly difficult to detect, and that the increasingly digitalized landscape that businesses operate in increase the pervasiveness and severity of cyber-attack risks. While we do not believe our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity threats or incidents, there is no assurance that we will not be materially affected by such threats or incidents in the future. We will continue to monitor cybersecurity risks with our IT Consultant and stay apprised of changes in the cyber environment.

companyName: SOLITARIO RESOURCES CORP.

ticker: XPL

secItem: Item 1C


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the responsibilities relating to the operational (including IT risks and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our executive officers and it reports any material findings and recommendations to the full Board for consideration.


text: Cybersecurity risk management is part of the Company's overall risk management program. Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to the best of their ability to ensure that such potential cybersecurity risk exposures are monitored, putting in place reasonably appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Treasurer with assistance from the management team. Any significant Cyber incidents that they become aware of are reported to the board of directors. There were no material cyber security incidents discovered in 2023.

companyName: Idaho Strategic Resources, Inc.

ticker: IDR


text: Our Board of Directors (Board) oversees the management of the risks inherent in the operation of the Company's business, principally through the Governance Committee. Our Governance Committee oversees our risk management efforts, with cybersecurity being an element of our comprehensive Enterprise Risk Management (ERM) strategy. Our executive officers report information to the Board through the Governance Committee regarding the risks that impact the organization, including cybersecurity risks, and any material events.

companyName: WIDEPOINT CORP

ticker: WYY


text: NIST SP 800-34, Rev 1, "Contingency Planning Guide for Federal Information Systems," November 2010 NIST SP 800-37 Rev. 2, "Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy," December 2018 IST SP 800-53, Rev. 5, "Security and Privacy Controls for Information Systems and Organizations," September 20, 2020, updated December 10, 2020 NIST SP 800-61, Rev 2, "Computer Security Incident Handling Guide," August 2012 Our approach to cybersecurity aims to protect the confidentiality, integrity, and availability of the data we handle. This process involves measures to identify and prevent cybersecurity threats and mechanisms to mitigate and respond to cybersecurity incidents.


text: Risk Management and Strategy Our cybersecurity program, a pivotal component of our overarching ERM framework, concentrates on several key areas:


text: Collaborative Approach: We employ a holistic, cross-functional strategy to identify, prevent, and mitigate cybersecurity threats. Our approach includes rapid escalation protocols for specific cybersecurity incidents, enabling timely decision-making on public disclosure and reporting by management.


text: Technical Safeguards: We utilize advanced technical safeguards to defend our information systems. These include firewalls, intrusion prevention and detection systems, anti-malware tools, and stringent access controls. Continuous vulnerability assessments and leveraging cybersecurity threat intelligence ensure these safeguards remain practical and up to date.


text: Incident Response and Recovery Planning: Our comprehensive incident response and recovery plans are designed to manage the aftermath of cybersecurity incidents. Regular testing and evaluation of these plans ensure preparedness and resilience.


text: Third-Party Risk Management: Recognizing the significance of external threats, we have implemented a risk-based strategy to manage cybersecurity risks associated with third parties, such as vendors and service providers. This strategy extends to these third parties' systems, which, if compromised, could impact our operations.


text: Education and Awareness: We understand the importance of informed personnel, so we conduct mandatory, regular training on cybersecurity threats. This training aims to equip our staff with the necessary tools to confront these threats effectively and disseminate updates on WidePoint's evolving information security policies, standards, processes, and practices.


text: We are committed to maintaining robust cybersecurity defenses through regularly evaluating and improving our policies, standards, processes, and practices. This commitment is actualized through a diverse array of assessment and testing activities, which include: Comprehensive Audits and Assessments: We conduct audits and assessments to scrutinize the efficacy of our cybersecurity measures.


text: Tabletop Exercises and Threat Modeling: Engaging in tabletop exercises and threat modeling allows us to simulate and prepare for potential cybersecurity scenarios, ensuring readiness and adaptability. Vulnerability Testing: Vulnerability testing is performed to proactively identify and address potential security weaknesses.


text: External Evaluations: We regularly commission third parties to conduct in-depth assessments to ensure an unbiased and comprehensive evaluation. These include information security maturity assessments, audits, and independent reviews of our information security control environment and its operational effectiveness.


text: Based on the insights gleaned from these assessments, audits, and reviews, we dynamically adjust and refine our cybersecurity policies, standards, processes, and practices to continuously enhance our cybersecurity posture.


text: By engaging in these rigorous and diverse testing and assessment activities, we verify the current effectiveness of our cybersecurity measures and identifies areas for continual improvement, ensuring our defenses evolve in line with the dynamic nature of cyber threats.


text: Executive Experience and Qualifications Our CEO, CFO, each with over thirty (30) years of risk management experience, and the COO with over twenty (20) years of experience including cybersecurity, possess deep expertise in their respective fields, evidenced by their academic qualifications and professional trajectories. This collective experience underpins our robust approach to managing cybersecurity risks. In addition, we have numerous employees with experience and qualifications related to cybersecurity. We expect to name a Chief Information Security Officer during 2024 as part our cybersecurity program. Our executive officers are responsible for informing the Board and Governance Committee of any material cyber events or risks.


text: Cybersecurity Threats are discussed in ITEM 1 A. RISK FACTORS, under the heading RISKS RELATED TO PRIVACY, CYBERSECURITY AND TECHNOLOGY in this Annual Report on Form 10-K. We are not aware of any material cybersecurity incidents in the past that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition.


text: Risk Management and Strategy The Company recognizes the importance of a cybersecurity risk management program designed to assess, identify, and manage risk associated with cybersecurity threats. Our cybersecurity risk management program (the "Program") is consistent with the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, which incorporates bank regulatory guidance and principles from the National Institute of Standards and Technology Cybersecurity Framework and includes the following risk-based principles: Identification, measurement, mitigation, monitoring and reporting of cybersecurity threats based on internal and external information sharing and resources; Safeguards designed to protect against identified threats, including documented policies and procedures, controls, and employee education and awareness;

companyName: F&M BANK CORP

ticker: FMBM


text: Processes to detect cybersecurity events and improve incident response, including routine testing of incident response, recovery and business continuity plans and processes; and Third-party risk management process to manage cybersecurity risk with service providers, suppliers, and vendors.


text: The Program is designed to adapt to an evolving landscape of emerging cybersecurity threats and advancing technology to determine the Company's cybersecurity preparedness. Through routine data gathering, emerging risks, internal incidents, technology investments and internal controls, our Program and overall cybersecurity risk strategy is adjusted as needed.


text: The Program is supported by regular training of information security employees and awareness training and activities for executives, directors, and employees through which we communicate our cybersecurity policies, standards, processes, and practices to foster a culture of cybersecurity risk management across the Company.


text: Integrated Risk Management The Program is integrated into the Company's enterprise risk management framework and functions to identify risk, form a strategy to manage risk, implement the strategy, test the implementation, and monitor our technology environment to control risk. The information technology team works closely with stakeholders across security, risk, compliance, operations, other business stakeholders, and senior leadership to conduct an annual cybersecurity risk assessment utilizing the FFIEC Cybersecurity Assessment Tool.


