text: Our cybersecurity program includes systems and processes for assessing, identifying and managing material risks from cybersecurity threats and include maintenance and monitoring of information security policies aligned with information technology controls; user and employee awareness of cybersecurity policies and practices; information systems configuration management; and infrastructure security systems. Management makes concerted efforts to select third-party software providers with a demonstrated track-record of effectively addressing cybersecurity concerns. In event of a cybersecurity incident, we would rely upon these providers. We have developed and implemented cybersecurity and data privacy processes and procedures that are informed by recognized cybersecurity frameworks and standards, including Microsoft Azure CSPM and SOC 2. We use this framework, together with information collected from periodic manual assessments and automated testing, to tailor aspects of our cybersecurity practices given the nature of our assets, operations and business.


text: The members of our information technology team actively monitor threats to the information technology environment and work with our third -party service providers to monitory cybersecurity threats. In light of the Company's current size and limited personnel, management believes relying on experienced third -party providers is the most prudent and cost-effective course.

companyName: STREAMLINE HEALTH SOLUTIONS INC.

secItem: Item 1C


text: As of the date of this Annual Report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition. For more information on how cybersecurity risk could materially affect our company's business strategy, results of operations, or financial condition, please refer to the "Risk Factors" section of this Annual Report.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. Our Board of Directors is responsible for general cybersecurity risk oversight and stays informed on data privacy and information security issues and vulnerabilities that may be applicable to the Company. Our Board of Directors reviews and evaluates management's evaluation and mitigation of cybersecurity risks as part of its oversight of the Company's risk management program. Management periodically reviews cybersecurity risks and risk mitigation plans and activities with the Board of Directors. We outsource most aspects of our information technology management and these third-party providers are available to address any cybersecurity issues that may arise.


text: Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third -party assessments, internal audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things:

companyName: SPAR Group, Inc.

ticker: SGRP


text: As noted, to operate our business, we utilize certain third -party service providers to perform a variety of functions and provide certain security-related services, such as outsourced business critical functions, professional services, SaaS platforms, managed services, cloud-based infrastructure, data center facilities, content delivery to customers, encryption and authentication technology, corporate productivity services, and other functions; as well as third parties that assist us to identify, assess and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity software providers, penetration testing firms and other vendors that help to identify, assess or manage cybersecurity risks. Response, eradication and recovery, Post-incident analysis and future preparations.


text: Cybersecurity Governance Cybersecurity holds a significant role within our risk management procedures and remains a focal point for our Board and management. Under the Board's oversight of general risk identification and management activities, the Audit Committee monitors cybersecurity risks. Committee members engage in comprehensive discussions with management regarding these risks, as well as the measures taken to safeguard the company's information systems and security, along with reviewing management's steps towards data privacy protection. Additionally, the Audit Committee receives annual cybersecurity updates from senior management, covering both existing and emerging risks, management's responses and mitigation efforts, any cybersecurity or data privacy incidents, and the status of key information security initiatives. Furthermore, our Board members regularly hold informal discussions with management about cybersecurity news events and any updates to our cybersecurity risk management and strategy programs.


text: During the last fiscal year, 2024, the Company did not encounter any material cybersecurity incidents, nor did it incur any notable expenses as a result.


text: Our technologies, systems and networks may be subject to cybersecurity threats. Our business, like others within the energy technologies industry, is faced with growing cybersecurity threats as we increasingly rely on digital technologies across our business, some of which are managed by third -party service providers on whom we rely to help us collect, host or process information.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: We recognize the significance of these threats, sometimes referred to as hacking, cybersecurity fraud, and cyberattacks, and maintains processes and procedures designed to protect our critical systems and sensitive information from unauthorized access. However, there can be no assurance that a cyber-attack would timely be detected or thwarted. To date, we are not aware of any material cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, and we have not incurred significant operating expenses related to cybersecurity incidents. For more information on risks related to cybersecurity, please see the section titled "Risk Factors" included under Item 1A of this Annual Report on Form 10-K.


text: Risk Management and Strategy Our cybersecurity risk management program includes operational, technical and physical controls to protect against and respond timely to cybersecurity threats. To address evolving cybersecurity risks and corresponding regulations, our policies and procedures are benchmarked to industry, regulatory and cybersecurity frameworks (including the National Institute of Standards and Technology). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we may use industry, regulatory, and cybersecurity frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Management has engaged third -party vendors to assist in monitoring our cybersecurity risk management programs and identifying and responding to any incidents. Additionally, third -party vendors are routinely engaged to evaluate how effectively management as a whole manages cybersecurity risk. This includes annual testing of our incident response plan through tabletop exercises and simulations to ensure readiness as well as penetration testing and security assessments. We also utilize third -party cybersecurity vendors to assess our protections against identified vulnerabilities, and we have implemented a third -party risk management process for key service providers, based on our assessment of their criticality to our operations.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our business and operations may be materially adversely impacted in the event of a failure or security breach of our or any critical third parties' IT Systems or Confidential Information."


text: The Board of Directors has delegated the oversight of risks from cybersecurity threats to the Audit Committee, which has delegated authority to the Chief Financial Officer to oversee the Company's day-to-day cybersecurity risk management, including prevention, detection and responding to any suspected cybersecurity incident.


text: The Director, Global Information Technology and Financial Systems (the "IT Director"), leads an internal team who work directly with our third-party vendors to manage our cybersecurity risk management program and activities. The internal team monitors our information systems for cybersecurity threats, reviews cybersecurity incidents, analyzes emerging threats, and develops and implements risk mitigation strategies. Under our CFO's authority, the IT Director periodically reports on the cybersecurity program to our executive leadership team, including by providing the team with updates on cybersecurity threats and incidents, the status of ongoing projects and initiatives, performance metrics, and additional cybersecurity topics. On an annual basis, the IT Director reviews the results of the current state of cybersecurity risk management, including the results of our cybersecurity risk assessment and any action plan to address any identified vulnerabilities.


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our Board and our management actively oversee our risk management program, including the management of cybersecurity risks. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that the Company's sustained investment in these efforts and technologies have put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: SOLITRON DEVICES INC

ticker: SODI


text: Risk Assessment: At least annually, we conduct a cybersecurity risk assessment that takes into account information from our employees, known information security vulnerabilities, and information from external sources, including reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants. The results of the assessment are used to develop initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader Company-wide risk assessment that are then reported to our Board and members of management.


text: We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third -party service providers, ensuring the service providers adhere to our security standards, thereby safeguarding our integrated operations. The strategic migration of our data centers and infrastructure to secure cloud environments, coupled with the implementation of targeted technical cybersecurity measures, underscores our dedication to establishing foundational security across our users, applications, data, systems, and networks.

companyName: TRANSCAT INC

ticker: TRNS


text: We have established a comprehensive incident response plan to swiftly address and recover from cybersecurity incidents, minimizing operational impact. We conduct regular trainings and simulations to enhance our team's awareness and preparedness against cyber threats. Our proactive approach to addressing identified vulnerabilities affirms the continuous improvement of our security posture.


text: Use of Consultants and Advisors. We engage various third -party cybersecurity service providers to assess and enhance our cybersecurity practices and assist with the protection and monitoring of our systems and information. This encompasses a range of services, including network monitoring, endpoint protection, vulnerability assessments, and penetration testing. Additionally, we engage cybersecurity consultants, auditors, and other third parties, such as a third -party consulting firm, to rigorously evaluate our cyber processes. This includes a comprehensive assessment of our incident response procedures, ensuring they meet the highest standards of readiness and effectiveness.


