text: part of our overall enterprise risk management program, we prioritize the identification and management of cybersecurity risk at several levels. Our Board of Directors has overall oversight responsibility for our risk management and is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.

companyName: Jingbo Technology, Inc.

ticker: SVMB

secItem: Item 1C


text: The Company adheres to cybersecurity practices shaped by relevant laws and industry benchmarks. We proactively manage cyber risks through a multidisciplinary framework designed to safeguard the integrity, confidentiality, and availability of our data and systems. This framework includes several key initiatives: Enterprise Risk Management—We identify primary cybersecurity threats to our operations. Vulnerability Management—We scrutinize software and computing infrastructure for potential vulnerabilities.

companyName: Crypto Co

ticker: CRCW


text: Our reliance on third-party service providers, who manage their own IT security, introduces additional vulnerabilities. These providers play a crucial role in securely handling and storing our sensitive data. Despite setting specific security requirements, we do not control their cybersecurity investments or operational security. Any security lapses on their part could potentially disrupt their services and, by extension, negatively impact our financial health and operational efficiency.


text: In 2024, we encountered no cybersecurity threats that significantly influenced our operational, financial, or strategic outcomes. However, we acknowledge that our cybersecurity measures, while comprehensive, cannot completely eliminate the risk of cyber incidents or guarantee that all such incidents will be detected.


text: We regularly evaluate cybersecurity risks through discussions and updates with our Chief Executive Officer ("CEO"), who oversees our cybersecurity strategy. The CEO ensures that our management team can identify, evaluate, and manage cyber risks effectively and deploy measures to address and mitigate potential cyber incidents. This governance structure ensures that cybersecurity remains a central element of our strategic planning and risk management philosophy.


text: Company engages a third-party provider to maintain our systems and management participates in the assessment to identify any risks from cybersecurity threats. Our third-party provider monitors our firewall, network, system security and internal and external backups and reports any issues to the Company. The Company's Board, together with management, is engaged in our cybersecurity monitoring managed by our third-party provider and it is constantly changing. Any issues are appropriately addressed timely. To date, we have no t experienced any cybersecurity incidents that materially affected our business strategy, results of operations or financial condition.

companyName: Brownie's Marine Group, Inc

ticker: BWMG


text: operate in the artificial intelligence sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers;

companyName: Global AI, Inc.

ticker: GLAI


text: violation of privacy laws and other litigation and legal risk; and reputational risk. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We currently have security measures in place to protect our clients' information and prevent data loss and other security breaches, including a cybersecurity risk assessment program. Both management and the Board of Directors are actively involved in the continuous assessment of risks from cybersecurity threats, including prevention, mitigation, detection, and remediation of cybersecurity incidents.


text: IT team is responsible for day-to-day assessment and management of risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents.


text: undertake activities to prevent, detect, and minimize the effects of cybersecurity incidents including an annual risk review. We also have policies and procedures to oversee and identify the risks from cybersecurity threats associated with our use of third-party service date, no cybersecurity incident (or aggregation of incidents) or cybersecurity threat has materially affected our results of operations or financial condition. However, an actual or perceived breach of our security could damage our reputation and prevent us from attracting potential Acquisitions or subject us to third- party lawsuits, regulatory fines or other actions or liabilities, any of which could adversely affect our business, operating results or financial condition.


text: do no t presently have any general processes for assessing, identifying, and managing material risks from cybersecurity threats. As we expand our business operations, we plan to develop processes that will allow for the identification and assessment of cybersecurity risk that will be integrated into an overall risk management system, which will be managed by senior management and overseen by the Board of Directors. As part of this development, we plan to identify and address cybersecurity risks related to our business, privacy and compliance issues through a multi-faceted approach that is expected to include third party assessments, internal information technology (IT) audit, IT security, governance, risk and compliance reviews. In connection with these planned approaches, and to defend, detect and respond to cybersecurity incidents, we, among other things, will consider: conducting proactive privacy and cybersecurity reviews of systems and applications, audits of applicable data policies, performing penetration testing using external third-party tools and techniques to test security controls, conducting employee training, monitoring emerging laws and regulations related to data protection and information security, and implementing appropriate changes.

companyName: Iveda Solutions, Inc.

ticker: IVDA


text: our Chief Financial Officer is expected to lead our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Our Chief Financial Officer will be tasked with staying informed about, and monitoring the prevention, mitigation, detection and remediation of cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes we plan to develop and as described above, including the operation of an incident response plan, and report to the Board of Directors on any appropriate items.


text: We rely on sophisticated information technology systems and network infrastructure to operate and manage our business. We also maintain personally identifiable information ("PII") about our employees, and given the nature of our business, we have access to protected health information ("PHI").

companyName: Beyond Air, Inc.

ticker: XAIR


text: Our business therefore depends on the continuous, effective, reliable, and secure operation of our computer hardware, software, networks, Internet servers, and related infrastructure. To the extent that our hardware or software malfunctions or access to our data by internal personnel, suppliers or customers through the Internet is interrupted or compromised, our business could suffer.


text: The integrity and protection of our customer, personnel, financial, research and development, and other confidential data is critical to our business, and our customers and employees have a high expectation that we will adequately protect their personal information. The regulatory environment governing information, security and privacy laws is increasingly demanding and continues to evolve and a number of states have adopted laws and regulations that may affect our privacy and data security practices regarding the use, disclosure and protection of PII. For example, the California Consumer Privacy Act ("the CCPA"), among other things, creates individual privacy rights and imposes increased obligations on companies handling PII.


text: Although our computer and communications hardware are protected through physical and software safeguards, they are still vulnerable to system malfunction, computer viruses, malware and ransomware, and other cybersecurity threats such as phishing and social engineering attacks. These events could lead to unauthorized access to our information technology systems and result in financial loss and the misappropriation or unauthorized disclosure of confidential information belonging to us, our employees, partners, customers, or suppliers. The techniques used by criminal elements to attack computer systems are sophisticated, change frequently and may originate from less regulated and remote areas of the world. As a result, we may not be able to address these techniques proactively or implement adequate preventative measures. If our information technology systems are compromised, we could be subject to fines, damages, litigation and enforcement actions, incur financial losses, suffer reputational damage, and lose trade secrets or other confidential information, each of which could significantly harm our business.


text: a notification of concerning factors which may be indicative that a notable cybersecurity incident has occurred, the Cyber Security Subcommittee (Cyber Security Subcommittee) consisting of General Counsel, Head of HR & Chief Technical Officer (CTO) meets to make an initial assessment.


text: If the Cyber Security Subcommittee determines there is a reasonable likelihood a notable cybersecurity incident has occurred, then notice will promptly be given to certain members of the Company Executive Team including our Chief Executive Officer, Chief Operating Officer, Chief Commercial Officer & Chief Financial Officer.