text: Engagement of Third Parties in Connection with Risk Management The Company engages various third parties to evaluate the effectiveness and maturity of the Program. The Company engages an independent third party to audit the cybersecurity risk strategy and preparedness. The Company also maintains cybersecurity insurance, however, the costs related to cybersecurity threats or disruptions may not be fully insured. The Company also engages third parties to perform regular penetration tests, vulnerability scans, disaster recovery tests and cyber exercises to simulate threat actor attacks. Our relationships with third parties enable us to leverage their cybersecurity expertise and industry knowledge to assess our Program and adjust as needed.


text: Risks from Cybersecurity Threats As of the date of this report, we have not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Board of Directors Oversight Our Board's Operational Risk Committee oversees cybersecurity risk.


text: Management's Role in Cybersecurity Risk Management Given the important role of technology in the Company's operations and customer service, the Company has established an Information Technology Steering Committee, which consists of our IT Manager, President, Chief Financial Officer, Chief Experience Officer, Director of Risk Management and Information Security Officer. The Information Technology Steering Committee reviews, monitors, aligns, and prioritizes all significant strategic information technology initiatives and security risks. The Information Technology Steering Committee reports to the Operational Risk Committee and minutes of the committee's meetings are subsequently reported by the Operational Risk Committee to the Company's Board of Directors. Our IT Manager, in collaboration with our Information Security Officer, makes quarterly reports to the Information Technology Steering Committee. Such reports include updates related to key metrics, key risk indicators, key performance indicators, penetration test results, risk assessment results, project updates, incident reports, compliance matters, and operational issues.


text: Risk Management Personnel The Information Security Officer has the primary responsibility for managing the Program to identify, assess, manage, and control cybersecurity risk. The Information Security Officer reports directly to the President. The Information Security Officer has approximately 15 years of experience in cybersecurity, information security risk management, identity and access management, security architecture, vulnerability management, threat intelligence, security operations and incident management and response.


text: Monitoring Cybersecurity Incidents The Information Security Officer is continually informed of and monitors cybersecurity risks and incidents. In the event of a cybersecurity incident, the Company has developed an incident response plan to timely report cybersecurity incidents to the executive management team, the Operational Risk Committee and Board of Directors, as necessary. In addition to facilitating timely evaluation, escalation and reporting of cybersecurity incidents, this plan also sets forth the process for identifying and assessing the severity of cybersecurity incidents, as well as monitoring post-incident mitigation and remediation.


text: Reporting to Board of Directors The Operational Risk Committee receives reports from the President, Information Security Officer, and Director of Risk Management, and briefings on our information security and enterprise risk management programs at least quarterly, including the results of any external audits, bank regulatory examinations and evaluations, as well as maturity assessments of our information security program.


text: CYBERSECURITY GOVERNANCE The Company's Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. The Audit Committee of the Board of Directors is responsible for board-level oversight of cybersecurity risk, however the full Board is typically present for Information Technology (IT) and Cybersecurity briefings. As part of it's oversight role, the Audit Committee receives reporting about the Company's cybersecurity program, activities, threats and incidents (if any) through periodic updates. The cybersecurity program is managed by our outsourced IT infrastructure team with oversight and coordination by our CFO, who reports directly to our CEO. Utilization of an outsourced IT infrastructure team allows Data I/O to access the necessary breadth and depth of leading cybersecurity programs, staff, expertise, and tools. The IT infrastructure team monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity function, including the operation of the Company's incident response plans, which include appropriate escalation to the CFO, CEO and the Audit Committee.

companyName: DATA I/O CORP

ticker: DAIO


text: CYBERSECURITY RISK MANAGEMENT AND STRATEGY The Company has processes in place to identify, assess, and monitor material risks from cybersecurity threats, which are part of the Company's overall cybersecurity risk management and have been embedded in the information systems operating procedures and internal controls. Our IT function manages IT operations and continually evolves and enhances our systems to meet the constantly changing digital environment. Periodic cybersecurity risk assessments are performed to identify, assess, and prioritize potential risks to information, data assets, infrastructure and third party vendors. Additionally, a third-party review and testing of the financial controls over IT as part of our Sarbanes-Oxley internal controls testing is performed annually. The Company addresses significant risks through corrective or mitigating actions as necessary.


text: The Company has also established cybersecurity and information security awareness training programs. Employees with access to the Company's network receive annual training on topics such as phishing, malware, and other cybersecurity risks. Training is administered and tracked through online learning modules with ongoing follow-up testing. All employees and contractors enter into non-disclosure confidentiality agreements. We work to continually evolve our systems to meet the constantly changing digital environment and continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.


text: There have been no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. The nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on the Company's business, financial conditions or results of operations. For more information about the cybersecurity risks we face, refer to the Risk Factors in section "Cybersecurity Risks" in Part I, Item 1A, "Risk Factors".


text: Risk management and strategy We depend on our information technology to conduct our business operations. This technology is predominantly operated on third-party platforms and services. Our business servers are owned and managed by an experienced third-party provider that addresses issues promptly in the event of a cybersecurity threat or incident.

companyName: Lowell Farms Inc.

ticker: LOWLF


text: We have tailored our business applications and hosting services to reduce the impact of cybersecurity incidents. We utilize the Google Cloud Suite for email, office documents, and communication. Our ERP and Financial System operate on RDP and SQL server, which are backed up nightly through a SQL backup. All our servers are backed up to tape and transferred off-site every night. Our third-party provider has the necessary tools to restore and clone servers in a timely manner.


text: Our strategy to mitigate cybersecurity risks includes monitoring and detection efforts, and the deployment of the anti-malware application ESET on all workstations and servers. The management of our Anti-Virus and Anti-Malware is performed by an experienced third party provider. Regarding third parties that manage or utilize our information technology or data, we conduct continuous monitoring of all third-party providers to ensure they adhere to our cybersecurity standards. To date, we have not experienced cybersecurity threats or incidents that have significantly impacted our business.


text: Our Board of Directors delegates the responsibility for cybersecurity oversight to the Audit Committee and our VP of Integration and IT Operations, who also manages our general technology risk.


text: Our VP of Integration and IT Operations collaborates closely with our information technology partners to pinpoint new risks and evaluate our risk management framework. This team includes employees familiar with our products and systems who also possess experience in managing cybersecurity risks.


text: The VP of Integration and IT Operations regularly updates the Audit Committee on cybersecurity-related risks. Our incident response plan involves informing the Management Team and then the Board of Directors about any substantial threats or incidents that occur.


text: We have established procedures for evaluating, recognizing, and managing significant risks stemming from potential unauthorized events occurring on or through our electronic information systems. These procedures comprise an important part of our overall enterprise risk management systemand are aimed at preventing, detecting, or mitigating data breaches, theft, misuse, unauthorized access, or any other security incidents or vulnerabilities affecting digitally stored data. Internally we have an Internet, Email and Computer Use Policy and all of our employees have been trained on the policy and related tools. Additionally, we employ processes to manage and identify risks arising from cybersecurity threats linked to supplier and customer relationships and our utilization of third-party technology and systems.

companyName: ENDRA Life Sciences Inc.

ticker: NDRA


text: We adhere to a risk management framework based on applicable laws and regulations to handle cybersecurity risks across our products, services, infrastructure and corporate assets. We regularly conduct risk assessments to gauge the effectiveness of our systems, identifying areas for improvement. These processes enable us to make informed, risk-based decisions and prioritize cybersecurity measures and risk mitigation strategies. Our risk mitigation efforts encompass a range of technical and operational actions.


text: Our cybersecurity risks and related responses are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by our Board of Directors. Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents. However, we cannot guarantee that our efforts will prevent any cybersecurity incident from occurring.


