text: We have established a comprehensive incident response plan to swiftly address and recover from cybersecurity incidents, minimizing operational impact. We conduct regular trainings and simulations to enhance our team's awareness and preparedness against cyber threats. Annual penetration testing and regular assessments by external experts validate the effectiveness of our cybersecurity measures. Our proactive approach to addressing identified vulnerabilities affirms the continuous improvement of our security posture.


text: To further strengthen our cybersecurity risk management framework, we have instituted an Information Security Management System ("ISMS") that equips us with advanced risk management capabilities. This system facilitates the development of a detailed risk registry, incorporating impact and likelihood scoring to prioritize risks effectively. Additionally, it guides the creation of comprehensive risk treatment plans and sets targets for residual risk, ensuring a strategic approach to risk mitigation. A key feature of our ISMS is a risk management insights dashboard, which provides real-time visibility into the current state of risk within our environment. This dashboard is an invaluable tool for our management and key stakeholders, enabling them to track risk exposure and trends accurately. Quarterly reviews are scheduled, during which key stakeholders convene to scrutinize and adjust risk treatment plans in response to the latest threat landscape. This process underscores our commitment to a dynamic and responsive cybersecurity risk management strategy, ensuring the ongoing protection of our systems, data, and operations against emerging threats.

companyName: TRANSCAT INC

ticker: TRNS

secItem: Item 1C


text: Use of Consultants and Advisors. We engage various third-party cybersecurity service providers to assess and enhance our cybersecurity practices and assist with the protection and monitoring of our systems and information. This encompasses a range of services, including network monitoring, endpoint protection, vulnerability assessments, and penetration testing. Additionally, we engage cybersecurity consultants, auditors, and other third parties, such as a third-party consulting firm, to rigorously evaluate our cyber processes. This includes a comprehensive assessment of our incident response procedures, ensuring they meet the highest standards of readiness and effectiveness.


text: To ensure the integrity and security of our operations, we have implemented stringent processes to evaluate third-party service providers and vendors that have access to sensitive systems, as well as company and customer data. This evaluation may include due diligence procedures such as assessments of the service provider's cybersecurity posture or recommendations for specific mitigation controls. Following an assessment, we determine and prioritize service provider risk based on potential threat impact and likelihood. These risk determinations are crucial in driving the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Enhancing our third-party vendor risk management, we have introduced two distinct capabilities to further safeguard our operations and sensitive data:


text: 1. We leverage a threat intelligence platform watchlist to curate, monitor, alert, and provide a risk rating to third-party vendors. This platform also offers a dashboard and real-time reporting, enabling us to stay ahead of potential threats by providing continuous oversight and actionable intelligence.


text: 2. Our ISMS platform encompasses vendor risk management capabilities, facilitating initial due diligence through the collection of vendor security-related artifacts. It applies risk ratings and delivers and analyzes annual security questionnaires, scheduling reviews and tasks to ensure compliance and security standards are met consistently.


text: Additionally, our virtual Chief Information Security Officer ("vCISO") compiles a quarterly executive summary of third-party risk, which is presented to both management and the Board. This summary ensures that leadership is informed of the current risk landscape and can make data-driven decisions regarding third-party engagements.


text: Board Oversight and Management ' s Role. The Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee oversees the proper functioning of our cybersecurity risk management program to ensures strategic alignment and governance of our cybersecurity efforts at the highest level. In particular, the Audit Committee assists the Board of Directors in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.


text: Management has implemented robust risk management structures, policies, and procedures, with day-to-day cybersecurity risk management being a core responsibility. Our Chief Financial Officer ("CFO") spearheads the assessment and management of cybersecurity risks on a daily basis, ensuring that our strategies and actions are both proactive and responsive to the evolving cybersecurity landscape. Supporting this effort, we have a cross-departmental approach to cyber security management. This ensures that our executive leadership team receives comprehensive quarterly updates on cybersecurity from various teams within the organization. Such updates are instrumental in promoting stakeholder engagement across all levels and enhancing management's oversight of cybersecurity. The content of these updates includes progress on ongoing cybersecurity initiatives, insights from recent threat assessments or incidents, findings and action plans derived from external vulnerability and penetration tests, and key performance metrics aligned with industry standards.


text: Risks from Material Cybersecurity Threats. Despite ongoing cyber-attacks, such as unauthorized access, phishing, and ransomware, we have not identified any cybersecurity incidents that have materially affected or are reasonably anticipated to have a material effect on our business strategy, results of operations, or financial condition. Our proactive security measures, alongside those of our third-party vendors, aim to protect our information technology systems and the sensitive data they hold. To bolster our cybersecurity posture, Transcat has engaged a third-party Managed Security Services Provider ("MSSP") to enhance our defensive capabilities. This partnership includes comprehensive vulnerability scanning both internally and externally to detect potential security weaknesses before they can be exploited. Our MSSP also provides round-the-clock monitoring through a 24x7x365 Security Operations Center ("SOC"), safeguarding our digital assets ("Endpoint Detection and Response - EDR"), identities ("Identity Detection and Response - IDR"), and integrating supplemental logging sources such as firewalls and Enterprise Resource Planning systems ("Extended Detection and Response - XDR"). Furthermore, we have established Incident Response as a Service ("IRaaS") to ensure rapid and effective action in the event of a security breach.


text: To maintain a strategic overview of our cybersecurity landscape, we conduct quarterly strategic reporting sessions. These sessions are crucial for reviewing security activity and identifying areas for improvement. Based on these reviews, we develop a Plan of Action and Milestones ("POAM") for remediation or re-architecture as necessary. Although these risks have not yet materially impacted our business, we remain vigilant, continuously monitoring and adapting to evolving cybersecurity threats. Our commitment to cybersecurity is integral to our risk management strategy, ensuring the ongoing protection of our systems and the sensitive data they contain.


text: Cybersecurity risk is the business risk associated with a vulnerability to financial or reputational loss due to a cyber attack or a data breach. Our technologies, systems and networks may be subject to cybersecurity threats. Our business, like others within the energy technologies industry, is faced with growing cybersecurity threats as we increasingly rely on digital technologies across our business, some of which are managed by third-party service providers on whom we rely to help us collect, host or process information.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: We recognize the significance of these threats, sometimes referred to as hacking, cybersecurity fraud, and cyberattacks, and maintains processes and procedures to protect its critical systems and sensitive information from unauthorized access. Despite our on-going efforts to improve our cybersecurity infrastructure and processed, there can be no assurance that a sophisticated cyber-attack would timely be detected or thwarted. To date, we are not aware of any material information security breaches and has not incurred significant operating expenses related to information security breaches. For more information on risks related to cybersecurity, please see the section titled "Risk Factors" included under Item 1A of this Annual Report on Form 10-K.


text: Risk Management and Strategy Our cybersecurity risk management program includes operational, technical and physical controls to protect against and respond timely to cybersecurity threats. To address evolving cybersecurity risks and corresponding regulations, our policies and procedures are benchmarked to industry, regulatory and cybersecurity frameworks (e.g., National Institute of Standards and Technology).


text: Management has engaged third-party vendors to assist in monitoring our cybersecurity risk management programs and identifying and responding to any incidents. Additionally, third-party vendors are routinely engaged to evaluate how effectively management as a whole manages cybersecurity risk. We also utilize third-party cybersecurity vendors to assess its protections against identified vulnerabilities.