text: date, we have no t experienced any cybersecurity incidents that materially affected our business strategy, results of operations or financial condition.

companyName: Blue Star Foods Corp.

ticker: BSFC


text: use, store and process data for and about our customers, employees, partners, and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: Laser Photonics Corp

ticker: LASE


text: Risk Management and Strategy the oversight of the Board of Directors and Audit Committee, we have implemented and maintained a risk management program that includes processes for systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories.


text: We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident. We also have a process to require corporate employees to undertake cybersecurity training utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing.


text: risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, please see Item 1A. Risk Factors, the section titled "Risk Factors—Risks Related to our Business and Our Industry— Internal system or service failures could disrupt our business and impair our ability to effectively provide our services and products to our customers, which could damage our reputation and adversely affect our revenues and profitability." and " As a U.S. defense contractor, we are vulnerable to security threats and other disruptions that could negatively impact our business. "


text: Board of Directors has oversight of the Company's cybersecurity program and has delegated the quarterly assessments and management of cybersecurity risks to the Audit Committee.


text: Risk Management and Strategy We have risk management processes in place for identifying, assessing and mitigating cybersecurity and risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems and other processes that are designed to detect, prevent or mitigate data loss, theft, misuse, unauthorized access, interference with operations, or other security incidents or vulnerabilities affecting the data. The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. Cybersecurity concerns are an important consideration in our application development and the design of our infrastructure and operations technology. We also use systems and processes designed to reduce the impact of a security incident to our clients or their customers. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems that we use for encryption and authentication, employee email, communication to clients and their customers, operational support, and other functions.

companyName: Roadzen Inc.

ticker: RDZN


text: Our executive leadership team is responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the Company. As part of our cybersecurity risk management system, our incident management teams are responsible to track and log privacy and security incidents across Roadzen platforms and our vendors and other third-party service providers to remediate and resolve any incidents, should they arise. In case there are any incidents, it is promptly reviewed by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material shall be immediately escalated for further assessment, and shall be reported to designated members of our senior management. We consult with our counsels as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions.


text: Our corporate governance committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and the committee is responsible to report any findings and recommendations, as appropriate, to the full board for consideration. Senior management regularly discusses cyber risks and trends and, should any issues arise, they review all material incidents with the corporate governance committee. Our corporate governance and audit committees discuss policies with respect to risk assessment and risk management, including risks associated with the reliability and security of the Company's information technology and security systems, and the steps management has undertaken to monitor and control such exposures. Our board receives updates on the Company's cybersecurity risk management programs from management.


text: Our business strategy, results of operations and financial condition have not been affected by risks from cybersecurity threats, however, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors under " Our solutions or products or our third-party cloud providers have experienced in the past, and could experience in the future, data security breaches, which could adversely impact our reputation, business, and ongoing operations".


text: recognizes the growing importance of cybersecurity. The company employs a dedicated IT infrastructure department led by Chris Rose. The IT department assumes the primary responsibility for overseeing our cybersecurity risk exposure across the entire organization. This includes evaluating, assessing, and enhancing cybersecurity practices.

companyName: Earth Science Tech, Inc.

ticker: ETST


text: CTO conducts regular IT and Security risk assessments. This involves employee sit-alongs, inventorying all tech systems and assets, and reviewing existing practices, procedures, and policies. The findings are meticulously cataloged. Action plans are developed and addressed in priority ranked order. These assessments are updated quarterly, addressing new and outstanding risks and remediation plans.


text: expedite security policy changes, active threat monitoring, infrastructure enhancements, device management, and endpoint security, the company engages additional third-party IT consultants.


text: manage material risks from cybersecurity threats to our information systems and the information residing in our information systems through various processes and procedures, including, depending on the environment, risk assessment, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, and employee training. We engage third-party service providers to provide some of the resources used in our information systems and some third-party service providers have access to information residing in our information systems. With respect to such third parties, we seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature and extent of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our processes may include conducting due diligence on the cybersecurity practices of such provider and contractually imposing cybersecurity related obligations on the provider.

companyName: ADDENTAX GROUP CORP.

ticker: ATXG


text: are no t aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Group, including our business strategy, results of operations, or financial condition.


text: Refer to "Item 1A. Risk Factors— Risks Associated with Our Company — Unauthorized disclosure, destruction or modification of data, through cybersecurity breaches, computer viruses or otherwise or disruption of our services could expose us to liability, protracted and costly litigation and damage our reputation".


text: Board of Directors holds oversight responsibility over our Group's risk management and strategy, including material risks related to cybersecurity threats. This oversight is executed directly by our board of directors and through its committees. Our audit committee oversees the management of our Group's major financial risk exposures, the steps management has taken to monitor and control such exposures, and the process by which risk assessment and management is undertaken and handled, which would include cybersecurity risks, in accordance with its charter. The audit committee holds regular meetings and receives periodic reports from management regarding risk management, including major financial risk exposures from cybersecurity threats or incidents.


text: management, the Group's Chief Financial Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats on a day-to-day basis and keep the senior executive officers informed on a regular basis of the identification, assessment, and management of cybersecurity risks and of any cybersecurity incidents. Such management personnel have prior experience and training in managing information systems and cybersecurity matters and participate in ongoing training programs.


text: threats could potentially result in slowed or halted business operations, such as shipping, closing sales, marketing engagement, and other communications. This would negatively impact the Company's financial condition until the issue is resolved. Such threats could impact customers of certain programs that rely on digital resources, but a majority of our products would no t be materially affected.

companyName: PCS Edventures!, Inc.

ticker: PCSV


text: cybersecurity incidents were identified this year. One threat was identified: insecurely stored credentials. This was responded to by implementing an encrypted password manager Company-wide. We will continue to monitor for threats to avoid risks to Company or individuals' data, interruptions to business operations, or financial losses. Information about risks or any identified cybersecurity threats are reported by our Director of Technology to our President.


text: part of the Company's overall enterprise risk management processes, the Company maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats.

companyName: ELITE PHARMACEUTICALS INC /NV/

ticker: ELTP


text: underlying processes and controls of the Company's cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). Elite has an annual assessment performed by a third-party specialist of the Company's cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, the Company, in conjunction with the third-party cyber risk management specialists develop a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.


text: addition, Elite maintains processes to help govern the processes put in place by management designed to protect the Company's IT assets, data, and services from threats and vulnerabilities. Elite employs additional key practices within the cybersecurity risk management program including, but not limited to maintenance of an IT assets inventory, identity access management controls including restricted access of privileged accounts, physical security measures at Company facilities, information protection (IPS)/detection systems (IDS) including maintenance of firewalls, network and data traffic monitoring and automated alerting, and critical data backups to reduce cybersecurity risk.