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have, or are likely to, materially affect us, our business strategy, results of operations, or financial condition.


text: The banking industry is increasingly reliant on information technology systems and digital platforms to conduct business operations, process transactions, and interact with customers. As a result, we are exposed to various cybersecurity risks, including but not limited to Cyber attacks: We are vulnerable to cyber attacks including malware, phishing, ransomware, and denial-of-service attacks, could disrupt operations, compromise sensitive information, and result in financial losses.

companyName: COMMUNITY BANCORP /VT

ticker: CMTV


text: Data Breaches: Despite implementing robust security measures, systems and networks may be breached, leading to unauthorized access to customer data, proprietary information, or intellectual property.


text: Third-Party Risks: We rely on third-party service providers and vendors which exposes the Company to cybersecurity risks associated with systems and processes. A breach or failure in critical systems could impact operations and reputation.


text: Regulatory Compliance: The Company is subject to various regulatory requirements related to cybersecurity, data protection, and privacy. Non-compliance with these regulations could result in financial penalties, legal liabilities, and reputational damage.


text: Reputation Risk: A significant cybersecurity incident could damage the Company's reputation and erode customer trust, leading to customer attrition, negative publicity, and loss of business opportunities.


text: Operational Disruption: Cybersecurity incidents may disrupt operations, including online banking services, payment processing, and customer support, resulting in financial losses and operational inefficiencies.


text: Financial Impact: Cybersecurity incidents may result in direct financial losses, such as fraud-related expenses, remediation costs, and legal fees, as well as indirect costs associated with business interruption and reputational damage. Regular risk assessments and vulnerability testing of systems and networks. Deployment of advanced cybersecurity technologies, including firewalls, intrusion detection systems, and encryption protocols. Employee training and awareness programs to enhance cybersecurity awareness and promote best practices. Incident response and business continuity plans to ensure a timely and effective response to cybersecurity incidents.


text: The Information Security Program is led by the Company's Information Security Officer (ISO) who works with the Privacy Officer, Security Officer, and IT Manager to review and identify security risks and controls within each functional area of the Bank. Risk assessments are updated at least annually or more frequently if circumstances warrant. Status and compliance with the program is reported by the ISO to the Information Technology Steering Committee and the Board annually or more frequently if circumstances warrant. The report discusses material matters relating to the program including the risk assessment; risk management and control decisions; service provider arrangements; results of monitoring and testing; security breaches and management's responses; gaps; and recommendations for changes to the program.


text: However, despite these efforts, we cannot guarantee that these cybersecurity measures will prevent all cyber threats or mitigate all potential impacts. Cybersecurity threats are constantly evolving, and the Company may be susceptible to new and unforeseen risks in the future.


text: In conclusion, cybersecurity risks pose significant challenges to business operations and financial stability. The Company continuously monitors and evaluates its cybersecurity posture to adapt to emerging threats and safeguard customers' information and assets.


text: Cybersecurity Governance Our Board considers cybersecurity risks as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.

companyName: 374Water Inc.

ticker: SCWO


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program and receives updates on the cybersecurity risk management program from management at least annually. In addition, management updates the Audit Committee regarding any material or significant cybersecurity incidents, as well as incidents with lesser impact potential as necessary. The Audit Committee reports to the full Board annually regarding cybersecurity.


text: Incident Response and Assessment Policies and Procedures We align with industry-standard cybersecurity frameworks designed to protect the company and customer data from unintentional disclosure, cybersecurity events, and other threats of all severity levels. As part of our alignment with these frameworks we our in the process of implementing a Cybersecurity Incident Response Plan that outlines actions to be taken after identifying a suspected information security breach and the people responsible for managing those actions. Additionally, this plan will outline communication responsibilities during incidents of all severity levels.


text: The Company approaches cybersecurity as an enterprise-wide risk and uses external resources to assess risk and manage its IT and 24x7 cybersecurity operations, including managed service providers who assist in the support of key business systems. The Company may also periodically engage external consultants to assist with cybersecurity incident management, particularly where advanced or specialized expertise may be required. If a material cybersecurity breach occurs, the incident will be reviewed by management to determine whether further escalation is appropriate. The Executive Chairman of the Board and Chief Executive Officer and the Interim Chief Financial Officer have primary responsibility for this review and assessment. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive team, and if deemed necessary or appropriate, the Board of Directors. The Board Audit Committee is responsible for reviewing and discussing the adequacy and effectiveness of the Company's information security policies and the procedures and controls regarding information systems. In addition, we plan to consult with outside counsel as appropriate, including on materiality analyses and disclosure matters, and to assist in making the final materiality determination regarding disclosure and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents as appropriate.

companyName: Catheter Precision, Inc.

ticker: VTAK


text: Lendway's cyber environment at December 31, 2023 consisted primarily of outsourced information technology ("IT") operations. The outsourced provider has a cybersecurity framework which includes multiple products implemented to ensure the security of Lendway's environment. Annual internal and external vulnerability scans are also completed to ensure we mitigate any risks proactively. The Company's internal operations are PC based and the PCs have up to date security software. Regular phishing exercises are conducted, and employee awareness training is conducted annually by our outsourced provider.

companyName: BLOOMIA HOLDINGS, INC.

ticker: TULP


text: Our full Board of Directors and our Audit Committee provide oversight of our risk management program, which includes cybersecurity. The Audit Committee, as part of its charter to review the Company's practices with respect to risk assessment and risk management, receives updates on internal control, including those relating to IT general controls and cybersecurity.


text: With the acquisition of Bloomia on February 22, 2024, the Company will include the IT environment of Bloomia in its cybersecurity processes and oversight at the corporate and board level. Bloomia's cybersecurity is managed by a third party vendor.


text: As of the date of this report, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cyber security threats, as such term is defined in Item 106(a) of Regulation S-K. We have certain processes for assessing, identifying and managing cyber security risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, and protect employee information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards and routine review of our policies and procedures to identify risks and refine our practices. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: TOMI Environmental Solutions, Inc.

ticker: TOMZ


text: We have not encountered cyber security challenges that have materially impaired our operations or financial condition. Additional information regarding risks from cyber security threats is provided at "Item 1A. Risk Factors."


text: Governance; Board Oversight The Audit Committee of our Board provides direct oversight over cyber security risk and provides updates to the Board of Directors regarding such oversight, when and if appropriate. Management provides periodic updates to the Audit Committee regarding cyber security matters including significant new cyber security threats or incidents, when and if appropriate.