text: We have developed cybersecurity training for employees concerning cybersecurity risk. This training provides information on security awareness and phishing simulations. All employees are required to attend periodic cybersecurity training. On a regular basis, our IT team shares news and articles related to cybersecurity awareness with all employees.


text: The Director, Global Information Technology and Financial Systems (the "IT Director"), leads an internal team and works directly with our third-party vendors to manage our cybersecurity risk management program and activities. The internal team monitors our information systems for cybersecurity threats, reviews cybersecurity incidents, analyzes emerging threats, and develops and implements risk mitigation strategies. The IT Director periodically reports on the cybersecurity program to the Company's Chief Financial Officer ("CFO").


text: Our cybersecurity risk assessment is performed annually and includes external and internal penetration testing performed by third party vendors to test for vulnerabilities in the Company's environment.


text: The Board of Directors has delegated the oversight of risks from cybersecurity threats to the Audit Committee, which has delegated authority to the CFO to oversee the Company's cybersecurity risk management, including prevention, detection and responding to any suspected cybersecurity incident.


text: The Audit Committee is updated at least annually by the CFO on the status of cybersecurity matters. Contemporaneous reporting is provided on an as needed basis to the Audit Committee and to the full Board of Directors on significant cyber events including response, legal obligations, and outreach and notification to regulators, and third parties when needed.


text: On an annual basis, the IT Director reviews the results of the current state of cybersecurity risk management, including the results of our cybersecurity risk assessment and any action plan to address any identified vulnerabilities.


text: Risk Management and Strategy There have been an increasing number of cyberattacks on companies around the world, which have caused operational failures, compromised sensitive corporate or customer data, and/or resulted in significant financial damages. These attacks have occurred over the internet, through malware, viruses or attachments to e-mails, or through inside actors with access to systems within the organization.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: We have implemented security measures as part of an evolving cybersecurity posture and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks and mitigate the damage that could result from such an attack. Subsequent to March 31, 2024, all employees will begin receiving cybersecurity training and other education regarding their use of computers, information technology, and sensitive data, including specifically how to recognize common attack strategies. As the Company does not have a physical office location, it does not have a local network or in-house servers and proprietary applications. We therefore utilize third parties applications and resources to support our information technology ("IT") needs. All applications utilized by the Company are Software as a Service ("SaaS") offerings. As our applications are developed and managed by third parties, we are dependent on these providers for many functions including disaster recovery during a disaster or cyber incident. Our goal is to only utilize the most secure and trusted providers for our IT needs. To this end, we are currently reviewing the security credentials and certifications of our key application providers. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers.


text: Our cybersecurity management strategy will consist of utilizing a combination of employee education, preventative controls, detective controls and periodic third-party cybersecurity testing. During fiscal year 2024, we began to deploy and utilize enterprise scale technology to support an appropriate cybersecurity posture including: endpoint detection and response, firewalls, security information and event management, email security, multifactor authentication, and vulnerability management, with deployment of these tools to be completed prior to March 31, 2025. As part of the service offering from our outsourced IT security services provider, cybersecurity related alerts will be issued to us as relevant situations develop. These alerts will be evaluated in concert with our IT provider and in the event an alert requires action within our environment, such actions will be taken promptly. Our process and cybersecurity posture will continue to be refined based on the results of periodic cybersecurity assessments conducted jointly with our IT provider. Upon implementation of this strategy, we will report on cybersecurity in reports to the Audit Committee on a semi-annual basis.


text: To operate our business, we rely upon certain third-party service providers (the "Providers") to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, SaaS platforms, managed services, cloud-based infrastructure, content delivery, encryption and authentication technology, corporate productivity services, and other functions. We are in the process of developing vendor management processes designed to help to manage cybersecurity risks associated with our use of these Providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed and the identity of the Provider, our vendor management process may include i) reviewing the cybersecurity practices of such Provider;ii) requiring their completion of written questionnaires regarding their services and data handling practices; and iii) obtaining a Security Operations Center ("SOC") report for the Provider's internal control structure. For our largest third-party provider, our Contract Research Organization ("CRO") which is helping us manage our clinical trial(s), we will conduct a comprehensive security assessment and review, including their cybersecurity practices, protocols and protections and physical security.


text: The Audit Committee is responsible for oversight of cybersecurity risk. Our Chief Executive Officer and Chief Financial Officer are the members of management responsible for managing and assessing our cybersecurity practices. The plan for the future is that they will report to the Audit Committee on cybersecurity on a semi-annual basis. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Audit Committee and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken.


text: We believe we are appropriately staffed (as supported by our outsourced IT provider) to support a healthy cybersecurity posture given our size and scope. Our Chief Financial Officer, who reports to the Chief Executive Officer, is directly responsible for IT functions.


text: To date, there have been no risks identified from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the company. However, despite all of the above aforementioned efforts, a cyberattack, if it occurred, could cause system operational problems, disrupt service to clinical trial sites, compromise important data or systems or result in an unintended release of confidential information. See "Item 1A. Risk Factors" for additional discussion of cybersecurity risks impacting our Company.


text: We evaluate cybersecurity risks as part of our overall enterprise risk management. A steering committee of senior executives meets quarterly to evaluate any changes to the Company's exposure to cybersecurity risks, discuss potential mitigation plans and provide updates on mitigation efforts already underway. Our cybersecurity team keeps up to date on the latest threats and risks through multiple channels and is also involved in evaluating risks associated with any new proposed service providers. We employ a Cybersecurity Engineer, reporting directly to our Chief Technology Officer, who manages our cybersecurity team that is comprised entirely of security professionals with industry recognized certifications. The cybersecurity team within BIO-key is responsible for assessing and managing risks and informing/gaining feedback from the cybersecurity steering committee.

companyName: BIO KEY INTERNATIONAL INC

ticker: BKYI


text: Additionally, our team of dedicated cybersecurity experts/professionals maintain a comprehensive set of cybersecurity policies and standards, including a security incident response framework. The framework is a set of coordinated procedures and tasks that our incident response team executes to ensure timely and accurate reporting and resolution of computer security incidents. The framework details who, how and when appropriate persons or committees, including the Board of Directors and Audit Committee are kept informed on the status of potential cybersecurity incidents. A summary of recent incidents is also presented by the Chief Law Officer ("CLO") at each regular Audit Committee meeting. Our policies and standards were developed in collaboration with a wide range of disciplines, including information technology, cybersecurity, legal, compliance and business. Our cybersecurity strategy and policies are continually reassessed to ensure they attempt to identify and proactively address the constant changes in the global threats. Decision makers such as the CLO, executive team, and Audit Committee are regularly kept up to date on cybersecurity trends. Ongoing collaboration with stakeholders throughout the business also helps to build continued awareness and visibility of future needs.


text: We engage external vendors to assess the cybersecurity program as needed. An independent third party will perform annual multi-stage penetration testing of our IT environment.


text: Our cybersecurity program is governed by the Audit Committee of our Board. The Audit Committee of the Board and the full Board will each receive quarterly updates on cybersecurity risks identified through the enterprise risk management processes described above.


text: Notwithstanding our processes to oversee and identify risk from cybersecurity threats, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. We identify nation state-sponsored threat actors and the rise in sophistication and proliferation of ransomware campaigns as top reasonable material risks to the business. The theft, unauthorized use or publication of our intellectual property and/or confidential business or personal information (whether through a breach of our own systems or the breach of a system of a third party that provides services to us) could harm our competitive or negotiating positions, reduce the value of our investment in research and development and other strategic initiatives, compromise our patent enforcement strategies or outlook, damage our reputation or otherwise adversely affect our business. To date there have not been any risks that have materially affected our operations. See Item 1A. " RISK FACTORS " for a discussion of cybersecurity risks.