text: The Company's cybersecurity partners, including, consultants, and other third-party service providers are a key part of Elite Pharmaceutical's cybersecurity risk management strategy and infrastructure. Elite partners with industry recognized cybersecurity providers leveraging third-party technology and expertise and engages with these partners to monitor and maintain the performance and effectiveness of IT assets, data, and services that are deployed in the Company's environment. The cybersecurity partners provide services including, but not limited to systems inventory monitoring, user management, network protection and monitoring, IPS/IDS management, remote access monitoring and management, user activity monitoring, data backups management, cybersecurity strategy, and cyber risk advisory, including assessment and remediation.


text: management team, in conjunction with cybersecurity service providers, is responsible for oversight and administration of Elite's cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Company's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and also relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by Elite for strategic cyber risk management, advisory and decision making.


text: Audit Committee of the Board of Directors oversees Elite's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including members of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of Elite's cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on processes to prevent, detect, and mitigate cybersecurity incidents.


text: The Company also relies on threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by the Company for strategic cyber risk management, advisory and decision making.


text: has implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes service level agreement monitoring and contract negotiations.


text: faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Elite acknowledges that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business.


text: However, as of the date of this Annual Report on Form 10-K, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect Elite's business strategy, financial condition, results of operations, or cash flows. The Company proactively seeks to detect and investigate unauthorized attempts and attacks against Company IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to Company service delivery; however, potential vulnerabilities to known or unknown threats will still remain.


text: Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject the Company to additional liability and reputational harm. In response to such risks, the Company has implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. " Risk Factors " for more information on cybersecurity risks.


text: is to perform a corporate risk assessment annually, which includes specific consideration and assessment of cybersecurity risk, proportional to the size of the Company. Service providers must meet certain security requirements such as security incident or data breach notification and response protocols, data encryption requirements, and data disposal commitments. managing cybersecurity risk, we employ a defense-in-depth strategy and regularly monitor our cyber environment for potential new threats.

companyName: Sundance Strategies, Inc.

ticker: SUND


text: Our strategy includes employee training and awareness on cybersecurity risks and related best practices, required password complexity, the use of multi-factor authentication, information security protocols, anti-virus and anti-ransomware software.


text: Board of Directors provides oversight of our cybersecurity program through an annual risk review. On an annual basis, cybersecurity risk and mitigation strategies are reviewed as part of management's reporting to the Board of Directors, which includes reporting significant business risks, including cybersecurity mitigation strategies employed to manage these risks, and a review of any emerging risks. Annually, management is to provide an overview of our cybersecurity program to the Board of Directors, including a review of key strategies, emerging risks, and a summary of key performance indicators. As of the date of this filing, we have no t experienced any material cybersecurity incidents.


text: the year ended March 31, 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Fatpipe Inc/UT

ticker: FATN


text: Third-party Risk we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the SOC reports (or international equivalent) of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Perfect Moment Ltd.

ticker: PMNT


text: risk management is an integral part of the Company's enterprise risk management framework and is overseen at both the Board and management levels.


text: Company's Board of Directors maintains ultimate oversight of cybersecurity risks. The Audit Committee, which is composed entirely of independent directors, has primary responsibility for overseeing cybersecurity risk as part of its broader oversight of information technology and risk management. The Audit Committee receives regular briefings—at least quarterly—from management on cybersecurity matters. full Board is also periodically briefed on material cybersecurity risks, incident response preparedness, and significant security incidents, if any.


text: responsibility for assessing, managing, and mitigating cybersecurity risk lies with the Company's Chief Financial Officer and Chief Operating Officer (the CFOO), who reports to the President and has a dotted-line reporting relationship to the Audit Committee.


text: of the date of this filing, the Company has not experienced a cybersecurity incident that has materially affected, or is reasonably likely to materially affect, its business, financial condition, or results of operations.


text: Management and Strategy have established processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: IMAC Holdings, Inc.

ticker: BACK


text: encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Governance


text: management team, specifically our President and Chief Financial Officer, are responsible for the day-to-day administration of our business operations, including our risk management of cybersecurity risks. Our management is responsible for the design and implementation of policies, processes and internal controls to manage our cybersecurity risks. Our management team regularly meets with their information technology resources, including our third-party service providers, to ensure that we are appropriately positioned to manage our cybersecurity risks. Our management team also sponsors periodic cybersecurity awareness training for employees of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: HONG YUAN HOLDING GROUP

ticker: HGYN


text: matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner.


text: a smaller reporting company with limited cash resources, we do not currently maintain formal cybersecurity policies, processes, procedures, or training programs. We do not have personnel specifically dedicated to cybersecurity risk management. We are aware of the importance of cybersecurity protections and intend to develop a more robust cybersecurity framework if financial and operational conditions permit.

companyName: Adapti, Inc.

ticker: ADTI


text: At present, we have not implemented system monitoring, employee training, or incident response protocols. We have not experienced any cybersecurity incidents to date, but any cyber security incident may negatively impact our operations.


text: have no t experienced any cybersecurity incidents that have been determined to be material in the past, however, like other medical device companies, we have experienced cybersecurity incidents and may continue to experience them in the future. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, Governance

companyName: PetVivo Holdings, Inc.

ticker: PETV


text: of the key functions of our Board is to be informed oversight of our risk management process, including risks from cybersecurity threats.


text: Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee.


text: CFO and representatives from our management committee on cybersecurity, which includes our Chief Business Development Officer and General Counsel, and our outside consultants, who collectively possess significant experience in evaluating, managing, and mitigating security and other risks, including cybersecurity risks, are primarily responsible for assessing and managing our material risks from cybersecurity threats.


text: have processes to assess, identify and manage risks from cybersecurity threats as a part of our overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. We engage certain external advisors to enhance our cybersecurity oversight where necessary. Whereas a member of our board of directors, Mr. Wesley Fry, is a cybersecurity expert.

companyName: GPODS, INC.


text: Maintain firewall and virus protection software, and two factor authentication logins to servers; and Seek to obtain a cybersecurity insurance policy where part of the above processes, we will engage with third party service providers, beyond our board member, to review our cybersecurity program and help identify areas for continued focus, improvement, and compliance.


text: processes also include assessing cybersecurity threat risks associated with the use of third-party service providers in the normal course of business use. Third-party risks are included within our cybersecurity risk management processes discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party service providers, including due diligence on the third parties that have access to our systems and facilities that house our critical systems and data.


text: Our board of directors is responsible for oversight of our risk assessment, risk management and cybersecurity risks. Our board of directors engage in discussions with management on cybersecurity-related news and discuss any updates to our cybersecurity risk management and strategy programs that are necessary.


text: As of the date of this Report, we have no t encountered risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position.


