text: Risk Management and Strategy We recognize the importance of cybersecurity risk management and have a defined strategy to support our business operations, platforms and information systems. We have implemented a comprehensive cybersecurity program to protect information systems and data. We have based our cybersecurity program on defined industry accepted frameworks with the goal of building enterprise resilience against an evolving cybersecurity threat landscape and to respond to cybersecurity threats as they materialize. Our program includes identification, assessment, monitoring, and management components, as well as informational and escalation components designed to inform management and the Board of prospective risks and developments.

companyName: Super League Enterprise, Inc.

ticker: SLE


text: Our cybersecurity program encompasses functions dedicated to both proactive and reactive management of cybersecurity threats. We implement our cybersecurity program internally through maintaining cybersecurity policies; deploying updated security technologies; and using third-party services and consultants to support and improve our cybersecurity program. Our proactive management of cybersecurity risks entails many actions, including actively monitoring our information technology systems; engaging service providers to monitor and, as appropriate, respond to cybersecurity threats; developing and updating incident response plans to address potential cybersecurity threats; and training our personnel on cybersecurity. We engage third-party auditors and consultants and leverage our internal information security, audit, and compliance functions to assess various facets of our cybersecurity program. We also maintain enterprise-wide processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.

secItem: Item 1C


text: We assess cybersecurity contingencies within our overall business continuity risk management planning process. Our information technology and information security teams utilize various technology tools to prevent, monitor, detect, and respond to cybersecurity threats. Our incident response policy outlines processes, roles, responsibilities, notifications, and other communications applicable to the assessment, mitigation, and remediation of realized cybersecurity events. The nature and scope of assessed risk of a realized cybersecurity event dictates the pace and extent of relevant processes, and communications, including an evaluation of any necessary or required disclosure. Depending on its nature and scope, a cybersecurity threat may be managed within our IT Department, responsible for day-to-day management of cybersecurity risks, and escalated to our executive management team, the Board, and the Audit Committee, as appropriate.


text: We have not historically been materially impacted by risks from cybersecurity threats and, as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, the breadth and scope of cybersecurity threats have grown over time and our systems and networks may be the target of increasingly sophisticated cyberattacks. For more information on our cybersecurity risks and their potential impact to our business, see Item 1A, " Risk Factors-Risks related to Our Business and Industry - We may experience security breaches and cyber threats " and Item 1A, " Risk Factors-Risks related to Our Business and Industry - Our business could be adversely affected if our data privacy and security practices are not adequate, or perceived as being inadequate, to prevent data breaches, or by the application of data privacy and security laws generally."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the " Committee ") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: Our IT Department updates management on cybersecurity matters, including risk assessments, security controls, incident response procedures, employee training and Third-Party Risk Management.


text: The Committee oversees the Company's cybersecurity risk management and strategy, while management is responsible for implementing the Company's cybersecurity program. This approach ensures that cybersecurity risks are appropriately prioritized and managed throughout the organization.


text: Our Corporate Counsel has 20 years of experience in information technology, including cybersecurity, audit, compliance, and cybersecurity. In addition, we have an Enterprise IT Operations Engineer ("Ops Engineer") with requisite knowledge and experience in information technology and cybersecurity, and maintains IT and Ops professional certifications.


text: The Ops Engineer may call upon other business and legal stakeholders across our company to help manage cybersecurity threats and incidents. Our Audit Committee is responsible for oversight of our programs, policies, procedures, and risk management activities related to information security and data protection. The Audit Committee meets periodically with our Corporate Counsel and executive management to discuss threats, risks, and ongoing efforts to enhance cyber resiliency, as well as changes to the broader cybersecurity landscape. Our Board periodically participates in presentations on cybersecurity and information technology from internal leadership. In addition to periodic presentations, management promptly updates our Board and Audit Committee regarding significant threats and incidents as they arise.


text: Risk Management and Strategy As part of our overall Enterprise Risk Management strategy, we maintain a robust Information Technology and Security Management Program ("ITSM"), which includes processes to assess, identify, monitor and manage cybersecurity risks. The program includes provisions for annual cybersecurity risk assessments, ongoing monitoring and testing, as well as annual training for employees, executives, and Board Members. We use the Federal Financial Institutions Examination Council's ("FFIEC") cybersecurity assessment tool to identify risks and ascertain cybersecurity preparedness and the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework to benchmark our internal policies and procedures against best practices. We engage consultants and auditors to assist in the completion of our annual risk assessment and review of controls related to the ITSM.

companyName: Provident Bancorp, Inc. /MD/


text: The Company also maintains a robust Vendor Risk Management program to manage risks related to third -party relationships in a manner that is consistent with the Company's strategic goals, organizational objectives, and risk appetite. This includes comprehensive risk and control assessments with respect to the appropriate safeguarding of sensitive information.


text: We maintain cybersecurity insurance coverage to mitigate potential financial impacts from cyber incidents, such as data breaches and system disruptions. However, such insurance may not cover all types of damages, and we cannot guarantee that our coverage will be sufficient to fully protect us from the financial consequences of a cyberattack.


text: To date, there have been no cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, the Bank, our business strategy, results of operations, or financial condition.


text: The Board of Directors is responsible for overseeing the development, approval, implementation and maintenance of the ITSM, including overseeing the program's execution in accordance with the overall strategic goals of the Bank. The Board conducts oversight, in part, through the use of committees. The Risk Management Committee ("RMC") of the Board of Directors is charged with monitoring and reviewing risk assessments, assurance, testing, and training as well as overseeing the correction of identified deficiencies as they relate to the ITSM. The Company's Information Security Team is comprised of the information security officer ("ISO") and a cyber-risk analyst. With input from the Information Technology and Risk departments, the Information Security Team is responsible for incident management, disaster recovery, business continuity and cybersecurity programs and policies. The Bank's Incident Response Manual and Cyber Incident Policy outline how potential cybersecurity threats or incidents are communicated to the RMC. The RMC is responsible for determining if cybersecurity incidents or threats should be escalated to the Board of Directors. The Information Security Team and the RMC work together to mitigate cybersecurity threats or incidents.


text: The ISO is responsible for cybersecurity under the ITSM and holds a Certified Information Security Manager certification and was a former Chief Information Security Officer ("CISO") for the United States segment of a multi-national bank. The ISO reports directly to the Executive Vice President, Chief Risk Officer of the Bank who is a member of the executive team. The Chief Operating Officer, who is a member of the executive team, is a former CISO and holds both a Certified Fraud Examiner and Certified Information Security Manager certification. The Chair of the RMC of the Board also has multiple certifications in information and cybersecurity, including a Certified Information Systems Security Professional certification.