text: Cybersecurity Risk Management and Strategy. We depend on software applications, information technology systems, computing infrastructure and cloud service providers to operate our business. Certain of these systems are managed, hosted, provided or used by third parties, to assist in conducting our business and which have their own cyber security measures in place. We implement generally applicable industry standards and best practices processes for the assessment, identification, and management of material risks from cybersecurity threats to our information technology systems. Our Information Security Coordinator oversees our information security policies and procedures. Our Information Security Coordinator maintains a cyber incident reporting and response process and provides management notifications based on the seriousness of any incident. Our information security policies and procedures are required to be reviewed on a regular basis.

companyName: Onfolio Holdings, Inc

ticker: ONFO


text: We have not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations; however, there can be no guarantee that we will not experience such an incident in the future. For a description of the risks from cybersecurity threats that may materially affect our Company and how they may do so, please see "Risk Factors - Risks Related to Information Technology Systems, Intellectual Property and Privacy Laws" included in Part I, Item 1A of this Annual Report on Form 10-K. If our security measures are breached and an unauthorized party obtains access to our proprietary business information, our information systems may be perceived as being unsecure, which could harm our business and reputation, and our proprietary business information could be misappropriated which could have an adverse effect on our business and results of operations."


text: Cybersecurity Governance. Our Nominating and Corporate Governance Committee has primary responsibility for overseeing our risk-management program relating to cybersecurity, although our Board of Directors participates in periodic reviews and discussion dedicated to cyber risks, threats, and protections.


text: We assess and identify security risk to the organization by: conducting assessments of risk, including likelihood and magnitude, from unauthorized access, use, disclosure, disruption, modification or destruction of information systems and the related information processes, stored or transmitted;

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: performing risk assessments and producing security assessment reports that document the results of the assessment for use and review by information technology senior leadership, including the Chief Technology Officer;


text: ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended and producing the desired outcome; and continuously scanning for vulnerabilities and remedying all vulnerabilities in accordance with the associated risk.


text: We have not experienced a material cybersecurity breach in the past five years and, as a result, there have been no charges related to a breach in the past five years. Moreover, no risks from cybersecurity threats have materially affected our business strategy, results of operations, or financial condition. While we have implemented processes and procedures that we believe are tailored to address and mitigate the cybersecurity threats that we face, there can be no assurances that such an incident will not occur despite our efforts, as more fully described in Item 1A ("Risk Factors – Our business could be adversely affected by a security breach or other attack involving our computer systems or those of one or more of our vendors.") in this Annual Report.


text: We have established a continuous monitoring strategy and program, which includes: a set of defined security metrics to be monitored; performance of security control assessments on an ongoing basis; addressing results of analysis and reporting security status to the executive team; monitoring information systems to detect attacks and indicators of potential attacks;


text: identification of unauthorized use of the information system resources; and deployment of monitoring devices strategically within the information system environment.


text: Our Corporate Sustainability and Risk Management Committee of the Board of Directors has been delegated the power and authority to oversee and make recommendations to the Board with regard to our overall approach to risks relating to business operations, including with regard to information technology and cybersecurity. In an annual presentation, the committee received a presentation from our Chief Technology Officer regarding our approach to cybersecurity, which included the following topics: the confidentiality of nonpublic information and the integrity and security of our information system, the cybersecurity policies and procedures, material cybersecurity risks to us, and the overall effectiveness of our Company's cybersecurity program.


text: Airship's cybersecurity and risk management program is intended to protect the confidentiality, integrity, and availability of our critical information systems and the data resided on them. Due to the nature of our business and our customers, we face various cybersecurity challenges and threats, including attempts to gain unauthorized access to our codebase, proprietary or confidential information, denial-of-service attacks, attacks from foreign nations, as well as threats to our identity and personnel. We have designed our IT systems and processes with the intention that our solutions should defend against the ever-evolving threat landscape while remaining agile to keep up with such threats.

companyName: Airship AI Holdings, Inc.

ticker: AISP


text: Airship leverages a combination of the NIST Cyber Security Framework alongside the CMMC framework to protect its assets and secure our supply chain for our customers. We use the controls from these frameworks as well as guidelines and best practices from the industry to develop our cybersecurity plan. Our cybersecurity plan and its elements are reviewed regularly to ensure they meet the requirements and expectations of our security needs.


text: Airship's cybersecurity program is spearheaded by their cybersecurity department with approval from executive management. The stakeholders have been identified and know their roles within the cyber security process as well as having all roles be documented.


text: Risk is assessed based on multiple factors. First, our IT team updates and maintains our asset inventory to ensure all assets are included in our risk management process. From there, key assets are identified, and risk is assessed based on business impact, availability of information, and attack feasibility. After the risks have been identified, they are reviewed with the stakeholders for action plans or sign-off on the acceptance of risk.


text: Airship leverages third party applications and software to help identify vulnerabilities within our system's boundaries. These vulnerability lists are used to create remediation plans and are prioritized based on severity and attack feasibility.


text: The Company performs security awareness training with its employees. Our security policy is also provided to employees upon employment providing them with the rules and policies to follow so that proper security practices are understood and performed.


text: Business continuity and disaster recovery plans are also a part of our cybersecurity process. Ensuring data continuity in times of disaster or other incidents is important so that proper security is followed in times of impact to our business. Our business continuity and disaster recovery plan includes a list of items that are essential to our business along with RTO and RPO information. The plan lists what each employee in the plan is responsible for and provides contact information.


text: Sensitive and confidential data is a part of business. Airship leverages an encryption and signing policy that identifies the type of information Airship stores and what level of encryption and signing is required for the data. This document also details the overarching requirements for encryption such as allowed cyphers, encryption methods, and key storage.


text: Airship has had one cybersecurity incident in the last decade. The Company was the victim of a ransomware virus that encrypted several machines on Airship's corporate network. The threat was quickly identified and isolated before significant damage could be done. The attack did not affect business operations and did not have a significant financial impact on the Company. Most files affected had backup and Airship was able to remove affected files and restore them from backup.


text: We review cybersecurity risk as part of our overall risk-management program. This ensures that cybersecurity risk management remains a meaningful priority in our business strategy and operations. Our risk management strategy for cybersecurity generally includes: Identification: We aim to proactively identify the manners in which our business could be materially impacted by cybersecurity risks.

companyName: SUI Group Holdings Ltd.

ticker: SUIG


text: Assessment: We periodically assess our risks relating to cybersecurity threats, including risks relating to our reliance on third parties. In so doing, we consider the likelihood and impact that could result from the manifesting of such risks, together with the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Management: If deemed appropriate, we design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures.


text: We presently do no engage third parties to assist with evaluating the effectiveness of our risk-management and cybersecurity practices. The Company did not have any material cybersecurity breaches during the year ended December 31, 2023.


text: Our criteria for determining the materiality of cybersecurity incidents includes assessing potential or actual financial impacts, reputational damage, and operational disruptions. In the event of a cybersecurity incident, all material and known facts would be recorded, including their nature, scope and financial implications; and Form 8-K filings required in relation to any material cybersecurity incident would be prepared and timely filed (with any reasons for delayed disclosures being documented in writing). The Company believes these steps will help ensure compliance with SEC requirements and maintain overall stakeholder confidence in the Company.