text: recognize that cybersecurity risks represent a significant operational and reputational threat to our business. Our cybersecurity risk management program is designed to identify, assess, mitigate, and respond to cybersecurity threats in a timely and effective manner. The program is integrated into our broader enterprise risk management framework through a defense-in-depth approach. internal and external vulnerability assessments and penetration testing; employee training with user phishing simulation tests; dedicated incident response plan, tested and refined annually; of multi-factor authentication, encryption, and access control policies; Recovery and Business Continuity Plans; acknowledgment; risk assessments; of least privilege access across environments; improvement loop using CI/CD pipeline, providing accountability and segregation of duties: monitoring by security operation center; with third-party security consultants for audits and advisory services.

companyName: Verses AI Inc.

ticker: VRSSF


text: monitor cybersecurity threats across our systems through both automated tools and manual review processes. Ma nagement is responsible for the overall implementation and effectiveness of our cybersecurity program. This includes allocating resources, establishing policies, and ensuring employee adherence to security practices. The Company's Vice President of Operations manages our cyber security process and reports to our President and Chief Operating Officer and our Chief Executive Officer who reports to the Company's Board of Directors.


text: Company's Board of Directors has specific oversight responsibilities related to cybersecurity, including review of security controls and incident response plans. Management provides updates to the Audit Committee on cybersecurity risks and the effectiveness of our cybersecurity of the date of this filing, we have no t experienced any material cybersecurity incidents that have materially impacted our operations, financial condition, or results of operations.


text: of December 31, 2024, the Company has not identified any cybersecurity threats, including previous incidents, that have materially impacted our business strategy, results of operations, or financial condition. This assertion signifies our diligent efforts in managing and mitigating cybersecurity risks, contributing to the stability and continuity of our operations.

companyName: Intelligent Hotel Group Ltd.

ticker: ZHJD


text: risk is an important component of our overall enterprise risk management framework, given our reliance on digital systems for product development, operational control, communications, data management, and financial reporting. Our operations involve proprietary software and hardware systems integrated into offshore platforms, as well as sensitive information related to customer deployments, government employ a layered cybersecurity approach aligned with industry standards. Our strategy includes preventive and detective technical controls (e.g., endpoint protection, intrusion detection, access control, and network segmentation), employee training, vendor diligence, and third-party audits. We maintain a combination of on-premise and cloud-based infrastructure with multi-factor authentication and routine patch management.

companyName: Ocean Power Technologies, Inc.

ticker: OPTT


text: also work with managed cybersecurity service providers to support real-time threat monitoring and incident response capabilities. Penetration testing and vulnerability scanning are performed periodically, and findings are reviewed with senior leadership.


text: risks are considered in connection with strategic planning, vendor selection, product development (particularly in embedded control systems), and compliance with regulatory obligations, including export control and data privacy laws.


text: date, we have not experienced any material cybersecurity incidents that have had a significant impact on our financial condition, results of operations, or reputation. However, we recognize that the threat landscape continues to evolve, and we remain vigilant in adapting our security posture to mitigate emerging risks.


text: Board of Directors has oversight responsibility for cybersecurity risk as part of its broader enterprise risk oversight function. The Audit Committee receives periodic updates on cybersecurity threats, incidents, risk mitigation strategies, and program enhancements from senior management.


text: Incident Response Plan outlines steps to investigate, contain, report, and recover from cybersecurity events. We have established internal procedures to investigate, contain, report, and recover from cybersecurity incidents. These procedures are designed to enable a prompt and coordinated response to potential threats. In the event of an incident determined to be material under SEC guidelines, we are prepared to make timely disclosures through current reports (Form 8-K) as required.


text: the fiscal years ended April 30, 2025 and 2024, we did not identify any cybersecurity incidents that had a material impact on our operations, liquidity, or financial condition. We did observe routine scanning, phishing attempts, and minor technical vulnerabilities, all of which were mitigated without operational disruption or data loss.


text: no material incidents have occurred, we cannot guarantee that future incidents will not materially affect our company, especially as we expand digital product features, enter new geographic markets, and integrate with third-party systems.


text: of the key functions of our Board is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. Our Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents, if any. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations of April 30, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.

companyName: U.S. GOLD CORP.

ticker: USAU


text: acknowledge the increasing importance of cybersecurity in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data, potentially impacting our business operations, financial condition a smaller reporting company, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. Our approach to cybersecurity is in the developmental stage, and we have not yet conducted comprehensive risk assessments, established an incident response plan or engaged with external cybersecurity consultants for assessments or services.

companyName: Landbay Inc

ticker: LNBY


text: believe cybersecurity is critical to advancing our technological advancements. As a fintech company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Netcapital Inc.

ticker: NCPL


text: Oversee Third-Party Risk Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the system and organization controls (SOC) reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Rocky Mountains Group Ltd


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing during the financial year ended December 31, 2024. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such an incident may have a material effect, including on our operations, business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section titled " Risk Factors " in Governance


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee. Our executive management team informs our Audit Committee on cybersecurity risks on a regular basis, at least once per year.


text: The Audit Committee is primarily responsible for assisting our board of directors in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including relating to cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including processes and policies for determining risk tolerance, and reviews management's strategies for adequately mitigating and managing identified risks, including risks relating to cybersecurity threats.


text: Our cybersecurity coordinator is responsible for assessing and managing our material risks from cybersecurity threats, in close collaboration with our IT team and reports to our CEO.


text: This ensures that the senior management are kept abreast of the cybersecurity posture and potential risks faced by our group.


text: have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We engage a third-party consultant to assist us with our cybersecurity risk management framework, including the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents. Our third-party consultant team is managed by our Vice President Operations who reports to the Chief Executive Officer or the board-level, as appropriate.

companyName: SPARTA COMMERCIAL SERVICES, INC.

ticker: SRCO


text: preserve the confidentiality, integrity, and availability of our information systems, and to safeguard our assets, data, intellectual property, and network infrastructure, while meeting regulatory requirements, it is crucial to effectively manage cybersecurity risk.

companyName: AIRWA INC.

ticker: YYAI


text: To achieve this, we have implemented a comprehensive cybersecurity risk management framework, which is integrated into our overall enterprise risk management system and processes and is internally managed.


text: IT staff is tasked with assessing, identifying, and managing cybersecurity threats and is responsible for: assessments designed to help identify material cybersecurity risks to our critical systems, information, products, and services and to our broader enterprise IT environment; of risk-based action plans to manage identified vulnerabilities and implementation of new protocols and infrastructure improvements; incident investigations; threats to sensitive data and unauthorized access to our systems;


text: access control measures to critical IT systems, equipment, and devices, which measures are designed to prevent unauthorized users, and executing protocols to ensure that information regarding cybersecurity incidents is shared promptly with the Board, as appropriate, to allow for risk and materiality assessments and to consider disclosure and notice requirements; and and implementing training on cybersecurity, information security, and threat awareness.