text: Cybersecurity Risk Management We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

companyName: Genprex, Inc.

ticker: GNPX


text: In the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program, which is comprised of a wide array of policies, standards, architecture, and processes. The cyber risk management program falls under the responsibility of our Chief Financial Officer, who has more than 15 years of experience, including cross-functional expertise in business operations and technology strategy. Under the guidance of our Chief Financial Officer, we develop, maintain, and evidence the policies, standards, and processes in a manner consistent with applicable legal requirements. We also utilize a variety of cybersecurity software from reputable vendors in cybersecurity.


text: We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems and ensure the effectiveness of our security controls. Our cybersecurity risk management program is Systems and Organization Controls (SOC)-certified and incorporates a number of components, including information security program assessments, continuous monitoring of critical risks from cybersecurity threats using automated tools, internal audits, and employee training. We deploy a wide range of security tools across the environment, require multifactor authentication, hold client data on a separate virtual private cloud (VPC), and implement access control policies that further limit access to data within the systems.


text: We periodically conduct internal audits and are consistently evaluating our cyber readiness. As a result, we have not identified any material cybersecurity risks and are continuously hardening our environment, systems and infrastructure to reduce our vulnerability to attack. Additionally, our program includes regular cybersecurity training for all employees.


text: For further information regarding cybersecurity risks, please refer to "Risk Factors – Risks Related to Development and Commercialization of Our Current and Future Product Candidates" and other risks described in the "Risk Factors" section of this Annual Report on Form 10 -K.


text: Our board of directors is responsible for the oversight of cybersecurity risk management. The board of directors delegates oversight of the cybersecurity risk management program to the audit committee of the board of directors (the "Audit Committee"). Our Chief Financial Officer reports to the Audit Committee. The Audit Committee updates the board of directors on our cybersecurity risk management program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards on an annual and as-needed basis.


text: Securing the Company's IT systems is integral and foundational to its everyday operations. The Company's Security Steering Committee is comprised of cross-functional executive management team members that collectively possess a high level of cybersecurity and technology operations expertise. The mission of our Security Steering Committee is to focus on defining and deploying its information security strategy, sustaining a robust employee cybersecurity awareness and training program, executing security engineering, providing continuous monitoring of the Company's information security strategy, responding and coordinating the response and investigation of cyber threats, building and testing its disaster recovery plans in support of its businesses' continuity plan requirements, and developing its cyber and information security policies.

companyName: ULTRALIFE CORP

ticker: ULBI


text: The Company's cybersecurity strategy is based on recognized best practices, standards, and frameworks for cybersecurity and information technology, including the Center for Information Security ("CIS") Controls and National Institute of Standards and Technology ("NIST"). The strategy focuses on implementing technologies, controls, and processes to constantly monitor, identify, assess, and manage cybersecurity risks.


text: The Company's cybersecurity program includes exercises and trainings designed to sustain a high level of cybersecurity awareness and readiness across our employee base. The Company also has a cybersecurity incident response plan that is designed to provide a framework across all functions for a coordinated identification and response to security incidents.


text: The Company engages leading cybersecurity firms to assist with its security engineering and operations; provide independent evaluations of its security posture through regular assessments; and to audit and provide advice on how to make its security processes and controls more effective.


text: The Company utilizes third-party service providers to perform a variety of functions to assist in operating its business. The cybersecurity risks associated with the use of certain providers are covered under a vendor management process. Depending on the nature of the services provided and the sensitivity and/or quantity of information processed, the vendor management process may include reviewing cybersecurity practices of these providers, contractually imposing obligations on the provider, inspecting independently audited reports, and/or conducting its own security assessments of their services.


text: The Company's Board of Directors has ultimate oversight of the Company's cybersecurity risk. Management updates the Board of Directors on the Company's cybersecurity and information security posture at least quarterly at the Company's board meetings, or more frequently as determined to be necessary or advisable. These updates include a review of cybersecurity incidents determined to have a moderate to high business impact, even if immaterial to the Company as a whole. The Audit Committee has responsibility for assisting the Board in the review and oversight of risks affecting the Company, and oversees the enterprise risk management process, which includes, with the assistance of senior management, assessing the Company's exposure to cybersecurity risk and the effectiveness of the Company's processes and controls to address and respond to those risks. Management is responsible for hiring appropriate personnel, integrating cybersecurity considerations into the Company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Notwithstanding the focus and emphasis on cybersecurity, the Company has experienced and will continue to experience cybersecurity incidents, and there can be no guarantee that future incidents will not have a material adverse effect on its business. See Risk Factor " Breaches in security, whether cyber or physical, and related disruptions and/or our inability to prevent or respond to such breaches, has previously, and in the future could diminish our ability to generate revenues or contain costs, compromise our assets, and negatively impact our business in other ways " for more information on the Company's cybersecurity risks.


text: We depend on information technology and systems for various operations (including refinery processes and refined product loading) and for capturing accounting, technical, and regulatory data for reporting, analysis, and archiving. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. As of the filing date of this report, our risk monitoring process related to cybersecurity includes conducting periodic vulnerability assessments using a combination of internal and third-party capabilities to perform technical assessments, vulnerability scanning, and incident and event monitoring. We are working to: (i) identify and assess threats and (ii) establish a thorough, risk-based cybersecurity program, including the potential adoption of a formal cybersecurity policy if deemed necessary by the Board, aimed at safeguarding our data, along with the data of our customers and partners. We anticipate that such a program will follow well-organized cybersecurity frameworks and be managed by a central control figure with Board oversight.

companyName: BLUE DOLPHIN ENERGY CO

ticker: BDCO


text: We did not experience a significant cybersecurity breach or associated expenses, penalties, or settlements for the twelve months ended December 31, 2024 and 2023.


text: Cybersecurity Risk Management, Governance And Risk Assessment The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. The Company intends to establish a cybersecurity program (the "Program") that will be designed to assess, identify, manage, and mitigate material cybersecurity threats, as well as to respond to and recover from cybersecurity incidents.

companyName: Elite Health Systems Inc.

ticker: EHSI


text: Cybersecurity Risk Management The Program will be based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), NIST Special Publication 800-53, and the Payment Card Industry standards, as applicable, and designed to comply with applicable laws and regulations, including HIPAA and the New York Department of Financial Services Cybersecurity Regulation, as applicable. This does not imply that we will meet any particular technical standards, specifications, or requirements. The Program will be aligned with the Company's overall enterprise risk management system and processes and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Control procedures are assessed regularly to confirm their effectiveness.