text: Cybersecurity Governance The Board of Directors (the "Board") of the Company is responsible for the oversight of the Company's cybersecurity program and recognizes the risks that cybersecurity threats may impose on the Company, its business partners, employees and investors. The Company's IT Director is responsible for overall IT governance, risk and compliance including the Company's cybersecurity program. The Audit Committee of the Board collaborates with the full Board and the IT Director to facilitate alignment of overall IT related controls and processes. We have a formalized IT Security Incident Report process which provides a method to document and communicate details of security incidents to appropriate stakeholders. The Board and the Audit Committee receive periodic briefings on cybersecurity and help set priorities and strategic direction. As part of continuous improvement, our cybersecurity program is being aligned with the NIST Cybersecurity Framework 2.0 to help ensure comprehensive controls and oversight.

companyName: FRIEDMAN INDUSTRIES INC

ticker: FRD


text: Cybersecurity Controls We have implemented a modern, comprehensive set of controls that restrict access to systems using a combination of firewalls, virtual private networks, multi-factor authentication and enforced use of corporate controlled compliant devices. We make extensive use of best-in-class automated intrusion prevention, intrusion detection and response systems which constantly monitor activity, build usage patterns and respond or alert when unusual activity is detected. We have experienced staff who perform root cause analysis, respond to any immediate threat, and implement improved controls for future prevention. Our cybersecurity tools are fully integrated and collect data from various sources to build relationships and detect more complex multi-channel attack strategies. Application controls are role-based and designed to protect data confidentiality and provide overall data integrity. A risk-based approach is taken regarding third-party systems utilized in our business.


text: We have controls specifically focused on E-mail phishing including impersonation attempts. Although our automated controls prevent most phishing attempts, some can be delivered to employees. To mitigate this risk, we provide training to employees using various methods including E-mail phishing campaigns which send phishing-style E-mails, monitors user responses and automatically assigns further training as appropriate. Employees have been trained to send any suspicious activity to a central IT Service Desk for evaluation and appropriate timely action.


text: All critical systems have rigorous data backups and are designed for disaster recovery, ensuring business continuity in the event of a catastrophic incident. As part of continuous improvement, disaster recovery testing is being conducted and documented.


text: We are not aware of any unmitigated risk or any prior incident that may have materially affected the Company's data integrity, confidentiality, operations, business strategy or financial reporting. Given our reliance on modern systems, we are aware a significant incident could impact the Company's overall goals so we strive to provide modern counter measures to manage this risk.


text: Safeguarding the Company's information technology ("IT") systems, intellectual property, and the confidential information and personal data that customers, suppliers, business partners, employees and others share is a critical concern. As such, the Company has processes in place to assess, identify, and manage material cybersecurity threats and incidents. The Company's cybersecurity strategy includes policies, procedures, and technology that proactively safeguard its operations against cybersecurity threats. The Company utilizes IT that enables its team to access both operational and financial performance data in real time, while, at the same time, identifying and preventing cybersecurity threats and risks. The Company aims to incorporate industry best practices throughout its cybersecurity processes and its cybersecurity framework leverages internationally recognized standards, including the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework (Identify, Protect, Detect, Respond and Recover). These processes incorporate preventative, detective and corrective controls to identify relevant cyber risks and include network and endpoint protection technologies that are designed to block and detect security events at the perimeter and within its network as well as evaluation and monitoring of detected security events. The Company continuously monitors activity, frequently scans applications and systems for vulnerabilities to risk from cybersecurity threats. Continuous monitoring of the Company's networks and systems for threats and vulnerabilities is a key component of the Company's strategy, supported by the analysis of threat intelligence from external sources. This multi-layered approach enables early detection and facilitates prompt response to potential cybersecurity threats.

companyName: PARK AEROSPACE CORP

ticker: PKE


text: The Company's management supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by it; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy The Company's cybersecurity risk management program is integrated with its overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across functions to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Seneca Foods Corp

ticker: SENEA


text: The Company designs and assesses the cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The Company uses the NIST CSF as a guide to help identify, assess, and manage cybersecurity risks relevant to its business; this does not imply that the Company's cybersecurity program meets any particular technical standards, specifications, or requirements.


text: Awareness and training for employees, involving phishing campaigns, informational sessions at management meetings, and annual mandatory training with simulations of common cybersecurity threats; Security tools and technologies, along with control policies and active review procedures which strengthen authentication and access protection;


text: Third-party risk management process and monitoring procedures for service providers, suppliers, and vendors who have access to critical systems and information;


text: Risk and vulnerability management encompassing both proactive and predictive defenses which provides opportunities to assess, remediate, and validate; and Managed detection and incident response, including advanced endpoint protection.


text: In evaluating the risks identified as a part of the annual assessment process, the Company's information technology team considers the likelihood and severity of the respective risk and the potential impact of the risk on the Company, its customers, and its employees. These risks are then prioritized and monitored by the information technology team.


text: The Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems to assess its cybersecurity readiness and maturity of the cybersecurity program. Tests are conducted by the information technology team and reputable third-party consultants and auditors. In developing and evaluating the testing procedures, the Company considers both its individual risks and industry standards.


text: The cybersecurity risk management program includes an incident response plan with a cross-functional team comprised of designated members of the information technology department, senior management, and other appropriate individuals. The team is responsible for assessing and managing the cybersecurity incident response process, as outlined within the incident response plan, and taking necessary corrective actions to mitigate and eliminate the issue.


text: As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents and potential impact to the Company, see the cybersecurity risk factor within "Item 1A. Risk Factors" in this Form 10-K.


text: The information technology department, led by the Senior Vice President of Technology and Planning, Chief Information Officer ("CIO"), is responsible for the Company's cybersecurity program. The CIO, along with the certified Information Security Officer and VP Information Technology have significant experience spanning over 20 years in information security, infrastructure, and compliance.


text: The Board of Directors considers cybersecurity risk as part of its overall risk oversight function. The Board of Directors receives briefings from the CIO regarding the Company's cybersecurity risk management program at least annually. These briefings include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan and is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. Our cybersecurity risk management program includes the following key elements:

companyName: CYANOTECH CORP

ticker: CYAN


text: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services and our broader enterprise information technology ("IT") environment;


text: A team comprised of IT personnel responsible for directing (1) our cybersecurity risk assessment processes; (2) our security controls; and (3) our response to cybersecurity incidents;


text: The use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our cybersecurity processes; A cybersecurity incident response plan.


text: During the fiscal year ended March 31, 2024, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition, as we have described in the Risk Factors section of this Form 10-K.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as critical to the enterprise and oversees management's design, implementation and enforcement of our cybersecurity risk management program, while our executive officers are responsible for the day-to-day management of the material risks. Our Board of Directors receive annual updates, and/or significant updates as needed, on relevant information regarding cybersecurity.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature, ("Information Systems and Data").

companyName: EMERSON RADIO CORP

ticker: MSN


text: Our information technology ("IT") department helps identify, assess and manage the Company's cybersecurity threats and risks. Our IT department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, using manual tools and conducting threat assessments designed to identity internal and external threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, conducting risk asse ssments and maintaining business continuity and disaster recovery plans.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program. The IT department works with Company management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Board, which evaluates our overall enterprise risk.