text: were no cybersecurity incidents during the financial year ended April 30, 2025, that resulted in an interruption to our operations or known losses of any critical data or that otherwise had a material impact on our business strategy, financial condition, or results of operations. However, the scope and impact of any future incident cannot be predicted. See Item 1A, "Risk Factors," for more information on how material cybersecurity attacks might impact our business.


text: Board acknowledges the significance of robust cybersecurity management programs and actively participates in overseeing and reviewing our cybersecurity risk profile and exposures. Our Board receives prompt and timely information regarding any significant cybersecurity incidents, as well as ongoing updates regarding any such incidents. Furthermore, in the event of any significant updates or adjustments to our cybersecurity related policies, our IT staff will present them to the Board for their review and approval.


text: IT staff are responsible for the daily management of our cybersecurity efforts. This includes updates and refinement of cybersecurity policies, execution and management of cybersecurity measures, and the preparation of regular reports on cybersecurity execution. Their primary focus is to consistently update our cybersecurity programs and mitigation strategies, ensuring they align with industry best practices and procedures.


text: All employees received cybersecurity training and other education regarding their use of computers, information technology, and sensitive data including specifically how to recognize common attack strategies. As many of our applications are developed and managed by third parties, we are dependent on these providers for many functions including disaster recovery during a disaster or cyber incident. Our goal is to only utilize the most secure and trusted providers for our IT needs. To this end, we are currently reviewing the security credentials and certifications of our key application providers. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers.

companyName: INTELLIGENT BIO SOLUTIONS INC.

ticker: INBS


text: Board of Directors is responsible for oversight of cybersecurity risk. Our Chief Financial Officer and Chief Executive Officer are the members of management responsible for managing and assessing our cybersecurity practices and have commenced reporting on such practices and risks. The plan for the future is that they will continue to report to the Board on cybersecurity at least quarterly. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Board of Directors and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken. We believe we are appropriately staffed (as supported by IT consultants and service providers, as needed) to support a healthy cybersecurity posture given our size and scope.


text: Cybersecurity is an important aspect of our business operations, and we are committed to protecting our systems, data, and the information of our clients and stakeholders.

companyName: BlueOne Card, Inc.

ticker: BCRD


text: We recognize that cybersecurity threats are constantly evolving and that maintaining robust security measures is an ongoing process. Below is an overview of our cybersecurity risk management and the measures we have in place:


text: Risk Management and Strategy have processes in place for assessing, identifying, and managing material risks from cybersecurity threats. Our risk management activities are overseen by senior management and are integrated into our overall enterprise risk management framework. As part of this process, management identifies and assesses internal and external cybersecurity risks and the potential impact of such risks on our business.

companyName: CITRINE GLOBAL, CORP.

ticker: CTGL


text: utilize external information technology consultants to provide technical support for our systems and to advise on security matters. Risks associated with third-party service providers who have access to our data are evaluated during the vendor selection process.


text: date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations, or financial condition. However, we face a variety of cybersecurity threats that are reasonably likely to materially affect our company in the future, which are further described in "Item 1A. Risk Factors."


text: Board of Directors is responsible for the oversight of risks from cybersecurity threats. As the Company does not have a separately constituted audit committee, the entire Board of Directors fulfills this function. The Board receives reports from management on an as-needed basis regarding information technology and security matters, allowing it to monitor the Company's risk management processes.


text: senior management is responsible for the day-to-day assessment and management of our cybersecurity risks. This function is led by our Chief Executive Officer and Chief Financial Officer, who have overall responsibility for the Company's risk management. our executive officers are not cybersecurity experts, they have extensive experience in business management and corporate governance.


text: For specific technical expertise, management leverages and consults with our external information technology consultants to advise on threat identification, prevention, and other cybersecurity matters. In the event of a cybersecurity incident, management would be responsible for implementing response procedures and reporting the matter to the Board of Directors.


text: The Audit Committee of our Board of Directors is responsible for overseeing management's processes for identifying and mitigating risks that affect our operations, including cybersecurity risks. Procedures for assessing, identifying and managing cybersecurity-related risks are incorporated into our overall risk management framework. Senior leadership regularly briefs the Audit Committee and the full Board of Directors on our cybersecurity and information security posture and the Audit Committee is apprised of cybersecurity incidents deemed to pose a critical risk to our information technology ("IT") assets or business. We have an incident response playbook that outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying key functional areas, such as legal and financial reporting, as well as senior leadership and the Audit Committee, as appropriate. We rely upon in-house and cybersecurity vendors to monitor our IT systems and assets and have a governance structure and processes to assess, identify, manage, and report cybersecurity risks.

companyName: vTv Therapeutics Inc.

ticker: VTVT


text: As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the FDA related to adequately safeguarding patient information. We work with our in-house and cybersecurity vendors on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. We have engaged third-parties to conduct evaluations of our security controls, including through penetration testing, independent audits, and consulting on best practices to address new challenges. We require that our employees and subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on our systems and operations.


text: We currently have one full-time employee who manages our day-to-day information technology systems and the third-party vendors engaged to assist in such management, including monitoring and addressing cybersecurity matters and reports to our Chief Financial Officer. Our cybersecurity vendor, which has a SOC 2 Type II Report and is ISO 27001 certified, utilizes industry-leading processes to monitor in real-time cybersecurity threats and risks to our systems. Our in-house IT resource receives immediate notification of incidents and engages regularly with our cybersecurity vendor through weekly and monthly reports and quarterly meetings to address any issues identified through their processes and communicates such issues in accordance with our incident response plan.


text: Although we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that materially affected our business, financial condition and results of operations, we can provide no assurance that we will not experience a material cybersecurity incident in the future. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For additional information regarding the risks we face from cybersecurity threats, please see the risk factor titled "Our business and operations would suffer in the event of computer system failures, cyber-attacks or a deficiency in our cyber-security" included in Part I, Item 1A, Risk Factors of this Annual Report on Form 10-K.


text: Although we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that materially affected our business, financial condition and results of operations, we can provide no assurance that we will not experience a material cybersecurity incident in the future. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For additional information regarding the risks we face from cybersecurity threats, please see the risk factor titled "Our business and operations would suffer in the event of computer system failures, cyber-attacks or a deficiency in our cybersecurity" included in Part I, Item 1A, Risk Factors of this Annual Report on Form 10-K.


text: Our board of directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes and practices are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF), the International Organization for Standardization Information Security Management System Standard (ISO 27001) and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to any cybersecurity incidents.

companyName: Shockwave Medical, Inc.