text: The Company will designate a Chief Information Security Officer (the "CISO"). The Program will be implemented and managed by the Company's executive management under the leadership of the CISO. The Company will contract with third-party service providers to support aspects of the Program implementation, operations, and review of information technology operations and cybersecurity technologies.


text: The Company's cybersecurity policies and procedures will be reviewed by the CISO and updated at least annually and will include an incident response plan ("IRP") for detecting, responding to and limiting the effects of a cyber security event. In addition, under the IRP, following the resolution of a cybersecurity incident, the Company will generally consider the effectiveness of the Program and the IRP, make adjustments as appropriate, and report to senior management and the Audit Committee as appropriate on these matters. Cybersecurity policies and procedures will also be subject to periodic review and audits by internal and external parties, such as the internal audit function, external auditors, regulators, or independent assessors. The Company will require employees to undergo cybersecurity-related training, including phishing prevention training, and employees are tested regularly through phishing exercises.


text: The CISO will be responsible for developing, maintaining, and enforcing the Program's policies and procedures, as well as reporting on the Program's performance and material cybersecurity risks to the Audit Committee. The CISO will have the relevant expertise and authority to carry out the Program's objectives and to coordinate with other key stakeholders within and outside the Company. The Program will be overseen by the Company's Board of Directors.


text: Cybersecurity Risk Assessment The CISO will be responsible for assessing and managing the Company's material risks from cybersecurity threats. The Company will conduct regular risk assessments to identify, evaluate, and prioritize material cybersecurity risks to the Company, including its health plans and state contracts, shared services and IT operations, or business strategy. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Risk Management and Strategy The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have developed the following processes as part of our strategy for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: FIREFLY NEUROSCIENCE, INC.

ticker: AIFF


text: Managing Material Risks and Integrated Overall Risk Management We have integrated cybersecurity risk management into our risk management processes. This integration is intended to ensure that cybersecurity considerations are part of our decision-making processes. We continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engaging Third Parties on Risk Management We engage a range of external experts, including consultants, auditors, and cybersecurity assessors, who assist us in evaluating and testing our cybersecurity systems and processes. These partnerships are intended to give us access to specialized knowledge and insights that can inform our cybersecurity strategies and processes, including as to industry-standard control frameworks and applicable regulations, laws, and standards.


text: Overseeing Third-Party Risk As part of our evolving cybersecurity roadmap, we plan to implement and conduct security assessments of all third -party service providers before engagement and maintain ongoing monitoring to ensure compliance with relevant cybersecurity standards.


text: Risks from Cybersecurity Threats We have not experienced any material cybersecurity incidents. As a result, we do not believe that risks from cybersecurity threats, have materially affected us, our results of operations and financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to us, including potentially to our results of operations and financial condition. See also "Risk Factors — Failure to protect our information technology infrastructure against cyber-based attacks, network security breaches, service interruptions, or data corruption could significantly disrupt our operations and adversely affect our business strategy and operating results." As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we may expend greater resources to continue to modify and enhance protective measures against such security risks Governance Board of Directors Oversight Our board of directors oversees the management of risks associated with cybersecurity threats.


text: Management ' s Role Managing Risk The Company's management is primarily responsible for assessing, monitoring and managing our cybersecurity risks. Management must ensure that all industry standard cybersecurity measures are functioning as required to prevent or detect cybersecurity threats and related risks. Management oversees and tests our compliance with standards, remediates known risks, and leads our employee training program.


text: Monitoring Cybersecurity Incidents The Company's management is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Management implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of industry-standard security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, management will implement an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors Significant cybersecurity matters, and strategic risk management decisions, will be escalated to the board of directors.


text: The Company recognizes the importance of securing its information, devices, and data and the IT systems it relies on to conduct its business. The Company has established its Network, Information, and Data Security Policy Guidelines (the "NIDSP Guidelines") designed to protect the integrity and confidentiality of data and information belonging to or being exchanged by the Company and its employees, partners, customers, service providers, and suppliers and to safeguard that information and the Company's IT infrastructure from unauthorized access, use, disclosure, alteration, and destruction.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: Risk Management and Strategy The protections, procedures, and controls set forth in the NIDSP Guidelines demonstrate the Company's attention to and prioritization of cybersecurity as a component of its overall strategy and system for managing risks. The NIDSP Guidelines include five policies described below, that together define the Company's strategy and practices for managing cybersecurity threats and mitigating cybersecurity risks.


text: Physical Security Policy (the "PSP"). The PSP establishes guidelines related to selecting IT operation sites, designating security zones, using, inspecting, and storing IT Assets, designing restricted-access and security controls, and monitoring compliance with safety and security standards. The goal of the PSP is to minimize risks of damage, destruction, unauthorized access, inadvertent disclosure, misuse, loss, or theft of the Company's IT Assets. In accordance with the PSP, the Company: (i) evaluates IT operation sites based on their susceptibility to natural disasters, crime and theft, and unauthorized access; (ii) requires the use of keycards or biometrics in order to enforce security zones and give users the least amount of access required to do their jobs; (iii) requires systems and devices that store confidential data to be maintained and protected in accordance with the Company's Confidential Data Policy; and (iv) requires visitors at the Company's office to complete a sign-in log, wear a visitor badge, and be escorted by a designated employee at all times.


text: Network Security Policy (the "NSP"). The NSP aims to protect the integrity of the Company's data by securing the systems and devices that make up the Company's network infrastructure. Pursuant to the NSP, the Company: (i) enforces strict password-construction criteria for network devices; (ii) requires employees to verify their identities using multi-factor authentication to access internal resources; (iii) maintains and reviews logs from application services, network devices, and critical devices and requires the retention of logs in accordance with the Company's Retention Policy; (iv) implements and configures firewall technology to filter both inbound and outbound network connections; (v) authorizes the IT Manager to determine the extent and scope of external security testing to be performed; (vi) establishes a software-use policy; and (vii) requires antivirus and anti-malware software to be used and timely patched and updated on any Company-provided devices.


text: Backup Policy. The Company's Backup Policy applies to all data stored on Company systems. The Backup Policy specifies the types of data and information considered to be critical to the Company's operations and thus required to be backed up, establishes a backup schedule that is necessary for successful data recovery, and implements procedures for the off-site rotation, storage, and retention of backups. The Backup Policy also establishes the Company's data-restoration procedures and mandates the periodic testing of those procedures.


text: Remote Access Policy (the "RAP"). The RAP defines the Company's standards for accessing IT resources from outside the Company's network, such as when an employee is working remotely. Pursuant to the RAP, remote access is only permitted if accomplished through secure, Company-provided means. The Company's uses remote-access software designed to guard against unauthorized access using traffic encryption during transmission and firewall protections.