text: We use third-party service providers to perform a variety of functions throughout our business, such as internet hosting companies, distributors, and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with any particular provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "An information systems interruption or breach in security, including as a result of cyber-attacks, could adversely affect the Company's business, results of operations and reputation."


text: Our Board addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee of the Board (the "Audit Committee") is responsible for overseeing the Company's risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Operating Officer ("COO"). Our COO, assisted by our Senior Vice President for Operations, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our COO and Senior VP for Operations are responsible for reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our COO.


text: The Board may receive reports from our IT Department and/or Management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity measures are primarily focused on ensuring the security and protection of its information technology systems and data. The Company recognizes the increasing volume and sophistication of cybersecurity threats and takes seriously its responsibility to protect these information technology systems and data. The Company considers risks associated with cybersecurity alongside the Company's other risks as part of its overall risk assessment process. The Company's Vice President of Information Technology and his staff monitor the Company's information systems to provide a comprehensive approach to assess, identify, manage, mitigate, and respond to cybersecurity threats.

companyName: CROWN CRAFTS INC

ticker: CRWS


text: The Company uses cost-effective controls that are commensurate with the risk and sensitivity of its specific information systems, control systems and enterprise data. The Company's cybersecurity program incorporates best practices and industry standards from multiple sources and includes, but is not limited to, risk assessment, policies and procedures, training and awareness, auditing, log collection and analysis, threat hunting and intelligence surveillance, compliance monitoring and testing, and incident response.


text: When necessary, the Company's Vice President of Information Technology and his staff collaborate with external third -party subject matter specialists. The Company has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of these providers. All third parties engaged for such matters are subjected to scrutiny to ensure they satisfy the Company's security standards. The Company periodically reviews its third -party engagements to ensure that the providers maintain the necessary levels of protection and competency, as well as to oversee and identify potential cybersecurity risks and threats from such engagements.


text: As of May 31, 2024, the Company has not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operation or financial condition. The Company has further disclosed how risks from cybersecurity threats could potentially have a material impact on the Company, including its business strategy, results of operations, or financial condition, in Part I, Item 1A, "Risk Factors" of this Annual Report.


text: Cybersecurity Governance Cybersecurity, as an important part of the Company's risk management processes, is a critical area of focus for the Company's Board of Directors (the "Board"), which is responsible for oversight of the Company's cybersecurity risk, including the effectiveness of cybersecurity risk management policies and protocols. As part of the Board's oversight, the Board receives a report at least annually from the Company's Vice President of Information Technology and other members of the Company's executive management team. These reports include updates on the Company's cybersecurity risks and threats, the status of projects intended to strengthen its information security systems, assessments of the cybersecurity program, and the emerging threat landscape.


text: In the event of a cybersecurity incident, the Company has processes by which the incident would be escalated internally and, when appropriate, reported to the Board or an appropriate committee of the Board, as well as for updating the Board regarding the incident until it has been resolved.


text: The Company's Vice President of Information Technology is responsible for the Company's cybersecurity strategy and execution. He has more than 30 years of experience in technology and information systems leadership and reports directly to the Company's Chief Executive Officer.


text: Risk Management and Strategy We perform a formal risk assessment each year. As part of our risk assessment, we consider the potential for cybersecurity threats, including but not limited to interruptions, outages and breaches to its operational and financial systems. We have policies, processes, internal controls and tools to assess, identify, and manage material risks from potential cybersecurity threats. We utilize a combination of cybersecurity awareness training, manual processes, specialized software and automated tools, and third-party assessments to build our cybersecurity program. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program. We are also currently developing a cybersecurity incident response plan that establishes a formal framework for responding to cybersecurity incidents, including defining what constitutes a reportable cybersecurity incident; establishing specific escalation and communication channels; identifying parties responsible for managing and responding to each incident; and other preparedness and response activities.

companyName: LiveOne, Inc.

ticker: LVO


text: The Audit Committee of our board of directors provides oversight over our internal control program, including the adequacy and effectiveness of our information technology infrastructure and cybersecurity program. Each quarter, our management provides updates to the Audit Committee regarding our internal control program, including any significant changes to its information technology infrastructure or cybersecurity program. Our management also reports any material risks from cybersecurity threats to the Audit Committee. Our management periodically provides the Audit Committee with updates on cybersecurity risks and/or trends.


text: Our management team, specifically our Chief Executive Officer and Chief Financial Officer, are responsible for the day-to-day administration of our business operations, including our risk management of cybersecurity risks. Our management is responsible for the design and implementation of policies, processes and internal controls to manage our cybersecurity risks. Our management team regularly meets with their information technology resources, including our third-party service providers, to ensure that we are appropriately positioned to manage our cybersecurity risks. Our management team also sponsors periodic cybersecurity awareness training for employees.


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For further discussion of the cybersecurity risks, see "Part I—Item 1A. Risk Factors," specifically the risk titled "We are subject to cybersecurity risks to our systems, infrastructure, and technology, and data processed by us or third-party vendors." No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.


text: Risk management and strategy We rely on our information technology to operate our business. We have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: ADM TRONICS UNLIMITED, INC.

ticker: ADMT


text: Due to our highly regulated stature for medical device development and manufacture, we have been practicing cybersecurity for a long time. We are ISO-13485 Certified for medical device manufacturing. Elements of that certification include risk management. And we are knowledgeable about ISO-27001. We have an engineer responsible for the security of our computers, network, etc.


text: We have robust firewalls for all access points. We have top line anti-virus on all computers and networks. We have prioritized the risks to protect our networks. To protect our departments we have implemented an architecture of a separate network for administration and one for engineering. This gives redundancy and protection. There is onsite as well as offsite backup as well as a separation of WiFi for visitors to prevent access to our network.


text: A plan is in place to restore our networks if attacked by both our on-site backup and, if needed the off-site backup. We have very complex software for our engineering. We also have a robust accounting ERP software. These are regularly maintained and updated.


text: We have an independent consultant who is a cybersecurity expert who has advised us on the above systems and procedures. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.


text: Our committee for the review and implementation of cybersecurity policies and procedures are made up of the CEO, CSO and VP of Regulatory and through the CEO, provides an update to the Board of Directors on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Board of Directors of any material threats or incidents that arise.


text: Risk Management and Strategy The Company maintains cybersecurity processes, technologies and controls to help it assess, identify and manage material risks from cybersecurity threats. These processes, technologies and controls are part of the Company's overall enterprise risk management process.

companyName: BUTLER NATIONAL CORP

ticker: BUKS


text: Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity Framework and is designed to ensure that our information systems are effective and are prepared for cybersecurity threats, including through regular oversight and mitigation of internal and external threats. As a U.S. defense subcontractor, we are additionally obligated to comply with Department of Defense regulations such as Defense Federal Acquisition Regulation Supplement.


text: The Company utilizes existing employees and contracts with third party firms to evaluate our information security program, for continuous system monitoring and threat detection, to gather insights for identifying and assessing material cybersecurity threats, and for potential mitigation assistance. We conduct cybersecurity assessments using third-party service providers, and we require them to promptly notify the Company of any cybersecurity risks, threats or incidents that might impact us.


text: The Company has an established cybersecurity and information security awareness training program that includes mandatory annual training and regular communications for our employees regarding cybersecurity threats and methods of mitigation.