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with our ERM function, our Chief Information Security Officer ("CISO"), our Chief Digital & Information Officer ("CDIO") and other members of management involved in cybersecurity risk management.


text: Safeguards: We deploy technical and non-technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We operate a security operations center which monitors our environment in a continuous manner.


text: Incident Response and Recovery Planning: We have established and maintain business continuity and technical recovery plans of critical systems and resources in the event of a cybersecurity incident that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. We also maintain a cybersecurity insurance policy, though the costs related to cybersecurity threats or disruptions may not be fully insured.


text: Third-Party Risk Management: We maintain a third-party cyber risk management program to identify and oversee cybersecurity risks presented by third party providers, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In the event we identify a risk, we communicate the risk to the third party and monitor the remediation. In the event of a critical risk that may cause imminent or material damage to us or our customers, our policy provides that we cease operating with such third party until the risk is remediated.


text: Education and Awareness: We provide regular, mandatory training, including ongoing end-user security awareness training and attack simulation assessments, for personnel regarding cybersecurity threats to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents, including through a formal annual risk assessment. These efforts include a wide range of activities, including external audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, endpoint reduction response, security operation centers, vulnerability and patch management programs and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: We have not identified risks from known cybersecurity threats that we believe have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our operations, business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section titled "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: The Board, in coordination with the Audit Committee, oversees our ERM process, including the management of risks arising from cybersecurity threats. The Audit Committee receives quarterly reports, and the Board is briefed at least once annually, on cybersecurity risks from the CISO, which address a wide range of topics including the status and specific metrics on our cybersecurity program, recent developments, evolving standards and regulations, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee would receive prompt and timely information regarding any future cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Board and the Audit Committee discuss our approach to cybersecurity risk management with our CISO, CDIO and other members of management involved in cybersecurity risk management regularly.


text: The CISO and CDIO work collaboratively across the business to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any future cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the organization are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and CDIO are informed about, and monitor the prevention, detection, mitigation and remediation, of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.


text: Our CISO has served in various leadership roles in information security, including serving as the Chief Information Security Officer at two other companies. Our CISO holds an undergraduate degree in Information Systems and a master's degree in Cybersecurity and Information Assurance and has obtained multiple professional security certifications including Certified Chief Information Security Officer. Our CDIO holds an undergraduate degree in Management Information Systems with minors in Computer Science and Economics and has served in various leadership roles in information technology, including serving as the Chief Information Officer of two public companies.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized activity on or conducted through our production and information systems that may result in adverse effects on the confidentiality, integrity, or availability of our systems or any information residing therein.

companyName: Samsara Inc.

ticker: IOT


text: We routinely conduct risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change that may affect production and information systems that are vulnerable to such cybersecurity threats and assessments in the event Samsara-specific or industrywide relevant vulnerabilities are discovered. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate whether, and if so, how, to design, implement, and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. For example, to advance and demonstrate our commitment to data security and privacy, we have achieved four cybersecurity-related certifications under standards promulgated by the International Organization for Standardization (ISO). We devote significant resources and designate high-level personnel, including our Chief Information Security Officer (our "CISO"), who reports to our Chief Information Officer, to manage the cybersecurity-related risk assessment and mitigation process.


text: As part of our overall risk management system, we regularly monitor and test our safeguards and train our personnel on these and other safeguards, in collaboration with our human resources, business technology, and management teams. Personnel across the company are made aware of our cybersecurity policies and procedures through training.


text: We are regularly audited and assessed pursuant to the System and Organization Controls (SOC 2) established by the American Institute of Certified Public Accountants for reporting on internal control environments implemented within an organization. We regularly use the Cybersecurity Framework published by the National Institute of Standards and Technology–a framework of standards, guidelines, and best cybersecurity practices–to evaluate our security program and to plan improvement.


text: We engage assessors, consultants, outside counsel, and other third parties in connection with our cybersecurity-related risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. For example, we engage independent entities to conduct platform, infrastructure, and hardware-level penetration tests on at least an annual basis.


text: Like other technology companies, we have faced and expect to face cybersecurity threats on an ongoing basis. As of the date of this Annual Report on Form 10-K, however, we do not believe that any prior cybersecurity-related threats or incidents have materially affected our company. In addition, we require other third-party service providers with access to our systems or processing sensitive data for us to certify that they have the ability to implement and maintain reasonable and appropriate security measures, consistent with all applicable laws, in connection with providing services to us, and to promptly report any suspected breach of their security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," including "Risk Factors—Risks Related to Our Business, Industry, and Operations: If we experience a security breach or incident affecting our customers' assets or data, our data or IoT devices, our Data Platform, or other systems, our Connected Operations Cloud may be perceived as not being secure or safe, our reputation may be harmed, and our business could be materially and adversely affected." and elsewhere in this Annual Report on Form 10-K.


text: A key function of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight responsibilities as a whole, as well as through our Audit Committee.


text: Our CISO is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our CISO, as of the date of this report, has experience in cybersecurity leadership roles at Microsoft Corporation, where he helped drive core security programs for the Windows operating system, including platform integrity, cryptography, data protection, identity and access control. He also held a leadership role in the mergers and acquisition security program at Salesforce, Inc., which included the assessment and remediation of security of potential and approved acquisitions. After he obtained his Bachelor of Science Degree in Electrical Engineering, he served for eight years as a Nuclear Submarine Officer for the U.S. Navy. He also has a Master of Business Administration degree.


text: Our CISO is supported by a team of personnel with experience in cybersecurity, including at other public companies in the technology industry.


text: Our CISO oversees our cybersecurity policies and processes, including those described in the section titled "Risk Management and Strategy" above. The processes by which our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: • Ongoing threat intelligence monitoring aimed at helping Samsara identify threats that may impact Samsara's production and information environments; • Mechanisms for real-time or otherwise prompt reporting through multiple channels, including e-mail and instant messaging to a team of on-call incident responders; • Supplemental retrospective reviews of reported incidents to identify trends and track resolution of incidents identified during the incident review process; • Routine product reviews to assess progress on key security initiatives, along with assessing existing and emerging product-related risks; and • Annual tabletop exercises in which we test our incident response procedures with management representatives from across the company.


text: Our CISO provides periodic briefings to our Audit Committee regarding cybersecurity risks and activities, including recent cybersecurity incidents and related responses, cybersecurity systems testing, cybersecurity training efficacy, and cybersecurity risks. As necessary, our Audit Committee provides periodic updates to our Board of Directors on such reports. In addition, our CISO provides periodic briefings to the Board of Directors on cybersecurity risks and activities.


text: Following these risk assessments, we evaluate whether, and if so, how, to design, implement, and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer (our "CISO"), who reports to our Chief Information Officer, to manage the cybersecurity-related risk assessment and mitigation process.