text: To ensure the integrity and security of our operations, we have implemented stringent processes to evaluate third -party service providers and vendors that have access to sensitive systems, as well as company and customer data. This evaluation may include due diligence procedures such as assessments of the service provider's cybersecurity posture or recommendations for specific mitigation controls. Following an assessment, we determine and prioritize service provider risk based on potential threat impact and likelihood. These risk determinations are crucial in driving the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Management has implemented robust risk management structures, policies, and procedures, with day-to-day cybersecurity risk management being a core responsibility. Our Chief Information Officer ("CIO") spearheads the assessment and management of cybersecurity risks, ensuring that our strategies and actions are both proactive and responsive to the evolving cybersecurity landscape. Supporting this effort, we have a cross-departmental approach to cyber security management. This ensures that our executive leadership team receives comprehensive quarterly updates on cybersecurity from various teams within the organization. Such updates are instrumental in promoting stakeholder engagement across all levels and enhancing management's oversight of cybersecurity. The content of these updates includes progress on ongoing cybersecurity initiatives, insights from recent threat assessments or incidents, findings and action plans derived from external vulnerability and penetration tests, and key performance metrics aligned with industry standards. Our CIO and our Chief Financial Officer report risks to the Audit Committee on a quarterly basis.


text: Risks from Material Cybersecurity Threats. Despite ongoing cyber-attacks, such as unauthorized access, phishing, and ransomware, we have not identified any cybersecurity incidents that have materially affected or are reasonably anticipated to have a material effect on our business strategy, results of operations, or financial condition. Our proactive security measures, alongside those of our third -party vendors, aim to protect our information technology systems and the sensitive data they hold. To bolster our cybersecurity posture, Transcat has engaged a third -party Managed Security Services Provider ("MSSP") to enhance our defensive capabilities. This partnership includes comprehensive vulnerability scanning both internally and externally to detect potential security weaknesses before they can be exploited. Our MSSP also provides round-the-clock monitoring through a 24x7x365 Security Operations Center ("SOC"), safeguarding our digital assets ("Endpoint Detection and Response - EDR"), identities ("Identity Detection and Response - IDR"), and integrating supplemental logging sources such as firewalls and Enterprise Resource Planning systems ("Extended Detection and Response - XDR"). Furthermore, we have established Incident Response as a Service ("IRaaS") to ensure rapid and effective action in the event of a security breach.


text: Cybersecurity threats, including any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. See the Risk Factor titled "We are subject to cyber-security risks, including those related to customer, employee, vendor or other company data and including in connection with integration of acquired businesses and operations" for a discussion of risk associated with cybersecurity.

companyName: Charlie's Holdings, Inc.

ticker: CHUC


text: Risk Management and Strategy We recognize that cybersecurity is integral to safeguarding our operations, intellectual property, patient data and stakeholder trust. Our cybersecurity risk management processes are designed to assess, identify and mitigate material risks from cybersecurity threats. Despite our best efforts to improve cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity risks is constantly evolving and we will continue to assess and update our cybersecurity measures in response to emerging threats.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: Risk Assessment and Identification We have implemented security measures as part of an evolving cybersecurity posture and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks and mitigate the damage that could result from such an attack. As the Company does not have a physical office location, it does not have a local network or in-house servers and proprietary applications. We therefore utilize third-party applications and resources to support our information technology ("IT") needs. All applications utilized by the Company are Software as a Service ("SaaS") offerings. As our applications are developed and managed by third parties, we are dependent on these providers for many functions including disaster recovery during a disaster or cyber incident. We prioritize risks based on their potential impact to our financial condition, operational continuity and reputation. Our goal is to only utilize the most secure and trusted providers for our IT needs.


text: Preventive Controls: We deploy advanced firewalls, endpoint protection and intrusion detection systems to secure our network infrastructure. Multi-factor authentication and encryption are enforced across critical systems and data repositories. Monitoring and Detection: Continuous monitoring of our IT environment is facilitated through our third -party service provider. Incident Response: We maintain an incident response plan that outlines procedures for containment, eradication, and recovery from cybersecurity incidents.


text: Employee Training: All employees receive mandatory cyber security awareness training at onboarding, covering phishing prevention, secure data handling and how to recognize common attack strategies and reporting suspicious activities.


text: Third-Party Risk Management We rely on third -party vendors for certain operational and IT services. To mitigate risks associated with these vendors, we will implement a vendor risk management program that includes: Due diligence reviews of third -party vendors' cybersecurity policies and practices prior to, and during, potential engagement. Contractual requirements for third -party vendors to maintain robust security controls, where applicable, and report incidents promptly.


text: Material Impact of Cybersecurity Risks Cybersecurity threats have the potential to disrupt operations, compromise sensitive data or lead to regulatory penalties. Our proactive risk management processes are designed to minimize the likelihood and impact of such events. As of March 31, 2025, we did not experience any cybersecurity incidents.


text: Cybersecurity Governance The Audit Committee is responsible for oversight of cybersecurity risk. Our Chief Executive Officer and Chief Financial Officer are the members of management responsible for managing and assessing our cybersecurity practices. Our Chief Executive Officer and Chief Financial Officer have each served as executive officers of public companies in the past. The plan for the future is that they will report to the Audit Committee on cybersecurity on a semi-annual basis. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Audit Committee and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken.


text: Risk management and strategy The Company is committed to securing our information technology systems, including accounting software, point-of-sale software, and back-of-house software, against cybersecurity threats and protecting the privacy of the data of our customers', employees', franchisees', licensees' and other business partners. However, as described in "Item 1A. Risk Factors – Cyberattacks and breaches could cause operational disruptions, fraud or theft of sensitive information " of this Form 10-K, we recognize that cybersecurity threats are an ongoing concern in today's digital world and that, despite devoting resources to secure our information technology systems, cybersecurity incidents can occur and, if so, could negatively impact our brand, business, results of operations and financial condition. Cybersecurity threats include any potential unauthorized occurrence on or conducted through our information technology systems or information technology systems of a third party that we utilize in our business that may result in adverse effects on the confidentiality, integrity or access to our information technology systems.

companyName: NATHANS FAMOUS, INC.

ticker: NATH


text: Our cybersecurity risk management program includes a cybersecurity incident response plan. We design and assess our program primarily following the guidelines of the National Institute of Standards and Technology and Payment Card Industry Data Security Standard. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. The objectives of our programs are to protect the confidentiality, integrity, use and availability of the Company's data; to protect against unauthorized access to the Company's data, the Company's network and information technology applications; and to maintain disaster recovery plans to prepare for and respond to the potential for a disruption in the Company's informational technology. Our programs fall under the oversight of our Information Technology manager.


text: To supplement our internal controls and processes and to meet these objectives, the Company engages third-party consultants who work closely with the Company's Information Technology manager to collectively manage our cybersecurity, information technology and data privacy programs, as well as perform application security reviews, scans and penetration tests. The Company's senior management team, including its Chief Executive Officer and its Chief Financial Officer, reviews the assessments performed by its third-party consultants and determines the plans to be executed in collaboration with the Information Technology manager.


text: Our information technology infrastructure includes firewalls, modern endpoint protections, intrusion detection tools and alerts, as well as multi-factor authentication to provide a multi-layered approach to protecting our information technology systems from unauthorized access, use, disclosure, disruption, or destruction. Such applications are regularly monitored and reviewed for adequacy and potential enhancements.