text: The Audit Committee of our Board of Directors is the governance body involved in, and ultimately responsible for, cybersecurity oversight. They will generally coordinate with our Chief Financial Officer in this regard. If needed, the full Board would be updated on cybersecurity risks and incidents. None of our directors on the Audit Committee nor our Chief Financial Officer have particular experience in cybersecurity matters.


text: In the event of a cybersecurity concern or event, our incident response approach would have our Chief Financial Officer report to our Audit Committee and full Board of Directors, as well as legal counsel.


text: Risk Management and Strategy Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks, and resiliency against incidents. Our cybersecurity risk management processes include accessing security controls, monitoring systems, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We engage a third-party information security officer who maintains, monitors, and ensures the security of our digital assets. We implement risk-based controls to protect our information, the information of our customers, suppliers, and other third parties, our information systems, our business operations, and our products. We maintain security programs that include physical and technical safeguards. We monitor cybersecurity vulnerabilities and potential attacks, and we evaluate the potential operational and financial effects of any threat and of cybersecurity countermeasures made to defend against such threats. We continue to integrate our cyber practices into our enterprise risk management practices, which is overseen by our Board of Directors. In addition, we assess the risks from cybersecurity threats, periodically engage third-party tools to assist us in enhancing and monitoring our cybersecurity risks, primarily spam and suspicious email filters, and regularly back up company information.

companyName: UNITED STATES ANTIMONY CORP

ticker: UAMY


text: We have experienced cybersecurity incidents, primarily related to phishing emails, and may in the future experience, whether directly or indirectly, cybersecurity incidents. While prior incidents have not materially affected our business strategy, results of operations, or financial condition, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations, or financial condition. See risks related to cybersecurity and business disruptions in "Risk Factors" in this Form 10-K.


text: Our Board of Directors is responsible for risk oversight. Our chief executive officer and chief financial officer, with input from and potentially attendance by our third-party information security officer, provide presentations to the Board of Directors on cybersecurity risks or threats as necessary. In the event of a potentially material cybersecurity event, the Chairman of the Board is notified and briefed, and a meeting of the full Board of Directors would be held, as appropriate.


text: Management and the Company's third-party information security officer discuss information technology needs and activity and assess and manage material cybersecurity risks and the Company's practices for the prevention, detection, mitigation, and remediation of cybersecurity incidents, as necessary and appropriate. Our third-party information security officer has 30 years of experience in the IT management field and has consulted with large and mid-size corporations on proper IT processes and security. Our CEO during the year ended December 31, 2023 and our CFO have managed information technology departments during their careers. Our CFO was trained as an auditor and an information technology auditor at the public accounting firm of Ernst & Young LLP and audited public companies, information technology departments, and third-party information technology service providers for 12 years.


text: We use, store and process data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: Fyntechnical Innovations Inc

ticker: FYNN


text: Cyber Risk Management and Strategy Under the oversight of the Board of Directors since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident. We also have a process to require corporate employees to undertake cybersecurity training and compliance programs annually.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems.


text: We use, store and process data for and about our customers, employees, partners, and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: Laser Photonics Corp

ticker: LASE


text: Cyber Risk Management and Strategy Under the oversight of the Board of Directors and Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident. We also have a process to require corporate employees to undertake cybersecurity training and compliance programs annually.


text: Further, we have processes in place to evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that will have access to Company data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement, and system monitoring.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, please see Item 1A. Risk Factors, the section titled "Risk Factors—Risks Related to our Business and Our Industry— Internalsystem or service failures could disrupt our business and impair our ability to effectively provide our services and products to our customers, which could damage our reputation and adversely affect our revenues and profitability." and " As a U.S. defense contractor, we are vulnerable to security threats and other disruptions that could negatively impact our business. "


text: Our IT Manager and our IT Administrator oversee our information security program and lead our information security team. Our IT Manager has primary responsibility for assessing and managing our cybersecurity threat management program, informed by over ten years of experience leading cross-functional organizations in the development and operation of large-scale systems.


text: Our IT Manager reports quarterly to the Audit Committee of the Board of Directors on the information security program and related cyber risks and provides an annual update to the Board of Directors on the Company's overall risk management strategy, which includes addressing cybersecurity risks. Any cybersecurity incidents at the Company are reported to the Audit Committee by the IT Manager.


text: Our Board is responsible for the oversight of risks from cybersecurity threats and directly oversees our cybersecurity policies and practices, internal controls regarding information security, and compliance with legal and regulatory requirements regarding cybersecurity risks. The Board receives regular reports and updates on cybersecurity matters from our management, including developments on existing and new cybersecurity risks and how management is addressing and/or mitigating such risks, cybersecurity and data privacy incidents (if any), the status of key information security initiatives, vulnerability assessments, as well as on existing and emerging threat landscapes. Additionally, on at least an annual basis, the Board reviews and discusses with management our policies and programs with respect to cybersecurity threats.

companyName: TPT GLOBAL TECH, INC.


text: We do not have a dedicated security team, but our Chief Executive Officer monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in accordance with our incident response and recovery plans. Threats and incidents that are identified as potentially significant are promptly reported to the Board. Our dedicated CEO has over 20 years of experience in managing and monitoring cybersecurity.


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity program is designed to protect its assets and information, and to maintain the secure storage and of proprietary information relating to our customers, employees, applicants, vendors, and other parties, including financial information and personal information. The Company's cybersecurity program is formed using a risk-based approach with recommendations from cybersecurity consultants, cybersecurity insurers, and other third-party consultants.

companyName: SMITH MIDLAND CORP

ticker: SMID


text: Our cybersecurity program includes, among others: a cybersecurity education program with on-going employee activities, which include frequent phishing simulation and testing and annual training; access management and access controls with periodic reviews;


text: when appropriate, use of external subject matter specialists, including assessors, insurers, and consultants, to provide incident response services and risk assessments; engagement in security practices that include physical, administrative, and technical safeguards of systems and hardware;


text: The Company continues to invest in its cybersecurity program and performs assessments to identify opportunities to enhance training and awareness and improve processes and technology used to identify, prevent, detect, respond, and recover from cybersecurity incidents.


text: Our Board of Directors has overall responsibility for risk oversight and oversees the implementation and continuous improvement of our cybersecurity program and compliance with disclosure requirements. The Board of Directors receives regular reports and periodic briefings from the Chief Financial Officer on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities. Our cybersecurity program is overseen by the Chief Financial Officer in conjunction with a third-party service provider. The third-party service provider has the primary responsibility for the Company's cybersecurity risk management program. At the time an incident is identified, the Company completes an evaluation and summarizes the incident that is shared with the Board of Directors to effectively manage resources to reduce risk and prevent future incidents.


text: Incident Disclosure To date, the Company has been subject to cyber related incidents, as previously disclosed in the Company's Quarterly Report for the quarters ended June 30, 2023 and September 30, 2023 and within this Annual Report. Since the identification of the incident, we have implemented additional safeguards designed to detect and prevent cybersecurity events that may have a material adverse effect on the Company.