text: To advance and demonstrate our commitment to data security and privacy, we have achieved four cybersecurity-related certifications under standards promulgated by the International Organization for Standardization (ISO). Additionally, we are regularly audited and assessed pursuant to the System and Organization Controls (SOC 2) established by the American Institute of Certified Public Accountants for reporting on internal control environments implemented within an organization. We regularly use the Cybersecurity Framework published by the National Institute of Standards and Technology–a framework of standards, guidelines, and best cybersecurity practices–to evaluate our security program and to plan improvement.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," including "Risk Factors—Risks Related to Our Business, Industry, and Operations: If we experience a security breach or incident affecting our customers' assets or data, our data or IoT devices, our Data Platform, or other systems, our Connected Operations Platform may be perceived as not being secure or safe, our reputation may be harmed, and our business could be materially and adversely affected." and elsewhere in this Annual Report on Form 10-K.


text: Risk management and strategy We maintain a cybersecurity risk management program to identify, assess and manage material risks from cybersecurity threats, including by regularly assessing risks from cybersecurity threats and monitoring our information systems for potential vulnerabilities. Our cybersecurity program is designed to align with the National Institute of Standards and Technology Cybersecurity Framework.

companyName: RMR GROUP INC.

ticker: RMR


text: We take various actions designed to maintain and protect the operation and security of our information technology and systems, including the data maintained in those systems. We conduct data security education and testing for our employees, in addition to penetration testing and unannounced email phishing exercises. Additionally, we have implemented a third-party risk management process for third party service providers and vendors. Extensive security questionnaires are issued to third party providers and vendors, the responses to which are weighted and reviewed by our security and compliance team. High risk vendors are reviewed at least biennially and new vendors that interact with our data are assessed as part of our vendor procurement process. In the event of a cybersecurity incident, we have a detailed incident response plan in place for contacting authorities and informing key stakeholders. In addition, we have engaged a qualified third party who conducted an external assessment of our cybersecurity controls.


text: To date, we are not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information on cybersecurity risks and potential related impacts on us, see Part I, Item 1A. Risk Factors, "We rely on information technology and systems in our operations, and any material failure, inadequacy, interruption or security breach of that technology or those systems could materially harm our business."


text: Our Board of Directors holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. Our Audit Committee takes a leading role in oversight of risk management, including risks related to cybersecurity, and receives reports from our management regarding cybersecurity risks and countermeasures being undertaken or considered by us, including updates on the internal and external cybersecurity landscape and relevant technical developments and more frequent reports as it may direct or as warranted. Our cybersecurity program is led by our Chief Information Officer, or CIO, who has over two decades of relevant experience in information technology and cybersecurity and has primary responsibility for assessing and managing material risks from cybersecurity threats and overseeing our cybersecurity team. Our CIO has previously held senior information technology and security roles, including as CIO of a global real estate firm and of a real estate investment trust. Our Director of Information Security and our cybersecurity team are responsible for, among other things, information technology failure mitigation and business continuity, cybersecurity threat detection and incident response and continuous network monitoring. Our cybersecurity team members have a broad array of relevant skills and expertise and have obtained, or are working to obtain, relevant information security certifications, including Certified Information Systems Security Professional, Certified Information Systems Auditor and Certified Risk and Information Systems Control certifications. Our Director of Information Security assembles our incident response and investigative teams and informs our CIO if an incident occurs. Investigative findings are reported to our executive leadership and to the relevant authorities if warranted. Our CIO works closely with our senior management, including cross-functional leaders in our human resources, legal and corporate communications departments, to develop and advance our cybersecurity strategy and reports to our Audit Committee on cybersecurity matters.


text: As our technology-enabled background and identity verification services involve the collection and transmission of confidential and sensitive information of our clients and their users and existing and potential employees, managing cybersecurity risks is a key component of our enterprise risk management plan. We have a comprehensive risk management and governance strategy in place to assess, identify and manage cybersecurity risks to our business and our proprietary technology platform.

companyName: Sterling Check Corp.


text: Risk Management and Strategy Our cybersecurity program is designed to protect our information systems from cybersecurity threats and to ensure the confidentiality, integrity and availability of systems and information used, owned or managed by the Company related to our employees, our clients and their users and existing and potential employees. This involves a comprehensive and ongoing effort to protect against, detect and respond to cybersecurity threats and vulnerabilities. Our cybersecurity program includes a number of components, such as: • policies, procedures and protocols concerning information security and data protection; • regular employee security awareness trainings; • regular employee "phishing" trainings; • regular third-party audits of our cybersecurity program; • an incident response plan that sets forth the steps to be taken following an actual or suspected cybersecurity incident or other data-related event; • periodic tabletop exercises associated with our incident response plan and processes; and • tools designed to detect and prevent cybersecurity incidents.


text: As part of our enterprise risk management program, we use the results of both internal and external information security audits, and data associated with our analysis of cybersecurity metrics within our information technology environment to inform and direct our overall cybersecurity strategy. Each year, we engage auditors to perform recognized standard audits related to cybersecurity, including a System and Organization Controls ("SOC") 2 review to test our information technology system internal controls. In addition, we engage other third-parties, from time to time and on an as needed basis, in the performance of tests and assessments associated with the cybersecurity of our operating environment. We maintain a centrally-managed third-party risk management process that includes a cybersecurity assessment performed during the procurement process and periodically thereafter of third-party service providers that may have access to sensitive information and/or systems, or applications that we have determined to be important to our operations.


text: Material Effects from Risks of Cybersecurity Threats From time to time, we experience data and cybersecurity incidents. To date, we have not experienced any risks from cybersecurity threats (including as a result of prior incidents) that have materially affected or to our knowledge are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Any future actual or perceived cybersecurity incidents, including the failure to protect the confidentiality, integrity, availability and privacy of our data and electronic transactions, or any misuse of our information services by our clients, employees, vendors or hackers, could cause significant harm to our business and reputation and result in significant liability. Such liability could include harm to our brand and reputation and cause us to lose existing clients and market share and fail to win new clients, and may require expenditure of significant costs and operational consequences in connection with investigating, mitigating, remediating, eliminating, and putting in place additional measures designed to prevent future actual or perceived cybersecurity incidents.


text: Role of Management Our Technology & Security Team, which is led by our Chief Technology Officer ("CTO"), Ivneet Kaur, oversees our cybersecurity program. Ms. Kaur has over 20-years' experience in leading global technology & security teams, including in the financial services and consumer reporting industries. She holds a Masters degree in Engineering Management from the University of College Park, Maryland and a Masters in Software Systems from Kurukshetra University in India. Members of our Technology & Security Team hold industry certifications such as CISSP, Security+, and GIAC.