text: We obtain System and Organizational Controls ("SOC") 1 or SOC 2 reports on an annual basis from vendors that host our significant financial applications to aid in our assessment of information security risk amongst our relationships with the host vendors. We also perform quarterly access reviews for these systems that are subject to Sarbanes-Oxley oversight.


text: Over 98% of our restaurants are operated by franchisees who themselves are at risk of potential cybersecurity threats. There is no connectivity between the Company's network and the networks on which our franchisees and licensees operate. Furthermore, there is no interface between the Company-owned restaurants point-of-sale system and the Company's network and no interface between the Company's primary manufacturer, Smithfield Foods, Inc. and the Company's network.


text: The Company routinely leads training exercises, at least annually, for its employees to reinforce the risk from common tactics and scams like email phishing campaigns, as well as more sophisticated descendants (i.e. spear phishing and smishing) to defend against potential business email and network compromise.


text: We have developed an incident response plan outlining immediate response actions, including internal and external communication protocols. The incident response plan is reviewed regularly by our third-party consultants in collaboration with our Information Technology manager evaluating our capabilities and our readiness. Under the plan, we have identified a management group comprised of our Chief Executive Officer, Chief Financial Officer, Corporate Controller and Information Technology manager. The plan provides that any cybersecurity incident will be reviewed by this group to determine whether any such incident is material for securities laws purposes and whether public disclosure is required, following consultation with outside counsel, the Audit Committee and/or Board of Directors.


text: We maintain cyber risk insurance coverage that is intended to mitigate the financial impact of cybersecurity and data privacy incidents experienced by the Company. There can be no assurance that our cyber insurance policies will be sufficient in scope or amount to cover the costs and expenses related to any future cybersecurity incidents and it does not remedy the reputational and future business impacts.


text: The full Board of Directors has overall responsibility for risk oversight, including cybersecurity matters. It is supported by the Audit Committee, which reports to the full Board of Directors. The Audit Committee receives updates from management, as necessary, on the cybersecurity landscape and cybersecurity risks impacting the Company. At least annually, the Board of Directors receives a cybersecurity update as part of our Company's risk management program. Such updates are designed to ensure that the Company's senior management team remain informed about and can monitor the prevention, detection, mitigation, and remediation of potential cybersecurity incidents.


text: At a management level, our cybersecurity program is led by our Information Technology manager, who reports to the Chief Financial Officer. Our Information Technology manager is supported by our third-party consultants. Our Information Technology manager along with the support of our third-party consultants, is equipped to help navigate the landscape of cybersecurity risks and challenges and to implement and to manage a comprehensive security strategy.


text: Risk and vulnerability management encompassing both proactive and predictive defenses which provides opportunities to assess, remediate, and validate; and Managed detection and incident response, including advanced endpoint protection and data loss prevention.

companyName: Seneca Foods Corp

ticker: SENEA


text: The information technology department, led by the Senior Vice President of Technology and Planning, Chief Information Officer ("CIO"), is responsible for the Company's cybersecurity program. The CIO, along with the certified Information Security Officer and the VP of Information Technology have significant experience spanning over 20 years in information security, infrastructure, and compliance.


text: Cybersecurity Controls We have implemented a modern, comprehensive set of controls that restrict access to systems using a combination of firewalls, virtual private networks, multi-factor authentication and enforced use of corporate controlled compliant devices. We utilize automated intrusion prevention, detection and response systems which constantly monitor activity, build usage patterns and respond or alert when unusual activity is detected. We have experienced staff who perform root cause analysis, respond to any immediate threat, and implement improved controls for future prevention. Our cybersecurity tools are fully integrated and collect data from various sources to build relationships and detect more complex multi-channel attack strategies. Application controls are role-based and designed to protect data confidentiality and provide overall data integrity. A risk-based approach is taken regarding third-party systems utilized in our business.

companyName: FRIEDMAN INDUSTRIES INC

ticker: FRD


text: A team comprised of IT personnel responsible for directing ( 1) our cybersecurity risk assessment processes; ( 2) our security controls; and ( 3) our response to cybersecurity incidents;

companyName: CYANOTECH CORP

ticker: CYAN


text: During the fiscal year ended March 31, 2025, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition, as we have described in the Risk Factors section of this Form 10-K.


text: As of May 31, 2025, the Company has not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operation or financial condition. The Company has further disclosed how risks from cybersecurity threats could potentially have a material impact on the Company, including its business strategy, results of operations, or financial condition, in Part I, Item 1A, "Risk Factors" of this Annual Report.

companyName: CROWN CRAFTS INC

ticker: CRWS


text: Cybersecurity Governance Cybersecurity, as an important part of the Company's risk management processes, is a critical area of focus for the Company's Board of Directors (the "Board"), which is responsible for oversight of the Company's cybersecurity risk, including the effectiveness of cybersecurity risk management policies and protocols. As part of the Board's oversight, the Board receives periodic reports from the Company's Vice President of Information Technology and other members of the Company's executive management team. These reports include updates on the Company's cybersecurity risks and threats, the status of projects intended to strengthen its information security systems, assessments of the cybersecurity program, and the emerging threat landscape.


text: We use third -party service providers to perform a variety of functions throughout our business, such as internet hosting companies, distributors, and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with any particular provider.

companyName: EMERSON RADIO CORP

ticker: MSN


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10 -K, including "An information systems interruption or breach in security, including as a result of cyber-attacks, could adversely affect the Company's business, results of operations and reputation."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Operating Officer ("COO"). Our COO, assisted by our Senior Vice President for Operations, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our COO and Senior Vice President for Operations are responsible for reviewing security assessments and other security-related reports.


text: Our management team, specifically our President and Chief Financial Officer, are responsible for the day-to-day administration of our business operations, including our risk management of cybersecurity risks. Our management is responsible for the design and implementation of policies, processes and internal controls to manage our cybersecurity risks. Our management team regularly meets with their information technology resources, including our third-party service providers, to ensure that we are appropriately positioned to manage our cybersecurity risks. Our management team also sponsors periodic cybersecurity awareness training for employees.

companyName: PodcastOne, Inc.

ticker: PODC


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For further discussion of the cybersecurity risks, see "Part I—Item 1A. Risk Factors," specifically the risk titled "Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business and our products." No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For further discussion of the cybersecurity risks, see "Part I — Item 1A. Risk Factors," specifically the risk titled "We are subject to cybersecurity risks to our systems, infrastructure, and technology, and data processed by us or third-party vendors." No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.

companyName: LiveOne, Inc.

ticker: LVO


text: Our cybersecurity risk management program is led by our Chief Information Officer ("CIO"), who is directly responsible for establishing cybersecurity strategies and structures and managing ongoing cybersecurity risk management activities. Our CIO is part of the executive management team, and updates our CEO and executive management on a monthly, or even more frequent basis, on cybersecurity enhancement and the development and implementation of our roadmap.


text: Cybersecurity risk, management, and strategy Tilray recognizes that cybersecurity is critical to protecting our systems, data, and operations. We are committed to addressing the significant risks posed by cyber threats by proactively managing the evolving landscape through a comprehensive, enterprise wide approach. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management framework to other legal, compliance, operational, and financial risk areas. The Company is committed to maintaining robust processes to assess, identify and mitigate material risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents.

companyName: Tilray Brands, Inc.