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from cybersecurity threats have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled " Cyber security attacks, internal system or service failures, and misappropriation of data or other breaches of information security may adversely impact our business and operations " in Item 1A. Risk Factors.


text: Management is responsible for the day-to-day assessment and management of cybersecurity risks. Cybersecurity measures that pertain specifically to Company's Boot Hill subsidiary have been delegated to Boot Hill's Board of Managers, a committee comprised of directors and officers of the Company and officers of Boot Hill. This committee is responsible for ensuring compliance with Kansas Racing and Gaming Commission regulations.


text: The Board of Directors has oversight responsibility for the Company's strategic and operational risks. The Board has delegated oversight responsibility for certain risks to its committees, including delegation to the Board's Nominating and Governance Committee oversight of the Company's major non-financial reporting enterprise risk assessment and management processes not retained by the Board. However, given the broad and important role of cybersecurity oversight, the Board has determined that oversight for cybersecurity should remain with the full Board. The Board routinely receives reports from the Company's Chief Executive Officer, with the assistance of the Company's IT department, concerning the Company's cybersecurity risk management and strategies and related processes, technologies and controls.


text: Cybersecurity risk, management, & strategy Tilray recognizes the importance of cybersecurity in safeguarding our systems, data, and operations and we are committed to addressing the significant risks posed by cyber threats. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management framework to other legal, compliance, operational, and financial risk areas. The Company is committed to maintaining robust processes to assess, identify and mitigate material risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents.

companyName: Tilray Brands, Inc.

ticker: TLRY


text: Our business is subject to various cybersecurity risks, including but not limited to, unauthorized access to sensitive data, including customer information and medical information, disruption of operations or supply chain due to cyberattacks, theft or manipulation of intellectual property, such as proprietary strains or cultivation techniques, regulatory non-compliance resulting from cybersecurity breaches, including violations of data privacy laws. To address these risks, we have implemented a comprehensive cybersecurity program, which includes, regular risk assessments and vulnerability testing to identify and address potential weaknesses in our systems, deployment of robust access controls and encryption technologies to protect sensitive data, mandatory annual employee training and awareness programs to promote cybersecurity best practices and prevent social engineering attacks, and continual monitoring and incident response procedures to detect and respond to cybersecurity incidents in a timely manner. We also have information security and data privacy policies and procedures in place applicable to our directors, officers, employees, contractors and suppliers. Third parties service providers also contribute to our overall cybersecurity. We engage third parties to support in the design, implementation and ongoing efforts to help identify and mitigate cybersecurity risks.


text: Cybersecurity governance Cybersecurity is an important part of our risk management processes and is an area of focus for our Board, Chief Information Officer ("CIO") whom reports to the Chief Executive Officer, and management team. Our CIO plays a pivotal role in assessing and managing material risks stemming from cybersecurity threats and is primarily responsible for the oversight of our overall cybersecurity risk management program, and coordinates with our external cybersecurity consultants. Additionally, given that cybersecurity risks can impact various areas of responsibility of the Committees of the Board, our Board of Directors oversees cybersecurity risk management and regularly reviews our cybersecurity strategy and initiatives. The Board receives quarterly and as needed updates on cybersecurity matters from the CIO and management.


text: Tilray is dedicated to maintaining a robust cybersecurity program to safeguard our assets, data, and stakeholders' interests. We remain vigilant in our efforts to identify, assess, and mitigate cybersecurity risks and are committed to transparency and accountability in our cybersecurity disclosures.


text: Cybersecurity Risk Management and Strategy Like other global companies, we face various cybersecurity threats that could have a material adverse effect on our business strategy, results of operations or financial condition. Cybersecurity, therefore, is an important element of our business and our overall enterprise risk management program, and while we have experienced a small number of cyber incidents over the last few years, none to date have been material or had a material adverse effect on our business or financial condition. To mitigate the risk, we have established a multilayered approach to assessing, identifying and managing material risks from cybersecurity threats, which includes the following:

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: An annual cybersecurity risk assessment as part of our Enterprise Risk Management (ERM) program, which reviews and evaluates the potential impact and likelihood of various cyber risks and defines a framework for mitigating measures and residual risk.


text: A cybersecurity roadmap that is built from the risk assessment and feeds into our annual IT expenditure plan and which outlines the actions and investments we intend to take to enhance our cybersecurity posture and capabilities.


text: A continuous cybersecurity risk monitoring and response process, which involves daily review and real-time alerts of security incidents, a multi-disciplinary escalation and review process, and a reporting and filing protocol for material incidents within four business days of materiality determination.


text: A periodic cyber risk assessment conducted by independent experts, which provides an external validation and benchmarking of our cybersecurity practices and performance.


text: As part of our cybersecurity program, we have and will continue to engage third parties, such as consultants, network security firms, auditors, and forensics providers, to assist us in assessing, managing, or investigating cyber risks or incidents. For example, we have engaged industry recognized third parties to monitor and conduct penetration and vulnerability testing on our networks and to assist us in the conduct of tabletop exercises.


text: In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we perform third-party risk assessments designed to help protect against the misuse of IT by third parties and business partners and generally request that third-party service providers provide us information about their security policies and procedures.


text: Cybersecurity Governance and Oversight We have a cybersecurity governance structure that involves the oversight and involvement of our board of directors and senior management.


text: Our board of directors, through its Audit Committee, maintains oversight of risks, including cybersecurity risks, and receives an update from the Director of IT Security and the Chief Information Officer (CIO) at each quarterly committee meeting. The Audit Committee also reports to the full board on cybersecurity matters as part of its regular report out after each meeting. The Audit Committee Chair is immediately informed of any breach that could be more than de minimis and is kept apprised of any resulting investigation and is briefed on the substance of any Form 8-K filing related to a material cybersecurity incident.


text: At the management level, oversight of our cybersecurity program rests with an internal committee comprised of the CIO, the Chief Legal Officer (CLO), and the Director of IT Security, who have in aggregate over 40 years of experience in assessing and managing cyber risks. The committee is responsible for overseeing the implementation and execution of our cybersecurity program and policies, and for engaging external experts as needed. The committee also reviews the log of security incidents as needed to validate that there are no materiality issues in the aggregate. The committee reports to the Audit Committee on a quarterly basis or more frequently as needed. We have an Incident Response Team comprised of IT, legal, and internal audit personnel that is activated with the help of other disciplines in the event of a perceived breach or security risk. The team is responsible for assessing the impact and materiality of the incident in accordance with a written Incidence Response Plan, determining the appropriate response and remediation actions, and communicating with internal and external stakeholders as needed.


text: In an effort to deter and detect cyber threats, we have a required cybersecurity training program that is provided to all new employees during on-boarding and semi-annually to employees with access to our IT resources, which aims to raise awareness and foster a culture of cybersecurity among our workforce. We also have an ongoing process of sending simulated phishing emails to employees. The results of these simulated attempts are monitored and reported to each employee's manager. Training includes such cybersecurity topics as social engineering, phishing, password protection, confidential data protection, asset use and mobile security. The training also emphasizes the importance of reporting all incidents immediately.


text: Cybersecurity Risk Management and Strategy We have policies, procedures and processes in place to identify, assess and monitor material risks from cybersecurity threats. These plans are part of our overall enterprise risk management strategy and are part of our operating procedures, internal controls, and information systems. Cybersecurity risks include, among other things, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks. We have developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications or requirements under the NIST.

companyName: ETHAN ALLEN INTERIORS INC

ticker: ETD


text: Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on our networks, including customer and employee information.


text: Cybersecurity incident response plan and testing: We have a cybersecurity incident response plan and dedicated teams to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have cross-functional teams that are responsible for leading the initial assessment of priority and severity, and external experts may also be engaged as appropriate. Our cybersecurity teams assist in responding to incidents depending on severity levels and seek to improve our cybersecurity incident management plan through periodic tabletops or simulations. Our Vice President of Information Technology and other members of his team oversee the implementation of this plan and are made aware of ongoing risks and incidents.