text: Cybersecurity Risk Management and Strategy Assessment, identification and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes to promote a company-wide culture of cybersecurity risk management. Our Chief Financial Officer is responsible for the evaluation of material risks from cybersecurity threats and reports to both the Company's executive management team and the Audit Committee of the Board of Directors. We also regularly use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including cybersecurity consultants, as well as data backup and recovery providers.

companyName: Loop Industries, Inc.

ticker: LOOP


text: We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature ("Information Systems and Data").


text: The Chief Financial Officer is responsible, with the support of the Company's internal IT staff and external service providers, for helping to identify, assess and manage the Company's cybersecurity threats and risks, using internal resources as well as third-party service providers, by monitoring our threat environment using, among other things, manual processes, automated tools, internal audits, threat and vulnerability assessments, evaluating threats reported to us, evaluating our risk profile, and subscribing to reports and services that identify cybersecurity threats.


text: We implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include amongst others data encryption, risk assessments, network security and access controls, physical security, asset management, and systems monitoring. In addition, to oversee and identify any risks associated with our use of third-party service providers, we review Service Organization Controls reports of such third-party service providers when onboarding the provider and annually thereafter.


text: To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools, some of which are managed by a third-party service provider.


text: Cybersecurity threats have not materially affected the Company, including its business strategy, results of operations or financial condition. The Company does not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which it is aware are reasonably likely to materially affect the Company.


text: Cybersecurity Governance Our Board of Directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. Pursuant to the Audit Committee Charter, the Audit Committee of the Board of Directors oversees management's processes for identifying, monitoring and addressing enterprise risks. In addition, the Audit Committee of the Board of Directors discusses with management the adequacy and effectiveness of the Company's policies and procedures regarding information technology risk management and internal controls related to cybersecurity.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of the Company's management. In particular, the Chief Financial Officer is responsible for hiring appropriate personnel and engaging external service providers with relevant cybersecurity expertise, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes and technologies, and reviewing security assessments and other security-related reports. In addition, the Chief Financial Officer provides reports to the Audit Committee concerning the Company's cybersecurity posture and significant threats and risks and the processes to address them.


text: Our security incident response plan ("SIRP") is designed to escalate certain cybersecurity incidents to members of the Company's executive management team depending on the circumstances. The Chief Financial Officer and relevant department heads work with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. The SIRP provides for escalation of potentially material cybersecurity incidents to the Audit Committee.


text: Cybersecurity Risk Management and Strategy We have established processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. To prevent, detect and respond to information security threats, we maintain a cyber risk management program that employs Cyber Security Framework ("CSF") in accordance with the National Institute of Standards and Technology ("NIST") security framework. CSF is a set of voluntary guidelines that help organizations assess and improve their cybersecurity posture by implementing processes for identifying and mitigating risk, and detecting, responding to and recovering from cyberattacks.

companyName: AEHR TEST SYSTEMS

ticker: AEHR


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.


text: Our Security Awareness Program includes training that reinforces our information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by Company-wide testing initiatives.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers or who have access to our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We are exposed to cybersecurity threats or incidents."


text: Cybersecurity Governance One of the key functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee has primary responsibility for oversight of information security risks, including fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks, and provides regular updates to the Board of Directors on such matters. The Audit Committee receives regular reports from our Chief Operating Officer on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. Information security risk is a significant oversight focus area for the Audit Committee, as well as the entire Board of Directors. Over the course of fiscal year 2024, the Audit Committee received four separate cybersecurity briefings from our Chief Operating Officer.


text: Our Chief Operating Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Operating Officer, who leads a team responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, has extensive experience and background in information technology, cybersecurity, enterprise strategy, risk management. Additionally, our Chief Operating Officer chairs our Cybersecurity Incident Response Team, which is responsible for prevention, identification, containment, eradication and remediation of cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy We have established and implemented a comprehensive cybersecurity risk management program aimed at safeguarding the confidentiality, integrity, and availability of our critical information technology ("IT") systems and sensitive information.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: Our cybersecurity risk management program is fully integrated within our broader enterprise risk management framework, leveraging consistent methodologies, incident reporting channels, and governance processes. These approaches are used not only for cybersecurity risks but also for managing other areas of risk, including legal, compliance, strategic, operational, and financial. The program is continuously assessed and refined, using the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") as a guiding tool to identify, prioritize, and manage cybersecurity risks that could significantly affect our operations, financial performance, or business objectives.


text: Cybersecurity Incident Response Plan ("CIRP"): Our CIRP ensures we are prepared to respond to, report, and remediate any cybersecurity incidents effectively. Led by the Chief Information Officer ("CIO"), our corporate compliance and risk management team manages all aspects of incident response. For significant incidents, additional third-party resources would be mobilized to mitigate impact on the business.


text: Continuous Vulnerability Management: We continuously monitor our IT networks and legacy systems to identify threats that may adversely affect critical systems and information, ensuring that our broader IT environment remains secure.


text: Third-Party Cybersecurity Consultants: We engage trusted third-party cybersecurity experts to enhance our security posture, perform assessments, and provide strategic guidance, ensuring continuous improvement in our cybersecurity approach.


text: Cybersecurity Awareness Training: Employees, incident response teams, and senior management undergo regular training to ensure awareness of evolving cybersecurity threats and the appropriate responses.


text: Risk Management for Third-Party Providers: We conduct due diligence when selecting and periodically reviewing third-party service providers, suppliers, and vendors to ensure they comply with necessary cybersecurity standards.


text: Cybersecurity Governance Our executive team and Board of Directors are actively involved in overseeing cybersecurity risks. The executive team and the CIO oversee the Company's information security efforts and cybersecurity governance. This team regularly reviews our cybersecurity posture and any significant incidents that have occurred.


text: The management of our cybersecurity risks is led by the CIO and the executive team who bring over 35 years of combined experience in cybersecurity, IT, and risk management. This team is responsible for the overall cybersecurity risk management program, collaborating with internal teams, external consultants, and cross-functional divisions. Their efforts are supported by threat intelligence from various sources, and they regularly benchmark our security practices against the NIST CSF.


text: Our CIO reports regularly to the executive team, providing updates on cybersecurity strategies, current threats, and long-term planning. Additionally, the CIO provides an annual cybersecurity update, presenting an overview of significant cybersecurity risks and their potential impact on internal controls.


text: In the event of a significant cybersecurity incident that escalates to a corporate crisis, the executive team and the Board will be engaged in alignment with the corporate compliance and risk protocols.


text: While LightPath Technologies faces various cybersecurity threats as part of routine operations, no risks have been identified to date that could materially impact the company's operations, strategy, financial condition, or overall business performance.


text: We engage third parties to assess the effectiveness of our cybersecurity and technology management strategy and continue to seek to implement new, and improve existing, processes regularly to adjust for changes in technology, internal or external threats, business strategy, and regulatory requirements. We, and our third parties, have deployed managed detection and response services to monitor our technology infrastructure and information systems for possible threats. Our technology management strategy also includes ongoing security training and education for employees regarding threats, including their role and responsibility in detecting and responding to such threats.