ticker: TLRY


text: Our business is subject to various cybersecurity risks, including but not limited to, unauthorized access to sensitive data, including customer information and medical information, disruption of operations or supply chain due to cyberattacks, theft or manipulation of intellectual property, such as proprietary strains or cultivation techniques, regulatory non-compliance resulting from cybersecurity breaches, including violations of data privacy laws. To address these risks, we have implemented a comprehensive cybersecurity program, which includes, regular risk assessments and vulnerability testing to identify and remediate potential weaknesses in our infrastructure, deployment of advanced access controls, encryption, and endpoint protection to safeguard sensitive data such as customer and medical information, mandatory annual cybersecurity training and awareness programs for all employees to reduce the risk of social engineering and phishing attacks, and continual monitoring and incident response protocols to detect, contain and respond to cybersecurity incidents in a timely and effective manner. We also have information security and data privacy policies and procedures in place applicable to our directors, officers, employees, contractors and suppliers. Third parties service providers also contribute to our overall cybersecurity. We engage third parties that are cybersecurity experts to support in the design, implementation and continuous improvement of our cybersecurity program.


text: As of the date of this Form 10 -K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" for further information about these risks.


text: Cybersecurity governance Cybersecurity is an important part of our risk management processes and is an area of focus for our Board, Chief Information Officer ("CIO") whom reports directly to the Chief Executive Officer, and management team. Our CIO plays a pivotal role in assessing and managing material risks stemming from cybersecurity threats and is primarily responsible for the oversight of our overall cybersecurity risk management program, and coordinates with our external cybersecurity consultants. Additionally, given that cybersecurity risks can impact various areas of responsibility of the Committees of the Board, our Board of Directors oversees cybersecurity risk management and regularly reviews our cybersecurity strategy and initiatives. The Board receives quarterly and as needed updates on cybersecurity matters from the CIO and management on topics including threat landscape developments, incident response readiness, and program enhancements.


text: In order to oversee and identify risks from cybersecurity threats associated with our use of third -party service providers, we perform third -party risk assessments designed to help protect against the misuse of IT by third parties and business partners and generally request that third -party service providers provide us information about their security policies and procedures.

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: Our board of directors, through its Audit Committee, maintains oversight of risks, including cybersecurity risks, and receives an update from the Director of IT Security and the Chief Information Officer (CIO) at each quarterly committee meeting. The Audit Committee also reports to the full board on cybersecurity matters as part of its regular report out after each meeting. The Audit Committee Chair is immediately informed of any breach that could be more than de minimis and is kept apprised of any resulting investigation and is briefed on the substance of any Form 8 -K filing related to a material cybersecurity incident.


text: In an effort to deter and detect cyber threats, we have a required cybersecurity training program that is provided to all new employees during on-boarding and semi-annually to employees with access to our IT resources, which aims to raise awareness and foster a culture of cybersecurity awareness among our workforce. We also have an ongoing process of sending simulated phishing emails to employees. The results of these simulated attempts are monitored and reported to each employee's manager. Training includes such cybersecurity topics as social engineering, phishing, password protection, confidential data protection, asset use and mobile security. The training also emphasizes the importance of reporting all incidents immediately.


text: Risk Management and Strategy We have policies, procedures and processes in place to identify, assess and monitor material risks from cybersecurity threats. These plans are part of our overall enterprise risk management strategy and are part of our operating procedures, internal controls, and information systems. Cybersecurity risks include, among other things, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks. We have developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications or requirements under the NIST.

companyName: ETHAN ALLEN INTERIORS INC

ticker: ETD


text: The Company's Board of Directors (the "Board"), as a whole, has oversight responsibility for our strategic and operational risks. The Board regularly reviews and discusses with management the strategies, processes and controls pertaining to the management of our information technology operations, including updates on the internal and external cybersecurity threat landscape, incident response, assessment and training activities, and relevant legislative, regulatory, and technical developments. Our Vice President of Information Technology presents, at least annually, to the Board, an overview of our cybersecurity threat risk management and strategy as well as provides reports regarding the evolving cybersecurity landscape, including emerging risk. Our Vice President of Information Technology and other members of his team remain informed about cybersecurity threats through the reporting framework as described above under Cybersecurity Risk Management and Security – Cybersecurity incident response plan and testing.


text: The Information Technology team is responsible for the day-to-day assessment and management of cybersecurity risks. Our cybersecurity risk management and strategy are led by our Vice President of Information Technology, and our Manager of Security. Such individuals have over 50 years of work experience, collectively, in various roles managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs, as well as relevant degrees and certifications.


text: The Company's Audit Committee is responsible for exercising oversight of management's identification and management, and planning for, risks from cybersecurity threats.

companyName: TWIN DISC INC

ticker: TWIN


text: The Company has developed and implemented processes to assess, identify, and manage material risks from cybersecurity threats as part of its overall enterprise risk management system. Its cybersecurity processes include security monitoring and threat hunting through a third-party managed vendor and mandatory, company-wide employee training. The processes also extend to oversight and identification of risks associated with vendors and customers if their computer systems interface with the Company's information systems. Upon detection of a potentially material cybersecurity incident, the Company initiates its cyber incident procedure to investigate, contain, and remediate the incident.


text: The Company recognizes the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational resilience and protecting stakeholders' interests. The Company currently manages cybersecurity risks by working with third-party IT consultants and utilizing basic security protocols. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to the best of their ability to ensure that potential cybersecurity risk exposures are monitored, putting in place reasonably appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of the CFO with assistance from the management team. Any significant cyber incidents that they become aware of are reported to the board of directors. The Board of Directors does not have a designated cybersecurity committee, but the Audit Committee receives periodic updates on cybersecurity matters. The Company has not experienced any material cybersecurity incidents to date and there are no material cybersecurity incidents discovered in 2025. Please refer to Item 1A: Risk factors for further insights into cyber attack-related risks.

companyName: Star Gold Corp.

ticker: SRGZ


text: Risk Management and Strategy We are committed to preserving the trust and confidence of our stakeholders by taking appropriate technical and organizational measures for maintaining information security and data privacy. Our cybersecurity program allows us to assess, identify and manage information security and cybersecurity threats through risk assessment and prevention measures to facilitate communication, training, awareness and incident response procedures. We have established policies and procedures to ensure timely and appropriate notifications to relevant parties and regulators as required for cybersecurity threats and data breaches.

companyName: LSI INDUSTRIES INC

ticker: LYTS


text: Our data breach response designates an incident response team comprised of senior leaders within information technology, finance and compliance functions to ensure timely diagnosis and mitigation of cyber events. The incident response team is responsible for determining whether a cybersecurity incident is material and requires current reporting pursuant to SEC Form 8-K Item 1.05 (Material Cybersecurity Incidents). In conducting the assessment, the team considers factors including but not limited to the probability of an adverse outcome; the potential significance of loss; the nature and extent of harm to individuals, customers, and vendors; the nature and extent of harm to our competitive position or reputation; and the possibility of litigation or regulatory investigations.


text: Risks from Cybersecurity Threats We have not encountered any cybersecurity challenges that have materially impaired our operations or financial standing in Fiscal 2025 and Fiscal 2024.

companyName: TRIO-TECH INTERNATIONAL

ticker: TRT


text: Cybersecurity Risks We rely on internal and third -party information technology systems and networks to process, transmit and store electronic information in our operations, including our proprietary business information and that of our customers, suppliers and employees. We use various internal and third -party information technology systems and networks to manage our operations and maintain effective internal control over financial reporting. We also collect and store sensitive data, including intellectual property, proprietary business information and personal information of our customers, suppliers and employees, in our data centers and on our networks. The secure operation of these information technology systems and networks, and the processing and maintenance of this information, are critical to our business operations and strategy.