text: Training: We provide security awareness training to our employees so they may better understand their information protection and cybersecurity responsibilities. We also provide additional training to certain employees based on their roles.


text: Supplier risk assessments: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply-chain or who have access to our customer and employee data on our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program. These considerations affect the selection and access to our systems, data, or facilities. We also seek contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect our information that is processed on their systems.


text: Third-party assessments: We have engaged third-party vendors to periodically assess our cybersecurity posture, to assist in identifying and remediating risks from cybersecurity threats. We also regularly engage with consultants, auditors, and other third-parties to help identify areas for continued focus, improvement and compliance.


text: While the Company has experienced cybersecurity incidents, we are not aware of any cybersecurity incidents to date, including as a result of any previous cybersecurity incidents, that has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase and the preventative actions we have taken and continue to take to reduce these risks and protect our systems and information may not successfully protect against all cybersecurity threats and incidents in the future. For more information, see Item 1A. Risk Factors under the heading of "Technology and Data Security Risks", of this Annual Report on Form 10-K.


text: Cybersecurity Governance The Company's Board of Directors (the "Board"), as a whole, has oversight responsibility for our strategic and operational risks. The Board regularly reviews and discusses with management the strategies, processes and controls pertaining to the management of our information technology operations, including updates on the internal and external cybersecurity threat landscape, incident response, assessment and training activities, and relevant legislative, regulatory, and technical developments. Our Vice President of Information Technology presents, at least annually, to the Board, an overview of our cybersecurity threat risk management and strategy as well as provides reports regarding the evolving cybersecurity landscape, including emerging risk. Our Vice President of Information Technology and other members of his team remain informed about cybersecurity threats through the reporting framework as described above under Cybersecurity Risk Management and Security – Cybersecurity incident response plan and testing.


text: The Information Technology team is responsible for the day-to-day assessment and management of cybersecurity risks. Our cybersecurity risk management and strategy are led by our Vice President of Information Technology, and our Manager of Security. Such individuals have over 50 years of work experience, collectively, in various roles managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader risk management system and processes. The cybersecurity risk management system involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from consultants, cybersecurity assessors, auditors and other third parties to gather certain insights designed to identify and assess material cybersecurity threat risks, their severity and potential mitigations. We depend on and engage various third parties, including suppliers, vendors, and service providers. Our risk management, legal, information technology, and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such entities. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to Mr. Srinivasan, our designated member of our Board of Directors.

companyName: WRAP TECHNOLOGIES, INC.

ticker: WRAP


text: Mr. Srinivasan has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and report any findings and recommendations, as appropriate, to the full Board of Directors for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the designated member of the Board of Directors.


text: Our strategy for managing cybersecurity risk is multifaceted and includes, without limitation: (i) robust security policies and procedures, designed in part to comply with Payment Card Industry, or PCI, rules; (ii) an incident response plan, (iii) comprehensive system security elements and vulnerability scanning; (iv) periodic cybersecurity awareness training and testing for employees and certain contractors; (v) risk management of our third-party suppliers, vendors, and other partners, which includes risk-based diligence and contractual provisions that generally allow for periodic auditing, and (vi) security assessments of any businesses that we acquire.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: As part of our cybersecurity risk management program, we periodically engage third parties to evaluate and test our systems, run tabletop exercises to test our incident response processes, provide incident response support if needed, and review our PCI compliance.


text: The Company's program to identify, assess, and manage cybersecurity risks is led by our Chief Information Officer, and leverages the expertise of our Chief Financial Officer and General Counsel. Our Chief Information Officer holds a Bachelor of Science in Computer Science and has over 30 years of work experience, with more than 20 years in senior executive roles involving managing information systems, including implementing effective information and cybersecurity programs. Our Chief Information Officer, who reports to our Chief Executive Officer, meets regularly with the executive leadership team regarding topics related to technology operations, including cybersecurity, and also periodically updates the Board and the Committee regarding the Company's cybersecurity and data privacy risk mitigation plans.


text: With respect to the prevention, detection, mitigation, and remediation of cybersecurity incidents, our information security team, under the direction of our Chief Information Officer, monitors our information systems, assesses the severity of any incidents it detects or that are otherwise reported, and follows escalation procedures embedded within our incident response plan to inform the Chief Information Officer, other members of management, the Committee, and the Board, each as needed.


text: The Company's Board of Directors is responsible for exercising oversight of management's identification and management, and planning for, risks from cybersecurity threats.

companyName: TWIN DISC INC

ticker: TWIN


text: The Company has developed and is continuing to develop processes, that seek to assess, identify, and manage material risks from cybersecurity threats to the information technology systems and information it uses or will use, transmit, receive, and maintain. The processes for assessing, identifying, and managing material risks for cybersecurity threats include the Company's efforts to identify the relevant assets that could be affected, determine possible threat sources and threat events, assess threats based on their potential likelihood and impact, and identify controls that are in place or necessary to manage and/or mitigate such risks.


text: The Company has not experienced any material cybersecurity incidents, and the expenses incurred from any security incidents have been immaterial. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to the Company, including potentially to the Company's results of operations and financial condition. The Company relies extensively on information technology systems and could face cybersecurity risk. As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that the Company may expend greater resources to continue to modify and enhance protective measures against such security risks.


text: Our data breach response designates an incident response team comprised of senior leaders within information technology, finance and compliance functions to ensure timely diagnosis and mitigation of cyber events. The incident response team is responsible for determining whether a cybersecurity incident is material and requires current reporting pursuant to SEC Form 8-K Item 1.05 (Material Cybersecurity Incidents). In conducting the assessment, the team considers factors including, but not limited to the probability of an adverse outcome; the potential significance of loss; the nature and extent of harm to individuals, customers, and vendors; the nature and extent of harm to our competitive position or reputation; and the possibility of litigation or regulatory investigations.

companyName: LSI INDUSTRIES INC

ticker: LYTS


text: To ensure our cybersecurity programs adhere to industry best practices, we have adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework as a guide for our cybersecurity program. The NIST Cybersecurity Framework models the best practices for security and the capabilities needed to identify, protect, detect and respond to cybersecurity risks and events. In addition to the framework, we have a Security Action Committee comprised of the senior leaders of information technology, finance, and compliance that meets regularly to guide the evolution of our cybersecurity program, review potential incidents, and respond to trends in the cybersecurity landscape. We evaluate our physical, electronic and administrative safeguards on a continuous basis to ensure they are effectively deployed across the business. We also engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.


text: Despite the Company's security measures and programs, our information technology and infrastructure are susceptible to cybersecurity incidents, intrusions and attacks, any of which could have a materially adverse effect on our business, operating margins, revenues and competitive position. See "Part I—Item 1A. Risk Factors" for further discussion of these risks.


text: Our Board of Directors is responsible for the oversight of cybersecurity risks and threats. The Board has delegated certain information security and data privacy oversight to the Audit Committee of the Board. The Audit Committee oversees compliance with information security and data privacy laws and has oversight responsibility for cybersecurity risks related to accounting, audit and financial matters. The Audit Committee and management report to the Board on a periodic basis regarding our information security and data privacy functions, including any cybersecurity threats.