text: Confidential Data Policy (the "CDP"). The CDP governs the handling, storage, transmission, destruction, and protection of confidential data. Pursuant to the CDP, confidential data must be securely stored, removed from common areas, properly marked as confidential data, protected with strong encryption if being transmitted, and destroyed by means that make recovery impossible. Employees who are given access to confidential data are required to immediately notify their supervisor if they suspect any misuse or unauthorized disclosure of confidential information.


text: The Company's NIDSP Guidelines and policies apply not only to the Company's employees and consultants but also to any third parties that access or utilize the Company's information and systems. Such third parties may include the Company's service providers, customers, suppliers, contractors, consultants, and any other individuals the Company conducts business with. The IT infrastructure that the Company has developed in accordance with the NIDSP Guidelines is designed to monitor both internal and external cybersecurity risks. The NIDSP Guidelines equip the Company with the tools and systems necessary to recognize, address, and protect against risks associated with its third -party interactions.


text: Cybersecurity Governance The Company's IT Manager and executive team is responsible for the day-to-day management of cybersecurity risks, while the Company's Board of Directors has responsibility for oversight of risk management.


text: As part of the Company's framework for cybersecurity risk oversight and governance, the Company's network, information, and data-security policies set forth in the NIDSP Guidelines are enforced by the Company's IT Manager and/or its executive team. The IT Manager is an employee designated by the Company to manage the Company's security policies and program. The IT Manager is tasked with ensuring that the Company maintains compliance with the Company's security policies and any applicable security regulations. The IT Manager is responsible for: (i) implementing the Company's security policies; (ii) disseminating the Company's security policies to all employees; (iii) establishing a training program for all employees and users covered by the Company's IT security policy to notify them of the Company's security policies, train and re-train them to comply with the Company's IT security program, and educate them on the importance of data security; (iv) performing any ongoing testing or analysis of the Company's security infrastructure, policies, and procedures; and (v) updating the NSP and any other policies and guidelines as needed to comply with applicable regulations and to stay up to date with the changing IT security landscape.


text: The IT Manager works closely with the Company's management and executive team to determine the Company's IT-related needs, to evaluate the sufficiency of the Company's data-governance policies and practices, to keep the Company's management informed of notable cybersecurity-related updates, to review its security-related policies, and to identify ways to strengthen the systems and procedures implemented by the Company to detect, assess, and manage data risks.


text: In the event of the detection of an actual or suspected cybersecurity incident, the Company's IT Team, lead by the IT Manager, assesses the incident as "minimal", "low", "moderate" or "high". Incidents assessed at a minimal or low risk are reported to Company's management and the Executive Chairman of the Board and the Executive Chairman of the Board may share this information with the Board. Incidents assessed at a moderate or high risk are reported to Company's management, the Executive Chairman of the Board, and the Company's Board of Directors.


text: Notwithstanding the Company's cybersecurity-related policies, procedures, and governance framework, the ever-present threat of a cyber-attack, data breach, or other security incident is pervasive. The increasingly sophisticated nature of the tactics used to circumvent IT security safeguards makes cybersecurity threats increasingly difficult to detect and respond to. While the Company does not believe its business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity threats or incidents, there is no assurance that the Company will not be materially affected by such threats or incidents in the future. Accordingly, the Company will continue to monitor cybersecurity risks and strive to invest in and strengthen its cybersecurity infrastructure.


text: Risk Management and Strategy We have implemented an enterprise-wide information security program designed to identify, protect, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our primary objectives are to safeguard information assets, prevent their misuse or loss, and minimize business disruptions, through a comprehensive cybersecurity program intended to detect, analyze, contain and address cybersecurity risk exposures, threats and incidents. Our program utilizes various security tools to safeguard our information systems, aiding in prevention, identification, escalation, investigation, resolution, and recovery from vulnerabilities and security incidents. Examples of such security tools include internal reporting systems, monitoring and detection tools, third-party penetration testing and security assessments and a bug bounty program engaging security researchers. In addition, we have adopted a comprehensive incident response plan and process for detecting, mitigating, and investigating cybersecurity incidents, which employees, under the leadership of the Company's Chief Information Security Officer ("CISO"), regularly test through table-top exercises, testing of our security protocols through additional techniques such as penetration testing, debriefing after security incidents to improve our security and responses, and regular briefing to our directors and officers on our cybersecurity risks and preparedness.

companyName: Skillsoft Corp.

ticker: SKIL


text: Our Board has oversight of our strategic and business risk management, including cybersecurity risk management, with support from our Audit Committee as described under "Governance" below. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Our global information security program is led by our CISO, who brings over 20 years of industry experience.


text: Additionally, we maintain a third -party security program to assess, prioritize, and mitigate risks associated with our vendors and partners. We also rely on third parties to implement appropriate security measures.


text: Regular risk assessments evaluate cybersecurity and technology threats, employing a widely adopted risk management model to prioritize risks and develop corresponding security controls. Our information security program undergoes regular reviews, audits, tests, and exercises to ensure effectiveness and enhance security measures.


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. Despite our continuing efforts, however, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive, or business harm or damage to our Company, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "We are regularly subject to cybersecurity and other similar attacks. If our security measures are breached or unauthorized access to customer data is otherwise obtained, our platforms may be perceived as insecure, we may lose existing customers or fail to attract new customers, our reputation may be harmed, and we may incur significant liabilities."


text: As part of its oversight responsibilities, which include the identification of the principal risks of the business and ensuring the implementation of appropriate systems to manage such risks, the Board devotes significant time and attention to information security and risk management, including cybersecurity, and regulatory compliance, supported by the Audit Committee.


text: The Audit Committee is responsible for evaluating the Company's major financial risk exposures and the steps management has taken to monitor and control such exposures. The Audit Committee's charter also requires it to discuss guidelines, policies and steps to govern the process by which risk assessment and management is undertaken (including risks related to information security, cybersecurity and data protection) and the establishment and management of appropriate systems to manage such risks. The Audit Committee reviews cybersecurity risks through quarterly reports from the CISO, and monitors the status of existing information security controls and practices to mitigate the potential risk from evolving cybersecurity threats. Regular reports on cybersecurity threats, assessments, and findings are also provided by the CISO to senior management and relevant teams.


text: Governance Related to Cybersecurity Risks Our board of directors, as a whole and through its committees, holds overall oversight responsibility for our risk management processes, including in relation to risks from cybersecurity threats. Our board of directors exercises its oversight function through the audit committee, which oversees the management of risk exposure across various areas, including cybersecurity risks, in accordance with its charter. The audit committee receives quarterly reports from our Management on the status of our cybersecurity program. The Chair of the audit committee provides a quarterly report to the board of directors, which includes any key updates on cybersecurity matters, as applicable.