companyName: AYTU BIOPHARMA, INC

ticker: AYTU


text: Despite our security measures, our internal and third -party information technology systems and networks may be subject to damage, disruption, or unauthorized access due to a variety of factors, including cyber-attacks by computer hackers, computer viruses, ransomware, phishing, denial-of-service attacks, physical or electronic break-ins, employee error or malfeasance, power outages, natural disasters, or other catastrophic events. Any such damage, disruption, or unauthorized access could compromise our internal and third -party networks and the information stored there could be accessed, publicly disclosed, lost, or stolen. Any such access, disclosure, or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations, damage to our reputation, loss of customers, potential harm to our competitive position and additional costs to remediate the issue.


text: Cybersecurity Incidents Despite our efforts to prevent and mitigate cybersecurity incidents, we cannot guarantee that we, or third -party providers that we rely on, will not experience any breaches, disruptions, or unauthorized access to our information technology systems and networks. During fiscal 2025, we did not experience any cybersecurity incidents that materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, however, there can be no assurance that the measures we have taken to address IT and cybersecurity risks will prove effective in the future. For additional discussion of the IT and cybersecurity risks facing our business, please refer to Part 1, Item 1A, Risk Factors of this Annual Report.


text: We periodically engage third -party consultants and service providers to obtain an independent assessment regarding internal efforts to prevent threats to our Information Systems. Continuous vigilance over safeguarding the Company's Information Systems has resulted in our current approach and these assessments are shared with our Audit Committee.

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: To mitigate the occurrence of an incident as defined by the Company's formal documentation, which classifies and defines the properties of potential threats, the Company has in place a host of defenses which include, but are not limited to, the use of gateway consoles in all our global locations, limited access to key Information Systems from in-office networks or VPN with multi-factor authentication by means of a third -party mobile identity management tool to limit access to authorized users.


text: Management is not aware of any material security breaches on its Information Systems and risks from cybersecurity threats have not previously materially affected us. Certain of our vendors have experienced cyberattacks in the past and the threat and development of cyberattacks is continuous. It is impossible to say with certainty whether the Company's efforts will prevail in a coordinated attack on its Information Systems. Currently we expect the risks from cybersecurity threats will continue, but are not reasonably likely to materially affect us mostly due to our profile and not because our defenses are impenetrable or the efforts of criminals will not become more sophisticated. A cybersecurity attack on our systems could have a material negative impact upon our business, results of operations or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."


text: Role of the Board The Audit Committee of our Board of Directors (the "Board") has the responsibility for the oversight of risk management, including those risks related to cybersecurity. The Board holds strategic planning sessions with senior management to discuss strategies, key challenges, risks and opportunities for mitigation. The involvement of our Board in setting our business strategy is a key part of its oversight of risk management, its assessment of management's appetite for risk, and its determination of what constitutes an appropriate level of risk for us. Our senior management attends meetings of our Board and its committees on a quarterly basis, and management communicates with the Board and its members regularly between Board meetings as otherwise needed and are available to address any questions or concerns raised by our Board on risk management and any other matters.


text: Role of Management Our senior management, with the oversight of the Board, is responsible for the day-to-day management of the material risks the Company faces, including those related to cybersecurity. We believe it is important to work at all levels of the Company's hierarchy to manage cybersecurity risks and threats. Therefore, all users must use an online IT ticketing system, which is monitored around the clock, to report any incidents. Qualified individuals in IT determine what resources to allocate to each case and escalation of an incident, if deemed necessary. The Systems Administrators and IT Director, who has more than 18 years of experience with the Company, communicates on a day-to-day basis with the Chief Financial Officer, and President/Chief Operating Officer who would bring any material cybersecurity issues to the attention of the Company's Chief Executive Officer, the Audit Committee, and the Board.


text: We recognize the importance of cybersecurity in safeguarding sensitive information, withstanding and recovering from adverse events, and protecting stockholders' interests. We currently manage cybersecurity risks by utilizing basic security protocols, such as network monitoring and access controls. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes that are designed to ensure such potential cybersecurity risks are monitored, putting in place reasonable appropriate mitigation measures and maintaining cybersecurity programs. Any significant incidents are reported to the board of directors, however the board of directors does not have a designated cybersecurity committee. During the fiscal year ended June 30, 2025, we have not identified any indication of a cybersecurity incident that would materially affect our business.

companyName: MOVING iMAGE TECHNOLOGIES INC.

ticker: MITQ


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. To this end, our processes are designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems (including such risks associated with the use of any third -party service providers) that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by third -party experts under supervision of management, and, where necessary or desired, include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. We also consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: ReposiTrak, Inc.

ticker: TRAK


text: Risk Management and Strategy As a component of and integrated into our overall risk management strategy and system, we maintain a cybersecurity risk management program designed to assess, identify, manage and protect our information systems and data from unauthorized access, use, disclosure, disruption, modification or destruction. Our program is based on applicable industry frameworks and standards, including those provided by the National Institute of Standards and Technology, and is comprised of core functions to identify, protect, detect, respond to and recover from cybersecurity threats and events. We constantly monitor cybersecurity threats and test the performance and effectiveness of our cybersecurity program, with the assistance of third-party experts, on an annual and ongoing basis. We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments. As described in "Item 1A. Risk Factors" in this Form 10-K, we are subject to risks from cybersecurity threats that could have a material adverse impact on our business and financial results. As of the date of this report, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business, results of operations, financial condition and cash flows.

companyName: INSTEEL INDUSTRIES INC

ticker: IIIN


text: Our Information Services Department manages our cybersecurity risk management program which is overseen by the Vice President of Information Services. The Vice President of Information Services has a master's degree in business administration with a focus on technology and has decades of professional experience in cybersecurity threat assessments and detection, applicable technologies, incident response and employee training. Our Information Services Department includes a team of experienced professionals who have developed an Incident Response Policy that is regularly reviewed and updated. The Incident Response Policy establishes the required steps to assess, respond to and limit the impact of an incident, details tactical and strategic team membership and points of contact related to the response process and provides for escalating notifications to senior executives, including the Chairman of the Board and Chief Executive Officer, depending on the severity of the threat.


text: Our Senior Vice President of Information Technology manages our security program. Oversight of the program occurs via IT metrics-based updates provided to an Information Technology Steering team (consisting of the executive officers and other key employees of the Company) on a quarterly basis. Additionally, multiple elements of our cybersecurity security program are tested internally and externally on a bi-yearly basis in alignment with our Sarbanes-Oxley information security controls, and we engage independent third parties annually to assess the risks associated with our information technology assets. Our cybersecurity program is part of our enterprise risk management strategy and includes policies and procedures designed to safeguard the confidentiality, integrity, and availability of our information assets. Lastly, a cybersecurity risk assessment is provided to our Board of Directors on an annual basis which includes metrics, security incidents, key risk indicators, and risk mitigation plans as well as on the status of material risks, mitigation measures, and incidents related to such risks. Our Board of Directors has overall responsibility for risk oversight, with the Information Technology Steering team assisting the Board in performing this function based on its respective areas of expertise. As such, the Information Technology Steering team performs materiality determinations of cyber incidents and advises the Board of Directors accordingly.