text: The Audit Committee is responsible for oversight of our cybersecurity policy, procedures and risk mitigation. Our information technology (IT) leadership briefs the Audit Committee and the Board of Directors on a periodic basis on information security matters, including the current cybersecurity landscape, progress on information security initiatives and accomplishments, and reports on material cybersecurity incidents, as needed.


text: The Chief Information Officer with the support from the Chief Executive Officer and Chief Financial Officer, assisted by our broader IT team, is responsible for setting the strategic direction and priorities for information security, coordination of enterprise-wide compliance with information security policies and procedures, as well as day-to-day information security management. Additionally, information security awareness trainings and testing are a compliance requirement for employees.


text: While the Company does not employ a Chief Information Officer or consider cybersecurity threats to be a material risk to the business strategy, results of operations or financial position of the Company, the Board of Directors discusses risks and threats most applicable to the Company and inquires of management regarding design and effectiveness of controls in place to address the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: GREYSTONE LOGISTICS, INC.

ticker: GLGI


text: Risk Management and Strategy Due to the size of the Company, our information technology ("IT") environment does not utilize overly complicated systems or processes. The Company does not sell products or conduct business in an online environment. We utilize a third party managed services provider ("Provider") for security applications, monitoring, and updates to our information technology environment. The Chief Financial Officer serves as the relationship manager for and has regularly scheduled meetings with the Provider to evaluate whether the services provided meet the Company's needs, review hardware and software obsolescence, and identify any new threats that need to be addressed. The Company uses multi-factor authentication for applications wherever possible to provide access security and we maintain a secure physical environment.


text: Managing technology risks, including cybersecurity risks, is a fundamental part of the Company's risk management framework and processes. We employ a variety of processes, risk assessments, and controls to assess, identify, and manage these risks and have developed and maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. The program is one component of our enterprise risk management system. The technical, administrative and physical controls underlying our program are based on nationally recognized practices and standards for cybersecurity. Trusted partners are an important part of our cyber risk management program. We partner with service providers to conduct periodic risk assessments and to monitor and maintain the performance and effectiveness of security controls used in our environment.

companyName: INTEGRATED BIOPHARMA INC

ticker: INBP


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees our management of enterprise risks, including cybersecurity risks. Members of the management team brief the Board of Directors and Audit Committee on the effectiveness of risk management efforts on an annual basis.


text: Our cyber risk management program helps mitigate risks that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Security breaches and other disruptions could compromise our information and expose us to liability, and could cause our business and reputation to suffer.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. We have a comprehensive cybersecurity policy hosted on our intranet for all employees, established to govern, guide and mitigate in the event of a cyber-attack. As a result, cybersecurity and data protection are key components of our long-term strategy.

companyName: TRIO-TECH INTERNATIONAL

ticker: TRT


text: Risks from Cybersecurity Threats We have not encountered any cybersecurity challenges that have materially impaired our operations or financial standing in Fiscal 2024.


text: Cybersecurity Risks We rely on internal and third-party information technology systems and networks to process, transmit and store electronic information in our operations, including our proprietary business information and that of our customers, suppliers and employees. We use various internal and third-party information technology systems and networks to manage our operations and maintain effective internal control over financial reporting. We also collect and store sensitive data, including intellectual property, proprietary business information and personal information of our customers, suppliers and employees, in our data centers and on our networks. The secure operation of these information technology systems and networks, and the processing and maintenance of this information, are critical to our business operations and strategy.

companyName: AYTU BIOPHARMA, INC

ticker: AYTU


text: Despite our security measures, our internal and third-party information technology systems and networks may be subject to damage, disruption, or unauthorized access due to a variety of factors, including cyber-attacks by computer hackers, computer viruses, ransomware, phishing, denial-of-service attacks, physical or electronic break-ins, employee error or malfeasance, power outages, natural disasters, or other catastrophic events. Any such damage, disruption, or unauthorized access could compromise our internal and third-party networks and the information stored there could be accessed, publicly disclosed, lost, or stolen. Any such access, disclosure, or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations, damage to our reputation, loss of customers, potential harm to our competitive position and additional costs to remediate the issue.


text: Cybersecurity Practices We have implemented various measures to manage our risk of information technology systems and networks damage, disruption, or unauthorized access, including regular employee training, monitoring of our systems and networks, maintenance of backup and protective systems and use of modern endpoint detection and response tools, which are integrated into Aytu's risk management systems and processes. We have implemented multi-factor authentication ("MFA") across many of our systems and email accounts to prevent unauthorized access and impersonation. We also utilize a cloud-based environment for a large portion of our operations, which enhances our scalability, flexibility and resilience and utilize third parties to perform early external vulnerability assessment and risk identification. We have established extensive backup and recovery procedures to ensure the continuity of our operations in a cyber incident. We also maintain cyber liability insurance coverage as part of our comprehensive risk management program. However, these measures may not be sufficient to prevent, detect, or mitigate the impact of such damage, disruption, or unauthorized access. Moreover, the regulatory environment related to information security, data protection and privacy is increasingly demanding and complex, and compliance with applicable laws and regulations may result in significant costs or require changes in our business practices that could adversely affect our operations.


text: Cybersecurity Governance Our Board of Directors is actively involved in overseeing our cybersecurity risk management. Our Board of Directors delegates certain oversight functions to our Audit Committee, which reviews our cybersecurity policies, procedures, controls and audit results. Our Audit Committee receives quarterly updates on our cybersecurity posture, threats and incidents from Aytu's management. Our Board of Directors and our Audit Committee regularly assess the adequacy of our cybersecurity risk management framework and the effectiveness of our mitigation strategies.


text: Our cybersecurity operations are led by our Chief Financial Officer. He is responsible for overseeing the development and implementation of our cybersecurity strategy, policies, standards and practices. He also oversees our cybersecurity team, which includes a staff member who has over 20 years of experience in the field. Our cybersecurity team monitors, detects, responds and reports on cybersecurity threats and incidents, and coordinates with our internal and external stakeholders to ensure the security of our information assets.


text: Aytu adheres to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0, which provides a set of standards, guidelines and best practices to manage cybersecurity-related risks. We have developed and documented our systems disaster recovery plan, which outlines the roles, responsibilities and procedures for restoring our critical systems and data in the event of a cyber incident. We have also crafted internal policies to help maintain a secure environment, such as our information security policy, our data classification policy, our incident response policy and our password policy. We regularly conduct phishing simulations, vulnerability scans and audits to test the effectiveness of our controls and backups, and to identify and remediate any gaps or weaknesses in our cybersecurity posture.


text: Cybersecurity Incidents Despite our efforts to prevent and mitigate cybersecurity incidents, we cannot guarantee that we, or third-party providers that we rely on, will not experience any breaches, disruptions, or unauthorized access to our information technology systems and networks. During fiscal 2024, we did not experience any cybersecurity incidents that materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, however, there can be no assurance that the measures we have taken to address IT and cybersecurity risks will prove effective in the future. For additional discussion of the IT and cybersecurity risks facing our business, please refer to Part 1, Item 1A, Risk Factors of this Annual Report.


text: We prioritize investment in cybersecurity risk management and governance. We continually assess the adequacy of our resources and capabilities to address emerging threats, regulatory requirements and changes in technology. As cybersecurity threats evolve, we may need to further enhance our processes and technologies, which could require additional financial resources.


text: Risk Management and Strategy As part of our overall enterprise risk management function, we have implemented and currently maintain various information security processes designed to identify, assess and manage material risks related to information technology, including cybersecurity threats to our critical computer networks, third-party hosted services, and our critical data, ("Information Systems"). Our Information Systems risk management process evaluates and mitigates cybersecurity risks in alignment with our business objectives and operational needs.