companyName: PALATIN TECHNOLOGIES INC

ticker: PTNT


text: In the last two fiscal years, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition. Although we proactively attempt to prevent all threats, we are unable to eliminate all risk from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A. Risk Factors "Our internal computer systems, or those of our third-party contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs."


text: While our board of directors is responsible for oversight and risk management in general, our audit committee provides oversight of our technology management strategy to ensure that cybersecurity threats and risks are identified, evaluated, and managed. The audit committee receives periodic updates from our management team regarding the overall state of our technology management strategy and any relevant risks from cybersecurity threats and cybersecurity incidents. Our management team is responsible for assessing and managing the material risks from cybersecurity threats.


text: We are a start-up company with limited operations, yet we recognize that we are subject to various cybersecurity risks that could adversely affect our business. Cyberattacks on companies around the world continue to increase, which cause operational failures, compromised sensitive corporate or customer data, and/or result in significant financial damages. These attacks occur over the internet, through malware, viruses or attachments to e-mails, or through inside actors with access to systems within the organization.

companyName: GenFlat Holdings, Inc.

ticker: GFLT


text: Risk Management and Strategy As part of our overall risk management, we focus on a comprehensive approach to identifying, preventing and mitigating cybersecurity threats and incidents. We deploy technical safeguards that are designed to protect our Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which we evaluate and improve on a periodic basis.


text: Our Chief Executive officer is the sole member of our Board of Directors, and he is responsible for oversight of cybersecurity risk. Our Chief Executive Officer, along with our President and Chief Operations Officer, who are currently our only other employees, are responsible for the ongoing managing and assessing of our cybersecurity practices and reporting on such practices and risks. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Board of Directors and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken. We believe we are appropriately staffed (as supported by IT consultants and service providers, as needed) to support a healthy cybersecurity posture given our Company's size and scope.


text: To date, there have been no risks identified from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect our Company. However, despite all of the above aforementioned efforts, a cyberattack, if it occurred, could cause system operational problems, compromise important data or systems or result in an unintended release of confidential information. See "Item 1A. Risk Factors" for additional discussion of cybersecurity risks impacting our Company.


text: Our cybersecurity and risk management program is intended to protect the confidentiality, integrity, and availability of our critical information systems and the data resident on them. Due to the nature of our business and our customers, we face cybersecurity challenges and threats, including attempts to gain unauthorized access to our intellectual property, trade secrets, codebase, proprietary or confidential information, denial-of-service attacks, attacks from foreign nations, as well as threats to our identity and personnel. We have designed our IT systems and processes with the intention that our solutions should defend against the ever-evolving threat landscape while remaining agile to keep up with such threats.

companyName: USBC, Inc.

ticker: USBC


text: We leverage a combination of cyber security frameworks to protect its assets. We use the controls from these frameworks as well as guidelines and best practices from the industry to develop our cybersecurity plan. Our cybersecurity plan and its elements are reviewed regularly to ensure they meet the requirements and expectations of our security needs. We have an information security policy in place, which includes monthly meetings with outside cybersecurity experts to review and maintain the procedures up to current standards.


text: Our cybersecurity program is spearheaded by its software department, with support from external advisors and approval from executive management. The stakeholders have been identified and know their roles within the cyber security process as well as having all roles be documented.


text: The Audit Committee of the Board of Directors performs an annual review of our cybersecurity program, including management's actions to identify and detect threats. The Board receives periodic reports and annual updates on our crisis management plan which includes cybersecurity. Both the Chief Science Officer and the Chief Financial Officer share responsibility for our program and solicit support of third party experts as necessary.


text: Risk is assessed based on multiple factors. First, our IT and administrative team updates and maintains our asset inventory to ensure all assets are included in our risk management process. From there, key assets are identified, and risk is assessed based on business impact, availability of information, and attack feasibility. After the risks have been identified, they are reviewed with the stakeholders for action plans or sign-off on the acceptance of risk.


text: We leverage third party applications and software to help identify vulnerabilities within our system's boundaries. These vulnerability lists are used to create remediation plans and are prioritized based on severity and attack feasibility.


text: Sensitive and confidential data is a part of business. We leverage an encryption and signing policy that identifies the type of information we store and what level of encryption and signing is required for the data. This document also details the overarching requirements for encryption such as allowed cyphers, encryption methods, and key storage.


text: We have had one cybersecurity incident in the last decade. A company-issued computer was reported stolen from an employee's residence. This incident represented a potential cybersecurity threat, as the device contained sensitive company information, including access credentials, confidential data, and proprietary software. The threat was quickly identified and isolated before significant damage could be done. This incident did not affect business operations and did not have a financial impact on our company. Our cybersecurity experts promptly locked the device, changed all relevant passwords and access credentials, initiated a remote wipe, and notified relevant teams and law enforcement, everything according to its info security plan. No proprietary information was lost.


text: CEL-SCI recognizes the importance of assessing, identifying, and managing material risks from cybersecurity threats. CEL-SCI's policies, standards and procedures for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management system. In this regard, CEL-SCI uses various tools and processes to help prevent, identify, and resolve any identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, routine employee awareness updates, annual cyber security training, monthly email testing engaging experts and third-party monitoring and detection tools.

companyName: CEL SCI CORP

ticker: CVM


text: CEL-SCI employs third-party information technology ("IT') consultants to manage its information technology environment and help manage and assess cybersecurity risks. The third-party IT consultants have relevant industry experience, including security solutions and data protection and recovery. Using various monitoring and detection tools implemented into CEL-SCI's internal technology systems, they can identify cybersecurity threats and report such risks to CEL-SCI's management team.


text: CEL-SCI's management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which includes oversight over its third-party IT consultant, monitoring systems and employee engagement. The management team is responsible for reporting any cybersecurity risks identified by CEL-SCI's third-party IT consultant to its board of directors.


text: CEL-SCI's board of directors is responsible for oversight over its risk management system, including review and approval of the risk management system and processes implemented by management to identify, assess, manage and mitigate cybersecurity risks. The Board is responsible for monitoring and assessing material risk exposure to cybersecurity risks, and CEL-SCI's management is responsible for the day-to-day supervision of the material risks CEL-SCI may face.


text: CEL-SCI's risks from cybersecurity threats have not affected or are reasonably not likely to materially affect its business strategy, results of operations, or financial condition.


text: Risk management and strategy We rely on information technology to operate our business. We have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: Pharma-Bio Serv, Inc.

ticker: PBSV


text: As part of our broader risk management framework, we have identified the potential cybersecurity risks to our business. We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes.


text: We have (i) engaged a third-party consultant to assist us with designing controls and our cybersecurity risk management framework; (ii) engaged third party applications to perform penetration testing, and (iii) retained third parties to assist with the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.


text: Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. There can also be no guarantee that our policies and procedures under our cybersecurity risk management program will be properly followed in every instance or that those policies and procedures will be effective. While we devote resources to our security measures designed to protect our systems and information, we cannot guarantee the security measures are infallible.


text: Our Board of Directors oversees our general risk management, including cybersecurity. Policies, practices and potential risks associated with cybersecurity are discussed and managed by the Board of Directors and management.