companyName: MILESTONE SCIENTIFIC INC.

ticker: MLSS


text: Our management team is responsible for the day-to-day administration and management of our cybersecurity program, under the direct supervision of our Chief Executive Officer currently we also work with external security service providers to support our security monitoring and threat detection capabilities and have implemented a process to report relevant findings to the Chair of audit committee where appropriate.


text: Cybersecurity Risk Management and Strategy We maintain a cybersecurity program, which includes processes for identification, assessment, and management of cybersecurity risks. We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify potential areas of enhancement, and develop strategies for the mitigation of cyber risks. We have implemented a process to periodically conduct security awareness training for employees.


text: Our team is informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third -party security software and technology services. In addition, we use third -party security solutions, monitoring, and alerting tools and resources, designed to monitor, identify, and address risks from cybersecurity threats. We also have implemented processes and technologies for network monitoring and data loss prevention procedures, and from time to time review such processes and technologies.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10 K for more information.


text: Cyber Security Governance Oversight of cybersecurity infrastructure is managed by members of our management team, including our President & Chief Executive Officer. Management works in tandem with a third-party service provider (the "Service Provider"). The Service Provider periodically reviews and updates our antivirus and antimalware software, manages our Business Continuity and Disaster Recovery system, reviews our vulnerability management and ensures our system is Payment Card Industry (PCI) compliant. Given our overall risk profile, the Board has had limited involvement with our cybersecurity risk management. The management team, with support from the Service Provider, would raise any significant cybersecurity risks with the Board.

companyName: Saker Aviation Services, Inc.

ticker: SKAS


text: Risk Management and Strategy We believe we have implemented processes that are designed to effectively identify and manage risks from cybersecurity threats. Through our Service Provider, we receive Endpoint Detection and Response services ("EDR"). The EDR helps to ensure faster identification of a cybersecurity breach. Once a cyber incident is identified, our Service Provider will notify management and work to secure our systems and fix the vulnerability. An investigation will be conducted, with the assistance of the Service Provider if needed, to determine the root cause of the cyber incident, the materiality of the cyber incident, and any disclosure or legal obligations that will stem from the cyber incident.


text: We have not been the victim of a cyber incident in the past but may be the subject of cyber incidents in the future.


text: Disclosure of Risk Management, Strategy, and Governance Regarding Cybersecurity Risks Our Board of Directors engages in regular discussions to address our Company's principal risks, including those related to cybersecurity, ensuring comprehensive management and oversight. In alignment with this commitment, our cybersecurity leadership, comprising the Chief Operating Officer, DevOps Resource Manager of Security, Senior Systems Architect, DevOps Engineer, and Senior Technical Project Manager, forms a core committee dedicated to the review and strategic planning of our cybersecurity initiatives. This team's collaborative efforts are instrumental in steering our Company's approach to identifying, evaluating, and mitigating cybersecurity risks.

companyName: PAID INC

ticker: PAYD


text: Cybersecurity Risk Management and Strategy The designated committee oversees our cybersecurity risk assessment and mitigation strategies through various means, including but not limited to: Conducting internal evaluations and leveraging technological tools to fortify our cybersecurity posture. Implementing rigorous cybersecurity training for all employees to heighten awareness and preparedness against cyber threats. Ensuring the robustness of our cyber defenses with comprehensive antivirus solutions and adherence to cybersecurity best practices.


text: Our reliance on third-party service providers, such as Google Cloud for server hosting and Stripe for payment processing, incorporates a level of inherited security measures. Nonetheless, our commitment extends to continuously assessing and enhancing our cybersecurity frameworks to align with evolving industry standards and best practices.


text: Our Board is advised of key cybersecurity matters through high-level briefings, ensuring strategic alignment and informed oversight of our cybersecurity endeavors. The Company's officers, along with the executive team, play a pivotal role in the dynamic landscape of cybersecurity risk management. This committee is not only responsible for the ongoing assessment and management of cybersecurity risks but also ensures that strategic cybersecurity initiatives are integrated within the broader operational framework of our Company.


text: Incident Response and Readiness Although our Company has not experienced cybersecurity incidents, we maintain a proactive stance through the implementation of an Incident Response Plan. This plan encompasses detailed procedures for addressing potential cybersecurity incidents, including scenario-based drills to test our preparedness. The escalation processes within the plan ensure swift communication to the executive leadership and, if necessary, to the Board of Directors, facilitating an agile and informed response to emerging cybersecurity threats.


text: Engagement with Third Parties Our engagement with third-party service providers incorporates a thorough consideration of cybersecurity risks. Through our diligent evaluation process, we ensure that our partners adhere to stringent cybersecurity standards, safeguarding our data and systems against potential threats. This collaborative approach towards cybersecurity underscores our commitment to maintaining a secure operational environment for our stakeholders.


text: Risk Management and Strategy Our risk management strategy comprises of ensuring access controls are in place to prevent unauthorized users from accessing our systems. Our systems are completely cloud-based and our providers have their own security protocols to assist us. We retain audit logs and login records for review, and we use multifactor authentication and username/password management for all of our systems.

companyName: Envirotech Vehicles, Inc.

ticker: EVTV


text: Our cybersecurity program is overseen by our Executive team comprising of the Executive Vice President and the Chief Financial Officer. An experienced information technology personnel identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. In the event of a cybersecurity threat, the IT personnel assesses the threat and determines the course of action to eliminate the threat. Depending on the circumstances, such threat is communicated to the executive team and if warranted to the Audit Committee for further action.


text: The Company maintains basic cybersecurity measures appropriate for our small size and limited technology infrastructure. Our primary business systems consist of QuickBooks and standard office productivity software. Our approach to cybersecurity risk identification includes:

companyName: IRONSTONE PROPERTIES, INC.