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: We periodically engage third-party consultants and service providers to obtain an independent assessment regarding internal efforts to prevent threats on our Information Systems. Continuous vigilance over safeguarding the Company's Information Systems have resulted in our current approach and these assessments are shared with our Audit Committee.


text: To mitigate the occurrence of an incident as defined by the Company's formal documentation, which classifies and defines the properties of potential threats, the Company has in place a host of defenses which include, but are not limited to, the use of gateway consoles in all our global locations, limited access to key Information Systems from in-office networks or VPN with multi-factor authentication by means of a third-party mobile identity management tool to limit access to authorized users.


text: Internally to manage potential cybersecurity threats, we have established an Incident Response Plan that is designed to control the workflow of a reported incident. This plan formalizes incidence response stages such that reporting, identification, scope, response, and recovery are executed in a timely manner and identifies the order and coordination of internal and external communication. In addition, the Company addresses crisis management and business continuity with respect to Information Systems to ensure reliable redundancy and recovery of backed-up databases.


text: Management is not aware of any material security breaches on its Information Systems and risks from cybersecurity threats have not previously materially affected us. Because certain of our vendors have experienced cyberattacks in the past and the threat and development of cyberattacks is continuous, it is impossible to say with certainty whether the Company's efforts will prevail in a coordinated attack on its Information Systems. We currently do not expect the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."


text: Role of the Board The Audit Committee of our Board of Directors (the "Board") has the responsibility for the oversight of risk management, including those risks related to cybersecurity. The Board holds strategic planning sessions with senior management to discuss strategies, key challenges, risks and opportunities for mitigation. The involvement of our Board in setting our business strategy is a key part of its oversight of risk management, its assessment of management's appetite for risk, and its determination of what constitutes an appropriate level of risk for us. Our senior management attends meetings of our Board and its committees on a quarterly basis, and as otherwise needed, and are available to address any questions or concerns raised by our Board on risk management and any other matters.


text: Role of Management Our senior management, with the oversight of the Board, is responsible for the day-to-day management of the material risks the Company faces, including those related to cybersecurity. We believe it is important to work at all levels of the Company's hierarchy to manage cybersecurity risks and threats. Therefore, all users must use an online IT ticketing system, which is monitored around the clock, to report any incidences. Qualified individuals in IT determine what resources to allocate to each case and escalation of an incident, if deemed necessary. The Systems Administrators and IT Director, who has more than 17 years of experience with the Company, communicates on a day-to-day basis with the Chief Financial Officer and President/Chief Operating Officer who would bring any material cybersecurity issues to the attention of the Company's Chief Executive Officer and the Board.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. To this end, our processes are designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems (including such risks associated with the use of any third-party service providers) that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by third-party experts under supervision of management, and, where necessary or desired, include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. We also consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: ReposiTrak, Inc.

ticker: TRAK


text: We believe that information security is a critical component of our business strategy. Therefore, we maintain and continuously assess and strengthen our cyber security program.

companyName: VALUE LINE INC

ticker: VALU


text: Management is responsible for the day-to-day administration of the Company's risk exposures and has adopted a risk management framework including identification, analysis and response to risks affecting our business. The Company has established a committee of senior leaders which is chaired by the Company's Executive Director of Information Technology.


text: We regularly engage third-party services to conduct evaluations of our security controls, which can include penetration testing, independent audits, or consulting on best practices to address new challenges. These evaluations include testing both the design and effectiveness of security controls.


text: We rely on third-party service providers for a variety of services to run our information systems. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. A cyber-attack at a third-party service provider could have a significant impact on our business, and we continuously monitor the risks associated with our service providers.


text: The Audit Committee has responsibility for the oversight of the Company's risk management program, including technology and cybersecurity risks facing the Company. The audit committee receives briefings from management and the executive director of information technology about cybersecurity risk management and the overall technology and cybersecurity environment.


text: We believe that currently we have not encountered a cybersecurity event that has had a material impact on our business. See Item 1A. "Risk Factors" for a discussion of our cybersecurity risks.


text: Risk Management and Strategy As a component of and integrated into our overall risk management strategy and system, we maintain a cybersecurity risk management program designed to assess, identify, manage and protect our information systems and data from unauthorized access, use, disclosure, disruption, modification or destruction. Our program is based on applicable industry frameworks and standards, including those provided by the National Institute of Standards and Technology, and is comprised of core functions to identify, protect, detect, respond to and recover from cybersecurity threats and events. We constantly monitor cybersecurity threats and test the performance and effectiveness of our cybersecurity program, with the assistance of third-party experts, on an annual and ongoing basis. We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments. As described in "Item 1A. Risk Factors" in this Form 10-K, we are subject to risks from cybersecurity threats that could have a material adverse impact on our business and financial results. As of the date of this report, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business, results of operations, financial condition and cash flows.

companyName: INSTEEL INDUSTRIES INC

ticker: IIIN


text: Our Information Services Department manages our cybersecurity risk management program which is overseen by the Vice President of Information Services. The Vice President of Information Services has a master's degree in business administration with a focus on technology and has decades of professional experience in cybersecurity threat assessments and detection, applicable technologies, incident response and employee training. Our Information Services Department includes a team of experienced professionals who have developed an Incident Response Policy that is regularly reviewed and updated. The Incident Response Policy establishes the required steps to assess, respond to and limit the impact of an incident, details tactical and strategic team membership and points of contact related to the response process and provides for escalating notifications to senior executives, including the Chairman of the Board and Chief Executive Officer depending on the severity of the threat.


text: The Board of Directors, having ultimate oversight of the company's cybersecurity risk, receives annual and periodic updates on the cybersecurity program, including those related to material risks and incidents, from the Vice President of Information Services and participates in discussions regarding cybersecurity risks. Cybersecurity information provided to the Board comprises a broad range of topics including, but not limited to, emerging cybersecurity threats, ongoing cybersecurity initiatives, incident reports and compliance with regulatory requirements, industry standards and relevant benchmarking. In addition to Board oversight, we provide mandatory quarterly employee training on how to identify, assess and manage risks from cybersecurity threats.


text: Cybersecurity threats and cybersecurity incidents could adversely affect our business and disrupt our operations. Cybersecurity incidents include an intentional attack or unintentional event allowing unauthorized access to systems impacting the confidentiality, integrity and/or availability of our information sources. Cybersecurity threats are any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or the information therein.

companyName: PROCYON CORP


text: To date, Cybersecurity threats have not had a material impact nor, are they anticipated to significantly affect the Company, including our business strategy, results of operations or financial condition.


text: We rely extensively on information technology (IT) services to conduct our business. We also rely on networks and services, including internet sites, cloud and software solutions, data hosting and processing facilities and tools and other hardware, software and technical applications and platforms to assist in conducting our business.


text: Procyon Corporation has processes in place for identifying, assessing and managing material risks from potential unauthorized access to electronic information held by the Company for business and/or commercial purposes. We have safeguards in place to protect the confidentiality of information residing on the systems that include controls, mechanisms and technologies designed to prevent, detect and/or mitigate data theft or misuse. The data includes proprietary information that we routinely collect, process, store and transmit while conducting business with our customers. We contract third party consultants to assist providing security hardware and software, as well as providing reporting and recommendations to strengthen our systems.


text: As part of our risk management process, cybersecurity risks and mitigations are evaluated by senior leadership and presented to the Board of Directors.