companyName: GEOSPACE TECHNOLOGIES CORP

ticker: GEOS


text: We maintain a comprehensive cybersecurity risk management program that aligns to the National Institute of Standards and Technology (NIST) Cyber Security Framework and adopts a variety of cybersecurity best practices across the enterprise. We leverage industry-leading cybersecurity vendors that provide the following capabilities: Managed Detection and Response (MDR); a Security Operations Center (SOC) that monitors the Company's IT assets on a 24x7x365 basis; tools to interdict emails with phishing links and malware payloads; data leak protection tools that provide real-time interdiction of data transfers outside of normal business usage; vulnerability detection and automated patching tools; firewalls and instruction detection systems; multi-factor authentication mechanisms; mobile device management systems; penetration testing; and various third -party assessments. Our critical IP data is maintained on segmented, access-controlled data stores. We utilize a variety of backup mechanisms for its data including both warm and cold storage solutions. Lastly, we utilize token-based technologies to support Payment Card Industry Data Security Standard (PCI DSS) compliance safe handling and protection of credit card data.


text: We have a defined security policy that is reviewed on an annual basis. We have established response procedures for cyber-security incidents and test the procedures on a periodic basis. We provide robust computer-based cybersecurity and wire fraud / phishing awareness training to all new employees as well as training to existing employees on an annual basis. We have not experienced material information security incidents in the last three years nor have we incurred any material expenses related to penalties and/or settlements related to a material breach nor have we been materially affected or reasonably likely to have had a material adverse effect on us, our business strategy, results of operations, or financial condition. Nevertheless, we do carry a cybersecurity insurance policy.


text: The Trust does not have any officers, directors or employees. The Sponsor is responsible for the oversight and overall management of the Trust. The Sponsor is an indirect wholly owned subsidiary of the World Gold Council and relies on the World Gold Council's cybersecurity program for its own risk management. The Trust also relies on the cybersecurity programs of its service providers. The Board of Directors of the Sponsor (the "Board of Directors") receives reports from the Sponsor's officers detailing cybersecurity review processes, any potential risks and any incidents which could impact the Trust. The Board of Directors also periodically receives, and reviews reports from the World Gold Council and the Trust's service providers regarding their cybersecurity programs.

companyName: SPDR GOLD TRUST

ticker: GLD


text: Cybersecurity Program Overview The World Gold Council has a comprehensive cybersecurity program built around the National Institute of Standards and Technology's Cybersecurity Framework which is overseen by the World Gold Council's Chief Technology Officer. The program incorporates a variety of strategies and measures aimed at identifying, protecting, detecting, responding to and recovering from cyber incidents. The program's key components include risk assessment and management, where the Operational Risk Committee of the World Gold Council, of which the Principal Financial and Accounting Officer of the Sponsor is a member, identifies potential threats and vulnerabilities and implements appropriate controls to mitigate those vulnerabilities. As part of the program, the World Gold Council (i) develops and enforces security policies and procedures, providing guidelines for safe and secure operations, (ii) prioritizes employee training and awareness, as human error is often a significant factor in security breaches, (iii) conducts regular security audits and assessments to ensure that the program remains effective and up to date with evolving threats, and (iv) incorporates advanced technologies such as identify management, encryption, firewalls, anti-malware and intrusion detection systems to provide multiple layers of defense against cyber-attacks.


text: Management ' s Role in Cybersecurity Risk Management The Sponsor conducts annual due diligence on the Trust's service providers, including the Trustee and Custodians, which includes a review of the relevant service provider's operational and cybersecurity controls. The Sponsor's officers review and report the results of this annual review and any incidents or perceived risks to the Board of Directors.


text: Board Oversight of Cybersecurity Risks The Board of Directors receives a report from the Sponsor's officers detailing the Sponsor's annual due diligence on the Trust's service providers, including a summary of any potential operational risks and any incidents which could impact the Trust. The Board of Directors also periodically receives reports from the World Gold Council and the Trust's service providers regarding their cybersecurity programs.


text: GLDM does not have any officers, directors or employees. The Sponsor is responsible for the oversight and overall management of GLDM. The Sponsor is an indirect wholly owned subsidiary of the World Gold Council and relies on the World Gold Council's cybersecurity program for its own risk management. GLDM also relies on the cybersecurity programs of its service providers. The Board of Directors of the Sponsor (the "Board of Directors") receives reports from the Sponsor's officers detailing the Sponsor's cybersecurity review processes, any potential risks and any incidents which could impact GLDM. The Board of Directors also periodically receives, and reviews reports from the World Gold Council and GLDM's service providers regarding their cybersecurity programs.

companyName: World Gold Trust

ticker: GLDM


text: Cybersecurity Program Overview The World Gold Council has a comprehensive cybersecurity program built around the National Institute of Standards and Technology's Cybersecurity Framework which is overseen by the World Gold Council's Chief Technology Officer. The program incorporates a variety of strategies and measures aimed at identifying, protecting, detecting, responding to and recovering from cyber incidents. The program's key components include risk assessment and management, where the Operational Risk Committee of the World Gold Council, of which the Principal Financial and Accounting Officer of the Sponsor is a member, identifies potential threats and vulnerabilities and implements appropriate controls to mitigate those vulnerabilities. As part of the program, the World Gold Council (1) develops and enforces security policies and procedures, providing guidelines for safe and secure operations, (2) prioritizes employee training and awareness, as human error is often a significant factor in security breaches, (3) conducts regular security audits and assessments to ensure that the program remains effective and up to date with evolving threats, and (4) incorporates advanced technologies such as identity management, encryption, firewalls, anti-malware and intrusion detection systems to provide multiple layers of defense against cyber-attacks.


text: Management ' s Role in Cybersecurity Risk Management The Sponsor conducts annual due diligence on GLDM's service providers, including the Administrator and Custodians, which includes a review of the relevant service provider's operational and cybersecurity controls. The Sponsor's officers review and report the results of this annual review and any incidents or perceived risks to the Board of Directors.


text: Board Oversight of Cybersecurity Risks The Board of Directors receives a report from the Sponsor's officers detailing the Sponsor's annual due diligence on GLDM's service providers, including a summary of any potential operational or cybersecurity risks and any incidents which could impact GLDM. The Board of Directors also periodically receives reports from the World Gold Council and GLDM's service providers regarding their cybersecurity programs.


text: Third-party service providers are used in various capacities as part of our cybersecurity risk management program, including performing risk mitigation controls and providing cloud-based cybersecurity services and platforms. For example, third-party service providers are used to conduct our external penetration testing, as well as assist the Company in detecting, responding, and mitigating cybersecurity incidents. The Company uses a variety of processes to oversee and identify material risks from cybersecurity threats associated with the use of third-party service providers. Third-party service providers are required to complete a detailed questionnaire, which is used to identify and assess material cybersecurity risks. In addition, the Company performs an annual review of independent attestation reports of the third-party service providers' control environments designed to ensure that the controls meet Company security requirements and that any identified issues in the independent attestation reports do not present material cybersecurity risks to the Company.

companyName: J&J SNACK FOODS CORP

ticker: JJSF


text: Cyber Risk Management and Strategy Under the oversight of the Board of Directors, since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools designed to monitor, identify, and address cybersecurity risks. In support of this approach, we implement processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we c onduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident.

companyName: NORTHERN MINERALS & EXPLORATION LTD.

ticker: NMEX


text: Further, we have processes in place to evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that will have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement, and system monitoring.


text: We continue to evaluate and enhance our systems, controls, and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies.