text: Regular review of user access to our financial systems Monitoring for unusual login attempts or activities Awareness of cybersecurity threats common to small businesses through industry publications and alerts Risk Management Process Our cybersecurity risk management process is designed to address identified risks through:


text: Implementation of basic safeguards, including strong password requirements and regular password changes Multi-factor authentication for access to QuickBooks and other critical business applications


text: Regular backup of business-critical data Installation of commercially available antivirus and security software on all Company computers Timely application of security updates and patches to operating systems and applications Use of secure, password-protected Wi-Fi networks for all business operations Material Effects of Cybersecurity Threats During the reporting period, the Company has not experienced cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Given our small size, our full Board of Directors maintains direct oversight of cybersecurity matters. The Board reviews cybersecurity as part of its risk oversight responsibilities at least annually, and more frequently if specific concerns arise. During these reviews, the Board considers:


text: Any cybersecurity incidents or concerns that occurred since the last review Changes to the Company's technology usage that might affect cybersecurity risk Basic protective measures in place and any recommended improvements Resource allocation for cybersecurity protection Management's Role Due to our limited organizational structure:


text: Our [CEO/President] has primary responsibility for overseeing the Company's cybersecurity practices Our [Controller/Bookkeeper] is responsible for implementing security measures related to our financial systems, including QuickBooks We engage an external IT support provider on an as-needed basis to assist with technical security matters and recommend appropriate safeguards All employees are expected to follow basic security protocols, including proper password management and data protection


text: Cybersecurity Expertise The Company does not have dedicated cybersecurity personnel or specialized expertise on the Board. We compensate for this by:


text: Utilizing our external IT support provider for technical guidance Accessing free cybersecurity resources available to small businesses through organizations such as the Small Business Administration (SBA) and the Federal Trade Commission (FTC)


text: Subscribing to cybersecurity alert services relevant to small businesses Considering basic cybersecurity training for key personnel who handle sensitive information Use of External Resources The Company relies on the following external resources to support our cybersecurity efforts:


text: Contracted IT support services on an as-needed basis Standard commercial security software for virus and malware protection Cloud service providers that maintain security for hosted applications we use QuickBooks security features and Intuit's security infrastructure for financial data


text: We aim to foster and preserve the confidence of customers, employees, shareholders, and other stakeholders regarding our technology and data practices. Our commitments to digital trust, aligned with our core values of service, excellence, integrity, and individual respect, form the basis of our cybersecurity approach.

companyName: BUILD-A-BEAR WORKSHOP INC

ticker: BBW


text: Cybersecurity Risk, Management and Strategy We acknowledge the critical nature of evaluating, pinpointing, and addressing the significant risks posed by cybersecurity threats. Our organization has established a comprehensive set of processes, technologies, and mechanisms to support the identification, evaluation, and management of these risks. Central to our cybersecurity strategy is the mitigation of threats, ensuring the robustness and reliability of our system infrastructures. We utilize the guidelines provided by the National Institute of Standards and Technology (NIST) Cybersecurity Framework to shape our cybersecurity initiatives and comply with the Payment Card Industry Data Security Standards where necessary.


text: Our cybersecurity risk management is intricately integrated into our broader enterprise risk management strategy. Our aim is to effectively identify, prioritize, and manage risks under robust governance, ensuring a secure and resilient organizational environment.


text: The daily operational responsibility for our cybersecurity initiatives falls to our dedicated cybersecurity team, headed by the Chief Technology Officer (CTO). This team collaborates with external partners to forge and execute our data security and cybersecurity plans, including risk assessments, monitoring activities, and training for our employees. We are committed to continually investing in the enhancement of our capabilities to identify, protect against, and detect security threats.


text: We employ a suite of tools and services that support the continuous surveillance and reduction of cyber risks. Our internal teams undertake regular audits and penetration testing throughout the year. External third -party experts are enlisted annually to assess our cybersecurity maturity and conduct risk evaluations, besides offering specialized knowledge on various cybersecurity matters. Our security operations center operates 24/7 to identify, lessen, and react to cyber threats promptly. Defined protocols are in place to manage and mitigate any detected cybersecurity incidents swiftly, with regular reviews of our policies and procedures to ensure compliance with evolving regulatory standards and the dynamic threat landscape.


text: The Incident Response Team (IRT) at our company is a specialized, multidisciplinary group empowered to act swiftly and effectively in managing and communicating cybersecurity incidents. The IRT operates under a comprehensive incident response plan, detailing the procedures for preparing, detecting, responding to, and recovering from cyber incidents. This includes triage, severity assessment, escalation, containment, investigation, and remediation processes, in addition to meeting legal requirements and minimizing damage to the brand and reputation. Regular tabletop exercises are conducted to simulate cyber incidents, enhancing our response strategies, plans, and technology.


text: Our company ensures that all new hires and existing employees undergo data security and privacy training annually, with additional specialized training for certain roles. Periodic campaigns and simulated phishing tests are also conducted to maintain awareness and vigilance against potential risks.


text: Vendor security is maintained using programs that evaluate the risk associated with service providers and business partners, focusing on the nature of data accessed or retained. This risk-based approach guides our due diligence and security assessments for selected vendors, ensuring that our contracts reflect the necessary security commitments.


text: Through the date of filing this Annual Report, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affect our Company, including our business strategy, results of operations, or financial condition. We have not encountered any significant incidents in the past fiscal year. However, we are aware of the ongoing threats that could, if materialized, have a significant impact on our business operations, strategies, or financial condition. Despite our rigorous cybersecurity efforts, we recognize that no system is infallible, and thus we cannot guarantee complete efficacy in preempting or mitigating all potential cyber threats. We continuously evaluate and disclose how identified cybersecurity risks, including those from past incidents, could materially influence our operational, strategic, or financial landscapes.


text: Cybersecurity Governance Our commitment to establishing a secure digital realm is underpinned by the structured governance and management of our data security and privacy policies and strategies. Our Board of Directors, which has primary responsibility for overseeing risk management, has delegated risk management oversight responsibility for information systems, information security, data privacy and cybersecurity to the Audit Committee, a member of which has extensive technology experience, including in the area of cybersecurity. The Audit Committee engages in regular, at least quarterly, discussions on these topics, informed by reports from our IT Security Team led by the CTO. Specific topics may include updates to the Company's approach to cybersecurity risk management; recent developments; key initiatives; the threat landscape; trends; and the results of certain assessments and testing. Periodically, the Audit Committee also receives presentations on cybersecurity matters from third-party cybersecurity experts. The Board of Directors receives reports from the Audit Committee chair on these and other risk-related matters as deemed necessary.


text: Our cybersecurity initiatives are led by our CTO and our Director of Security, who holds a Bachelor of Science, Management Information Systems and a Master of Science, Computer and Information Systems Security and Information Assurance. In addition, our CTO and our Director of Security have Computer Hacking Forensics Investigator and Certified Ethical Hacker certifications. Both, under the CTO's leadership, have extensive experience in managing information security, crafting cybersecurity strategies, and spearheading initiatives to counter evolving cyber threats.


text: The Security and Technology Risk Leadership Committee, led by our CTO, oversees our cybersecurity initiatives, and comprises technology leaders and members of various departments across the company. Similarly, our Privacy, Data Governance, and Artificial Intelligence Committee, under the guidance of our Chief Privacy Officer, oversees our privacy and data governance strategies.