text: Our chief financial officer has primary responsibility for assessing, monitoring, managing cybersecurity risks and updating the Board of Directors on any significant risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Board of Directors of any material threats or incidents that arise.


text: Under the oversight of the audit committee of the Company's board of directors, and as directed by the Company's Chief Executive Officer, the Company's Director of Information Technology (DIT) is primarily responsible for the assessment and management of material cybersecurity risks. The DIT has over 20 years of experience in information security, risk management, and compliance, and has served essential security and audit roles at other organizations. The DIT is supported by members of senior management who provide cross-functional support for cybersecurity risk management and facilitate the response to any cybersecurity incidents.

companyName: Inuvo, Inc.

ticker: INUV


text: As of the date of this Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor beginning on page 10 of the section entitled "Item 1A. Risk Factors" of this annual report.


text: As a technology vendor within the hosted services segment, Crexendo understands the importance of cybersecurity and data privacy. To proactively protect against related threats, and to be fully prepared for timely and effective response in case of an incident, a comprehensive program has been put in place leveraging the following:

companyName: Crexendo, Inc.

ticker: CXDO


text: The plans are reviewed annually for enhancements and inter-department alignment. Tabletop exercises are conducted to measure the effectiveness of the plan and any findings are factored in towards further revisions of the plans.


text: Security Awareness – Employee awareness towards potential threats and how to steer clear of any phishing or social engineering attacks, is a critical element that governs efficacy of any cybersecurity measures. To that end, Crexendo subscribes to periodic security awareness training, and mock tests for all employees and contractors. Employees and contractors are evaluated for timely completion of the training, on corresponding quiz scores, and based on how they fare tackling mock phishing emails. Worse than minimum required scores trigger actions to guide the person towards better security awareness and thereby score. Disciplinary actions are in store for employees/contractors who still fail to secure the minimum required score.


text: Cybersecurity risk is managed through effective inter-department cooperation towards assessing and remediating risks ranging across corporate IT, software development, software quality process, production network architecture and deployment, and data security/privacy.


text: Crexendo relies on several third-party vendors and contractors in order to provide products and services to its customers as well as to augment the resource pool. On an annual basis, all significant third-party vendors and subservice organizations are assessed for any applicable cybersecurity or service availability risks. Vendors and contractors with access to sensitive data and/or information are expected to meet certain information security requirements.


text: While, we have a comprehensive cybersecurity and compliance program in place as an effort to counter the threats, and while we have not been subject to any cyberattacks that, individually or in the aggregate, have been material to Crexendo's operations or financial condition, there can be no guarantee that Crexendo will not experience such an incident in the future. For more information on the risks from cybersecurity threats that we face, refer to "Risk Factors — Operational Risks — Cyber-attacks impacting our networks or systems could have an adverse effect on our business" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Assessment: We periodically assess our risks relating to cybersecurity threats, including risks relating to our reliance on third parties, as part of our overall risk-management efforts and program. In so doing, we consider the likelihood and impact that could result from the manifestation of such risks, together with the sufficiency of existing policies, procedures, systems, and safeguards to manage such risks. Identification: We aim to proactively identify the manners in which our business could be materially impacted by cybersecurity risks.


text: Management: If deemed appropriate, we would design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures.


text: We presently do not engage third parties to assist us with the assessment, identification or management of cybersecurity risks, or in evaluating the effectiveness of our existing approaches.


text: We are unaware of any material cybersecurity breaches during the year ended December 31, 2024, and given that we rely on relatively few and well known well capitalized larger third-party enterprises for certain of our data and information storage and communication needs, we do not believe that an overall material cybersecurity risk presently exists for our business. Our criteria for determining the materiality of cybersecurity incidents includes assessing potential or actual financial impacts, reputational damage, and operational disruptions.


text: The Audit Committee of our Board of Directors is the governance body involved in, and ultimately responsible for, cybersecurity oversight. They will generally coordinate with our Chief Financial Officer in this regard, with management alerting the committee members to any specific concerns of which management may be aware. In the event of a cybersecurity concern or event, our Chief Financial Officer would report the events or his or her concerns to our Audit Committee and full Board of Directors, as well as legal counsel. None of our directors on the Audit Committee nor our Chief Financial Officer have particular experience in cybersecurity matters.


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, or that management otherwise deems to be significant, as well as ongoing updates regarding any such incident until it has been fully addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the members of management's Cybersecurity Council, which includes the Company's Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Director of Risk, and Director of Information Technology & Cybersecurity.

companyName: EASTERN CO

ticker: EML


text: The Director of Information Technology & Cybersecurity has served in various roles in information technology and information security for over 25 years, including the design and management of operational and cybersecurity activities of two large public companies. The Director of Information Technology & Cybersecurity holds undergraduate and graduate degrees in computer science and is certified in National Institute of Standards and Technology ("NIST"), Cybersecurity Maturity Model Certification ("CMMC"), Cybersecurity and Infrastructure Security ("CIS"), and General Data Protection Regulation ("GDPR"). The Company's CEO and CFO each hold undergraduate and graduate degrees in their respective fields, and each has over 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.


text: While we take cybersecurity seriously, we mitigate the common cybersecurity risks that many companies face by greatly limiting the accessibility of and our reliance on our cyber profile and web-based activities. Of our seven employees (four full-time, three part-time), a total of three employees plus one third-party information-technology consultant (our "IT Consultant") that we contract with have access to our cyber system. No vendors or customers have access to our system, which to some extent minimizes the risk of unauthorized access. No part of our business entails third-party members of the public accessing our accounts, making purchases, or ordering products or services, which also potentially reduces our risks of cyber-attack and minimizes the potential consequences if such an attack were to occur. In addition, although we do have a website, it is maintained offsite and is not connected to our file server, which is maintained separately in our office rather than being connected to the internet or linked to any third-party cloud storage system.

companyName: SOLITARIO RESOURCES CORP.

ticker: XPL


text: Despite our belief that we have a relatively low-risk cybersecurity profile and the minimal threat of cybersecurity incidents that we face, we contract with one IT Consultant to assist us in identifying any potential cybersecurity risks and in implementing and maintaining effective measures to reduce our cybersecurity risks. Our IT Consultant helps ensure that our system is updated with the latest cybersecurity patches and configurations and monitors our system and accounts for suspicious activity.


text: We did not identify any cybersecurity incidents during the year ended December 31, 2024 that have materially affected or are reasonably likely to materially affect Solitario's business strategy, results of operations, or financial condition.


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Director of Technology, is primarily responsible for this cybersecurity component and is a key member of Bank management, reporting directly to the Chief Operations Officer and, as discussed below, periodically to the Bank Board.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our cybersecurity program is designed around the MITRE Adversarial Tactics, Techniques and Common Knowledge ("ATT&CK") Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence to facilitate and promote program effectiveness. Our Director of Technology, Information Security Officer, Chief Operations Officer and key members of their teams collaborate with peer banks and industry groups to review cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We provide regular updates across the Company to highlight recent examples of risks as they are identified. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate management committees and Bank Board. The Incident Response Plan is coordinated through the Chief Operations Officer, and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.