text: We have policies and procedures for identifying, assessing, and managing material risks associated with cybersecurity threats. We seek to address cybersecurity risks through a comprehensive approach focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We implement and maintain technical and physical safeguards and other organizational measures, including, for example, the use of antivirus software, intrusion prevention and detection systems, virtual private networks, firewalls, email security, link protection, the regular deployment of updates and patches as they become available, a general policy against providing access to our network to any third party (with the exception of our third party information technology vendor), the use of a third party service to conduct mandatory online training for all employees regarding identifying and mitigating cybersecurity risks, regular phishing testing, regular reviews of access to systems and networks, and routine monitoring of compliance with our written information security plan. We also maintain cybersecurity insurance that provides for certain protection against potential losses arising from a cybersecurity incident.

companyName: HENNESSY ADVISORS INC

ticker: HNNA


text: The Company's cybersecurity program fundamentally aligns with the COBIT framework. This is reflected in our related policies, practices and procedures. We have multiple layers of security controls as well as a third -party SOC that helps identify, avoid and mitigate cybersecurity threats. The evaluation of risks includes consideration of cybersecurity and privacy risk, including ( 1) potential impact on the Company's employees, customers, and other stakeholders, ( 2) intelligence briefings on notable cyber events impacting the industry and ( 3) evaluation of external threats. The Company utilizes internal and third -party assessment tools and tests to evaluate its cyber risk policies, practices and procedures as well as to challenge how its defenses are built and deployed. These assessments provide opportunities for critical self-analysis, constructive feedback from third parties, and learnings from industry experts to enhance cyber resilience. Both formal and informal cybersecurity awareness trainings are provided to employees to help identify and avoid cybersecurity threats and to ensure employees understand the Company's cyber risk management policies along with the key role they play to ensure cyber hygiene. The Company has established a cybersecurity incident response team that includes the CEO, CFO, VP of HR, IT Director and other personnel. The Company has also retained counsel to advise on cybersecurity matters. The Company periodically undertakes table top exercises facilitated by a third party whereby the incident response team reacts to, evaluates and updates, if necessary, its policies and processes to a simulated cyberattack.

companyName: RGC RESOURCES INC

ticker: RGCO


text: a security team that is principally responsible for managing ( 1) our cybersecurity risk assessment processes, ( 2) our security controls and policies, and ( 3) our response to cybersecurity incidents;

companyName: Azenta, Inc.

ticker: AZTA


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; cybersecurity awareness training for our employees, incident response personnel, and senior management; assessment of material cybersecurity risks posed by third -party service providers, including risks to employee, customer and financial information; a cybersecurity incident response protocol that includes procedures for responding to cybersecurity incidents; and business continuity plans.


text: Our processes also address cybersecurity threat risks associated with our use of third -party service providers, including our suppliers and manufacturers or who have access to confidential, proprietary, personal, or employee data, or to our systems. In addition, cybersecurity considerations affect the selection and oversight of our third -party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits or audits for System and Organization Controls (SOC) compliance.


text: We have been, and expect to continue to be, subject to cybersecurity risks and incidents related to our business. We have not experienced any material cybersecurity incidents during the last fiscal year. For more information about the cybersecurity risks we face, see Part I, Item 1A, "Risk Factors " of this Annual Report on Form 10 -K.


text: Our Board of Directors considers cybersecurity risk as part of its enterprise risk management oversight function. The Board of Directors delegates oversight of the cybersecurity risk management program to the Audit Committee. This oversight includes periodic reports from management concerning cybersecurity related risks. The management of the program is the responsibility of our Risk Management Committee, comprised of our Chief Financial Officer, Chief Digital & Information Officer, Chief Accounting Officer and General Counsel. Our Chief Digital & Information Officer, who has over 30 years of extensive work experience in the field of technology and cybersecurity, leads our team of cybersecurity professionals and provides the Risk Management Committee with periodic reports on our cybersecurity risks and any material cybersecurity incidents. Our team of cybersecurity professionals monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through the cybersecurity risk management and processes described above, including the operation of our incident response plan. The Risk Management Committee provides updates to the Audit Committee on our cybersecurity risk management program as appropriate, including updates on ( 1) any critical cybersecurity risks; ( 2) ongoing cybersecurity initiatives and strategies; ( 3) applicable regulatory requirements; and ( 4) industry standards. The Risk Management Committee also notifies the Board of Directors of any significant and/or material cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.


text: Cybersecurity Governance Our Vice President of Information Technology (our VP of IT) has primary responsibility for monitoring, assessing and managing our material risks from cybersecurity threats. He oversees a dedicated information technology team that is responsible for managing enterprise-wide information security strategy, policy, standards, architecture and processes, and is regularly informed of, and monitors, the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. Our VP of IT has over 26 years of information technology experience, has earned a graduate degree in Cybersecurity and Information Assurance, and maintains relevant industry designations including Certified Information Systems Security Professional and Certified Information Security Manager certifications.

companyName: Natural Grocers by Vitamin Cottage, Inc.

ticker: NGVC


text: Our Board considers cybersecurity risk as a part of its overall risk oversight function. Our Board receives reports from our VP of IT at least bi-annually, and on an as-needed basis, on cybersecurity risks and actions taken to mitigate those risks. These reports include updates on our cybersecurity risks, the emerging threat environment, and the status of projects designed to enhance our information security systems and programs.


text: Our cybersecurity policies and procedures are designed to ensure that appropriate cybersecurity measures and controls are developed, implemented, and maintained, with assistance from a third -party service provider. These policies and procedures and the resulting safeguards are designed and evaluated in light of our risk assessments. We have implemented access controls, firewalls, and intrusion detection and prevention systems, vulnerability and patch management processes, and we also use a variety of other automated tools and manual processes to safeguard our information systems. We maintain a business continuity and disaster recovery plan designed to enhance our incident response preparedness. We also require employees to undergo security awareness training when hired and based on periodic phishing tests.

companyName: VERU INC.

ticker: VERU


text: As of the date of this Annual Report on Form 10 -K, we have not identified risks from known cybersecurity threats, including or as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information regarding risks to us from cybersecurity threats, see "Risk Factors" in Item 1A. of this report.


text: We are not aware of any existing cybersecurity threats that would materially affect, or that are reasonably likely to materially affect, our business strategy, results of operations, liquidity or financial conditions. Furthermore, we are not aware of having experienced any significant cybersecurity incidents during fiscal year 2025. Management periodically updates the Board of Directors regarding efforts to minimize cybersecurity risks.

companyName: OPTICAL CABLE CORP

ticker: OCC


text: In an effort to deter and detect cyber threats, we periodically provide training programs to our employees on issues related to privacy and data protection, cybersecurity risks, and the importance of reporting all incidents immediately. Topics include identifying phishing, password protection, securing confidential data, and mobile security. In addition, we use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We also perform annual vulnerability assessments, conducted by independent, third -party cybersecurity firms. Additionally, as part of our overall risk mitigation strategy, the Company obtains certain insurance policies. However, such insurance may not be sufficient in type or amount to cover us fully against claims related to security breaches, cyber-attacks and other related breaches.

companyName: Bridgeline Digital, Inc.

ticker: BLIN


text: Our management periodically evaluates information on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we have not had any cybersecurity incidents in 2025, and through the date of filing of this Form 10-K.