text: We take a defense-in-depth approach, leveraging multiple, layered security measures, to protect our data, our customers' data, our infrastructure, and our employees. We embed data protection throughout our operations and information technology programs, relying on multiple and various controls to prevent and detect threats, with the goal of safeguarding our assets, data and personnel.

companyName: BIO KEY INTERNATIONAL INC

ticker: BKYI


text: We evaluate cybersecurity risks as part of our overall enterprise risk management. A steering committee of senior executives meets quarterly to evaluate any changes to the Company's exposure to cybersecurity risks, discuss potential mitigation plans, and provide updates on mitigation efforts already underway. Our cybersecurity team keeps up to date on the latest threats and risks through multiple channels and is also involved in evaluating risks associated with any new proposed service providers. We employ a Cybersecurity Engineer, reporting directly to our Chief Technology Officer, who manages our cybersecurity team that is comprised entirely of security professionals with industry recognized certifications. The cybersecurity team within BIO-key is responsible for assessing and managing risks associated with both our internal operations and our use of third-party service providers and informing/gaining feedback from the cybersecurity steering committee.


text: Additionally, our cybersecurity team maintains a comprehensive set of cybersecurity policies and standards, including a security incident response framework. The framework is a set of coordinated procedures and tasks that our incident response team executes to ensure timely and accurate reporting and resolution of computer security incidents. The framework details who, how and when appropriate persons or committees, including the Board of Directors and Audit Committee are kept informed on the status of potential cybersecurity incidents. A summary of recent incidents is also presented by the Chief Law Officer ("CLO") at each regular Audit Committee meeting. Our policies and standards were developed in collaboration with a wide range of disciplines, including information technology, cybersecurity, legal, compliance and business. Our cybersecurity strategy and policies are continually reassessed to ensure they attempt to identify and proactively address the constant changes in the global threats. Decision makers such as the CLO, executive team, and Audit Committee are regularly kept up to date on cybersecurity trends. Ongoing collaboration with stakeholders throughout the business also helps to build continued awareness and visibility of future needs.


text: We engage external vendors to assess the cybersecurity program as needed. An independent third party will perform annual multi-stage penetration testing of our IT environment.


text: Our cybersecurity program is governed by the Audit Committee of our Board. The Audit Committee of the Board and the full Board will each receive quarterly updates on cybersecurity risks identified through the enterprise risk management processes described above.


text: Notwithstanding our processes to oversee and identify risk from cybersecurity threats, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. We identify nation state-sponsored threat actors and the rise in sophistication and proliferation of ransomware campaigns as top reasonable material risks to the business. The theft, unauthorized use or publication of our intellectual property and/or confidential business or personal information (whether through a breach of our own systems or the breach of a system of a third party that provides services to us) could harm our competitive or negotiating positions, reduce the value of our investment in research and development and other strategic initiatives, compromise our patent enforcement strategies or outlook, damage our reputation or otherwise adversely affect our business. To date there have not been any risks that have materially affected our operations. See Item 1A. " RISK FACTORS " for a discussion of cybersecurity risks.


text: Risk Management and Strategy Our cybersecurity strategy prioritizes detection, analysis, and response to mitigate unknown and unexpected threats and security risks. Our cybersecurity risk management processes include technical security controls, monitoring systems, employee training, and management oversight to assess, identify, and manage risks from cybersecurity threats. To date, we have not experienced any cybersecurity threats or incidents which have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, but we cannot provide assurance that they will not have a material impact in the future. See "Risk Factors" in Item 1A of this Annual Report for additional information about our cybersecurity risks.

companyName: MIND TECHNOLOGY, INC

ticker: MIND


text: Also, as part of our cybersecurity program, we partner with a third -party information technology firm to support and evaluate our cybersecurity and informational security program. This third -party service includes product and software security for data protection and cyber defense, to monitor, detect, prevent, and protect our Company against potential cybersecurity threats.


text: Our executive management has overall responsibility for risk oversight in performing this function. Our executive management assesses cybersecurity and information technology risks and the controls implemented to monitor and mitigate these risks. Our cybersecurity program is overseen by our Global Information Technology Manager, who meets regularly with executive management to share information about potential cybersecurity events and monitor, prevent, and detect potential cybersecurity incidents. Executive management is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks.


text: Risk Management and Strategy The Company's policies and practices are based on frameworks and standards that address risks through a comprehensive, cross-functional approach that assess, identify, monitor, and mitigate material risks from cybersecurity threats as part of the overall enterprise risk management ("ERM") process. This includes the collection and storage of data and being responsive to incidents as they occur. Further, the Company's processes and technology are utilized to develop, implement, and maintain appropriate measures to safeguard information systems in protecting the integrity, availability, and confidentiality of data. Additionally, the Company engages certain third parties to assist in network monitoring and control testing, among other functions of similar capacity.

companyName: Perma-Pipe International Holdings, Inc.

ticker: PPIH


text: Technological safeguards that are designed to protect the Company's information systems from cybersecurity threats, including the prevention and detection of system applications, access controls, and firewalls, which the Company assesses the vulnerability and severity of potential cybersecurity threats and makes necessary improvements. Utilization of third parties as part of the Company's risk-based approach in identifying and overseeing cybersecurity risks.


text: The Company maintains an incident plan that addresses the Company's response to a cybersecurity event, which is periodically reviewed and updated.


text: While the Company is working to adopt the National Institute of Standards and Technology ("NIST") cybersecurity framework, the Company's on-going investment in information systems and utilization of external 3rd parties represents the best means for extensively testing both the design and operational effectiveness of cybersecurity controls, and to ensure continuity and functionality of the Company's operating systems.


text: As of the date of this report, the Company has not experienced any material cybersecurity events. However, the presence of new or more advanced forms of cybersecurity threats could have a material and adverse impact on the business, results of operations, and financial position. For further discussion relating to this topic, see Item 1A. Risk Factors "The Company's information technology systems may be negatively affected by cybersecurity threats."


text: The Audit Committee of the Board of Directors has the responsibility of overseeing the Company's cybersecurity risks. The Director of Information Technology provides periodic updates to the Board of Directors regarding actions taken to mitigate the Company's exposure and protection from cybersecurity risks. Management routinely evaluates the Company's security processes, procedures, and systems to determine if enhancements are needed to reduce the possibility of a future cybersecurity event. This includes safeguards implemented by the Company, such as a multi-factor authentication process; restricted firewall settings; network monitoring, email phishing tests, and enhancing the Company's backup recovery strategy, among others.


text: The Director of Information Technology is responsible for assessing, monitoring, and managing the Company's cybersecurity risks. The Director of Information Technology has extensive experience in leading the Company's information systems and has previously led cybersecurity teams for several large global organizations prior to joining the Company.