text: Under our incident response plan, the Technology & Security Team is tasked with identifying and responding to actual or suspected cybersecurity incidents or other data-related events, as well as escalating qualifying incidents and events to a cross-functional leadership team, which includes representation from Technology, Security, Privacy and executive leadership, including our Chief Legal & Risk Officer. The leadership team is responsible for supervising incident response, remediation and compliance with any notification and disclosure obligations with respect to any incidents that have been escalated in accordance with our incident response plan. The Technology & Security Team conducts regular security assessments and employee security awareness trainings and tracks cybersecurity events through the preparation of quarterly status reports and metrics. The team presents these reports and metrics, together with additional internal metrics associated with the status of the Company's cybersecurity program and updates on the status associated with enterprise risk mitigation for technology-based programs, including cybersecurity initiatives, to the Audit Committee of the Board of Directors (the "Board") at least bi-annually. Additionally, the Company's Enterprise Risk Management Team ("ERM Team"), which is responsible for assisting the Company in identifying, assessing, managing, mitigating and reporting on top enterprise risks (including cybersecurity risks), provides updates to the Audit Committee at least bi-annually.


text: Role of the Board of Directors Our Board has delegated responsibility for overseeing our technology, cybersecurity and data privacy programs and controls to the Audit Committee. The Audit Committee evaluates the adequacy of the Company's technology and cybersecurity (including data protection) programs, with the CTO. The CTO provides periodic updates concerning the Company's technology and cybersecurity programs (including data protection) to the full Board on an annual basis.


text: As a medical device manufacturer that directly interacts with both healthcare professionals and patients, we recognize data privacy and cybersecurity as fundamental imperatives. Like all companies of our size, computer system complexity, and geographic reach, our information systems are subject to constant probing from outside actors and potentially vulnerable to internal and external malicious intrusion, cyberattacks and computer viruses. Because the techniques used to obtain unauthorized access or sabotage systems change frequently and, generally, are not recognized until launched against a target, we maintain a multifaceted approach to assessing, identifying and managing our material risks related to cybersecurity threats. This approach is integrated into our overall risk management processes. We use both technology-based solutions (e.g., anti-virus software, automated intrusion detection systems, spam filters, encrypted virtual private networks) and human-based solutions (e.g., data management policies, outside penetration testing, employee training and testing, independent audits) to defend against cybersecurity threats. We reinforce our commitment to a strong cybersecurity culture through security training and awareness programs. Education on topics such as data security, privacy practices, email and mobile security as well as tailored topics such as secure programming for developers make our employees aware of the need to make sound cybersecurity decisions. Our goal is to promote a culture of thorough security and impress upon our employees that everyone has a part to play in securing corporate data and information systems.

companyName: NovoCure Ltd

ticker: NVCR


text: We have obtained both ISO 13485 (quality management systems for medical devices) and ISO 27001 (information security management systems) certifications, which require independent annual auditing to obtain and maintain. In addition to our commitment to secure our employees', customers' and patients' data, as well as intellectual property, we take steps to ensure data integrity and protection standards are maintained throughout our supply chain. We understand that supply chains are vulnerable to increasing risks from cybersecurity threats. Cybersecurity threats to our supply chain are accounted for by performing risk assessments by our dedicated cybersecurity staff. These analyses take into account the type and amount of data being accessed and the supplier's ability to employ and maintain cybersecurity health and is also verified through third-party assessments and certifications. Supply chain vendors are monitored to ensure that risks remain mitigated and mechanisms are in place to allow for tracking and reporting of any material supplier cybersecurity events. Data security requirements are also included in all key vendor contracts. All vendors that handle personal information are required to provide appropriate protection in accordance with our policies and applicable regulations and laws.


text: Our Board of Directors has primary oversight over our risk management activities and has specifically delegated cybersecurity risk management oversight to its Audit Committee, which is comprised entirely of independent directors. At least on a quarterly basis, our information security management provides updates on our cybersecurity activities and to the extent any cybersecurity incidents may have occurred. On at least an annual basis, our information security management team engages in a thorough discussion and review of our cybersecurity practices and procedures that are designed to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our information security management team is led jointly by our Vice President, IT Infrastructure and Cybersecurity and our Director of Privacy.


text: We have dedicated privacy and cybersecurity officers and committees with established processes to assess, identify, manage and investigate all potential privacy and cybersecurity risks and incidents. As a medical device manufacturer with a global presence, we are compliant with privacy laws and regulations in all jurisdictions where we conduct business. In the U.S., the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH" and collectively "HIPAA") provides data privacy and security provisions for safeguarding medical information. Additionally, states in the U.S. are enacting local privacy laws (e.g., California). In the EU, the General Data Protection Regulation ("GDPR") harmonizes data privacy laws and rules on the processing of personal data, including patient and employee data, across the EU. The GDPR has a number of strict data protection and security requirements for companies processing data of EU residents, including when such data is transferred outside of the EU. Additionally, we need to comply with analogous privacy laws in other jurisdictions in which we operate, such as the Israeli Privacy Protection Law, the Asia Pacific Economic Cooperation Privacy Framework, and Japan's Act on the Protection of Personal Information. Our policies and procedures are all designed to ensure compliance with these obligations.


text: We have not encountered any incidents from cybersecurity threats to date, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy Our Cybersecurity and Digital Risk Management ("CDRM") organization, under the leadership of a Global Chief Information Security Officer ("Global CISO"), operates a cybersecurity program that is designed to help us assess, identify, manage, and mitigate risks relating to cybersecurity threats and incidents. We design our cybersecurity standards, policies, processes and controls to operate in an integrated manner, leveraging applicable industry standards and security frameworks, including the NIST Cybersecurity Framework, as guides in supporting our ability to perform such functions.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: CDRM manages our cybersecurity program, including by fostering collaboration with partners across business units and functional areas to identify and assess material cybersecurity threats, evaluate their severity, and explore ways to mitigate and manage such risks. Business units and functional areas are responsible for managing risks and implementing our policies and standards within the respective business unit or function. Compliance with our policies and standards is assessed by CDRM in conjunction with our internal audit function, through periodic cybersecurity audits.


text: As part of our cybersecurity program, we maintain a Cyber Risk Management Program that seeks to address key risk management concepts, including mission and vision, escalation path for risk mitigation, risk assessments, and risk treatment. We do so by conducting a variety of planning and preparedness activities, including employing monitoring tools to identify suspicious or anomalous activity, vulnerabilities, or signs of compromise across our networks, systems, and data. We utilize data from attack surface management tools to produce a prioritized set of vulnerabilities for remediation. We also require mandatory cybersecurity training for employees and periodically conduct Company-wide phishing simulations.


text: To aide in assessing material risks from cybersecurity threats, our enterprise risk management ("ERM") program incorporates cybersecurity risks as part of its process to assess overall risk of the Company. The ERM organization supports management by facilitating a semi-annual risk assessment, which documents the priority and status of these risks and aligns them with our strategic mitigation efforts. ERM is structured using a framework based on guidance from the Committee of Sponsoring Organizations of the Treadway Commission on Enterprise Risk Management Integrating Strategy with Performance.