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our IT department and our management actively oversee our risk management program, including the management of cybersecurity risks. We have contracted cybersecurity and risk assessment experts to help test our systems and guide the ongoing development of best practices policies. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that our company's sustained investment in these efforts and technologies have put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition. Risk management and strategy.

companyName: cbdMD, Inc.

ticker: YCBD


text: Coastal recognizes the critical importance of identifying, assessing and managing material risks from information security threats. One key way that Coastal mitigates information security threats is through the Company's information security program (the "Information Security Program"). Cybersecurity is an integral subset of information security and the Information Security Program is designed to protect the Company from cybersecurity attacks, breaches, incidents and resulting consequences.

companyName: COASTAL FINANCIAL CORP

ticker: CCB


text: As part of the Information Security Program, the Company has implemented preventative controls to minimize data loss, exposure and misuse. These controls are designed to be implemented prior to a threat event to avoid the likelihood and potential impact of inadvertent or intentional misuse, improper disclosure, damage or loss. In addition, the Information Security Program includes internal and external penetration testing, regular vulnerability assessments, detailed vulnerability management, data loss prevention controls, file access and integrity monitoring and reporting and threat intelligence. The Information Security Program is coordinated and primarily executed by our information security, technology, IT and operations personnel. The IT department is responsible for the oversight of all managed systems and implements and maintains appropriate controls to protect the confidentiality, integrity and availability of computerized data and information resources. Coastal applies a layered defense strategy for protecting information systems and customer information, including the implementation of zero-trust principles, which require authenticated, authorized, and validated users and devices to access applications and data. Security logs are correlated and monitored by an internal security team as well as an augmented third-party Security Operation Center. Network vulnerability scans are conducted daily.


text: Coastal engages third party assessors, consultants and auditors in connection with the Information Security Program, including to conduct external penetration testing, independent audits and risk assessments. Coastal also utilizes third party service providers in the ordinary course of business to provide services to customers and partners. These third-party service providers may store or process confidential information and personally identifiable information related to our customers or on behalf of our partners in order to perform those services for which they were engaged. Coastal has implemented a vendor management program to help ensure third party relationships are effectively managed. Under this program, we have established risk-focused controls and processes that are designed to monitor our vendors' compliance with relevant laws, regulations, and industry standards, such as data privacy regulations and anti-corruption laws, as well as relevant contractual obligations.


text: Executive Management is responsible for managing the Information Security Program's operations for identifying and assessing external and internal risks to the security, confidentiality, and integrity of nonpublic information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information. Coastal's Information Security Officer ("ISO") is designated by the Board and is responsible for implementing and monitoring the Information Security Program. The ISO is a Senior Vice President and has served in such role since 2010. The ISO has over 38-years of financial institution experience, which includes, compliance, BSA, operations, physical security along with information security. The ISO provides an annual report to the Board on the overall status of the Information Security Program and on information technology incidents as necessary. The SVP of Technology also has responsibility for cybersecurity matters and reports to the Management Risk Committee, which consists of members of senior management. The Technology Subcommittee of the Management Risk Committee focuses on 3 pillars: Technology Strategy, InfoSec/Cyber, and Data.


text: The SVP of Technology has served in that role since 2005 and the SVP, Head of Technology Operations and Implementation, who also supports the Information Security Program, has 23 years of financial technology experience, including previously as Director, Application Development and Vice President, Integration and Analytics. The Information Security Program is further supported by other members of Coastal's management team, including the President, Chief Risk Officer, and the Chief Audit Executive.


text: The Board exercises oversight over the Information Security Program and reviews and approves the Information Security Program at least annually. Cybersecurity risk management is also incorporated into Coastal's overall enterprise risk management framework, which is updated on an annual basis and subject to oversight by the Management Risk Committee and the Board.


text: Although Coastal has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected Coastal's business strategy, results of operations, or financial condition, there can be no guarantee that Coastal will not experience such an incident in the future. For a discussion regarding risks from cybersecurity threats, see "Item 1A. Risk Factors," including the risk factors titled "—We are subject to laws regarding the privacy, information security and protection of personal information and any violation of these laws or another incident involving personal, confidential or proprietary information of individuals could damage our reputation and otherwise adversely affect our business, financial condition and earnings" and "—We are dependent on our information technology and telecommunications systems and third-party service providers; systems failures, interruptions, security breaches and cybersecurity threats could have an adverse effect on our business, financial condition and results of operations." As noted above, we are a regulated financial institution and are subject to financial privacy laws and to oversight by federal banking agencies. For additional information on these laws and oversight, see "Item 1. Business—Regulation and Supervision."


text: As part of the Information Security Program, the Company has implemented preventative controls to minimize data loss, exposure and misuse. These controls are designed to be implemented before a threat event to avoid the likelihood and potential impact of inadvertent or intentional misuse, improper disclosure, damage or loss. In addition, the Information Security Program includes internal and external penetration testing, regular vulnerability assessments, detailed vulnerability management, data loss prevention controls, file access, controls, data integrity monitoring and reporting, and threat intelligence. The Information Security Program is coordinated and primarily executed by our information security, technology, and operations personnel. The IT department is responsible for the oversight of all managed systems and implements and maintains appropriate controls to protect the confidentiality, integrity and availability of computerized data and information resources. Coastal applies a layered defense strategy for protecting information systems and customer information, including the implementation of zero-trust principles, which require authenticated, authorized, and validated users and devices to access applications and data. Security logs are correlated and monitored by an internal security team as well as an augmented third-party Security Operation Center. Network vulnerability scans are conducted daily.


text: Coastal engages third party auditors and consultants in connection with the Information Security Program, including conducting external penetration testing, independent audits and risk assessments. Coastal also utilizes third party service providers in the ordinary course of business to provide services to customers and partners. These third-party service providers may store or process confidential information and personally identifiable information related to our customers or on behalf of our partners to perform those services for which they were engaged. Coastal has implemented a vendor management program to help ensure third-party relationships are effectively managed. Under this program, we have established risk-focused controls and processes that are designed to monitor our vendors' compliance with relevant laws, regulations, and industry standards, such as data privacy regulations and anti-corruption laws, as well as relevant contractual obligations.


text: Executive Management is responsible for managing the Information Security Program's operations for identifying and assessing external and internal risks to the security, confidentiality, and integrity of nonpublic information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information. Coastal's Information Security Officer ("ISO") is designated by the Board and is responsible for implementing and monitoring the Information Security Program. The ISO is a Senior Vice President and has served in such role since 2010. The ISO has over 38-years of combined financial institution experience, which includes compliance, BSA, operations, physical security and information security. The ISO provides an annual report to the Board on the overall status of the Information Security Program and information technology incidents as necessary. The SVP of Technology also has responsibility for cybersecurity matters and reports to the Management Risk Committee, which consists of members of senior management. The Technology Subcommittee of the Management Risk Committee focuses on three pillars: Technology Strategy, InfoSec/Cyber, and Data.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and patient and customer data ("Information Systems and Data").

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: Our information security function is led by our Vice President, Cybersecurity (our "Information Security Team"), and is supported by our Chief Technology Officer, our Chief Legal, Privacy and Compliance Officer and legal department, our Vice President, Head of Information Technology, and our cybersecurity incident management team. Our Information Security Team is tasked with identifying, assessing and managing our cybersecurity threats and risks. It identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including: the use of manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting risk assessments, coordinating with law enforcement concerning threats, conducting internal and external audits and threat assessments for internal and external threats, obtaining third party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and tabletop incident response exercises.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including an incident response policy, vulnerability management policy, disaster recovery and business continuity plan, vendor risk management program, programs for incident detection and response, encrypting certain data, network security controls, data segregation, asset management tracking and disposal, penetration testing, employee training, access controls, physical security controls, systems monitoring, a dedicated cybersecurity officer; and cybersecurity insurance.