text: The Director of Information Technology, along with members of management, inform the Audit Committee on cybersecurity risks by providing periodic updates regarding (i) Status of ongoing cybersecurity initiatives and strategies, (ii) The overall state of the Company's security program and potential exposure to risks, and (iii) Incident reports and learning from any cybersecurity events. Further, the Director of Information Technology maintains an open dialogue regarding any significant developments in cybersecurity risks, ensuring the Audit Committee's oversight is proactive and responsive. In addition to periodic updates to the Audit Committee, the Director of Information Technology, in his capacity, regularly informs the Chief Executive Officer ("CEO") and the Chief Financial Officer ("CFO") regarding matters related to cybersecurity risks and incidents. This ensures the highest level of management are informed of potential risks associated with cybersecurity that could have a material and adverse effect on the Company.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property.

companyName: STREAMLINE HEALTH SOLUTIONS INC.


text: Our cybersecurity program includes systems and processes for assessing, identifying and managing material risks from cybersecurity threats and include maintenance and monitoring of information security policies aligned with information technology controls; user and employee awareness of cybersecurity policies and practices; information systems configuration management; and infrastructure security systems. Management makes concerted efforts to select third-party software providers with a demonstrated track-record of effectively addressing cybersecurity concerns. In event of a cybersecurity incident, we would rely upon these providers. We have developed and implemented cybersecurity and data privacy processes and procedures that are informed by recognized cybersecurity frameworks and standards, including Microsoft Azure CSPM and SOC 2. We use this framework, together with information collected from periodic manual assessments and automated testing, to tailor aspects of our cybersecurity practices given the nature of our assets, operations and business.


text: The members of our information technology team actively monitor threats to the information technology environment and work with our third -party service providers to monitory cybersecurity threats. In light of the Company's current size and limited personnel, management believes relying on experienced third -party providers is the most prudent and cost-effective course.


text: As of the date of this Annual Report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition. For more information on how cybersecurity risk could materially affect our company's business strategy, results of operations, or financial condition, please refer to the "Risk Factors" section of this Annual Report.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. Our Board of Directors is responsible for general cybersecurity risk oversight and stays informed on data privacy and information security issues and vulnerabilities that may be applicable to the Company. Our Board of Directors reviews and evaluates management's evaluation and mitigation of cybersecurity risks as part of its oversight of the Company's risk management program. Management periodically reviews cybersecurity risks and risk mitigation plans and activities with the Board of Directors. We outsource most aspects of our information technology management and these third-party providers are available to address any cybersecurity issues that may arise.


text: SPAR Group Inc. recognizes the increased global cybersecurity threats and sophisticated, targeted computer crime and the risk it poses to our operations. We rely on information technology and data to operate our business and develop, market and deliver our products and services to our customers.

companyName: SPAR Group, Inc.

ticker: SGRP


text: Our cybersecurity risk management program is led by our Chief Information Officer ("CIO"), who is directly responsible for establishing cybersecurity strategies and structures and managing ongoing cybersecurity risk management activities. Our CIO is part of the executive management team, and updates our CEO and executive management on a monthly, or even more frequent, basis on cybersecurity enhancement and the development and implementation of our roadmap.


text: We have strategically embedded cybersecurity risk management within an enterprise-wide framework, ensuring that it permeates across various facets of our operations. This integrated approach encompasses administrative protocols, operational strategies, organizational structures, physical safeguards, and technical measures, all tailored to align with the scope and nature of our business.


text: Cybersecurity Risk Management and Strategy We believe this integrated approach allows cybersecurity considerations to be an integral part of our decision-making processes. Our day-to-day cybersecurity work is led by our CIO and Head of Infrastructure. Both are highly experienced professionals. This group works closely with our executive management to continuously evaluate and address cybersecurity risks in alignment with our business and operational needs.


text: Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third -party assessments, internal audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things:


text: Proactively review threat intelligence and other information obtained from governmental, public or private sources Perform network vulnerability scans, cyber-hygiene assessments, and continually evaluate and address perceived gaps. Conduct companywide cyber awareness training and on-going new employee cyber training. Deploy a wide array of industry leading 3rd party solutions to continuously monitor network and endpoints. On-going testing and evaluation of backup processes. Perform disaster recovery tabletop exercises to assess readiness for possible events.


text: As noted, to operate our business, we utilize certain third -party service providers to perform a variety of functions and provide certain security-related services, such as outsourced business critical functions, professional services, SaaS platforms, managed services, cloud-based infrastructure, data center facilities, content delivery to customers, encryption and authentication technology, corporate productivity services, and other functions; as well as third parties that assist us to identify, assess and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity software providers, penetration testing firms and other vendors that help to identify, assess or manage cybersecurity risks. Response, eradication and recovery, Post-incident analysis and future preparations.


text: The plan also provides the process and workflow of communication for escalation of incidents to executive leadership to determine incident classification, impact severity, and if and what further actions are warranted. Incident responses are overseen by leaders from our Software, Infrastructure Engineering, and Executive team.


text: Cybersecurity Governance Cybersecurity holds a significant role within our risk management procedures and remains a focal point for our Board and management. Under the Board's oversight of general risk identification and management activities, the Audit Committee monitors cybersecurity risks. Committee members engage in comprehensive discussions with management regarding these risks, as well as the measures taken to safeguard the company's information systems and security, along with reviewing management's steps towards data privacy protection. Additionally, the Audit Committee receives annual cybersecurity updates from senior management, covering both existing and emerging risks, management's responses and mitigation efforts, any cybersecurity or data privacy incidents, and the status of key information security initiatives. Furthermore, our Board members regularly hold informal discussions with management about cybersecurity news events and any updates to our cybersecurity risk management and strategy programs.


text: The leadership of our cybersecurity risk management and strategy is guided by experts from our Software, Infrastructure Engineering, and Executive teams. With backgrounds spanning: information technology, security, systems, programming, and corporate strategy, these individuals are equipped to oversee prevention, detection, mitigation, and remediation of cybersecurity incidents. They actively engage in managing our cybersecurity risk processes, including executing our incident response plan, and regularly report relevant matters to the executive management and the Audit Committee.


text: We carry insurance that provides protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover, or be sufficient to cover, all losses or claims that may result from a cybersecurity incident.


text: During the last fiscal year, 2024, the Company did not encounter any material cybersecurity incidents, nor did it incur any notable expenses as a result.


text: Our technologies, systems and networks may be subject to cybersecurity threats. Our business, like others within the energy technologies industry, is faced with growing cybersecurity threats as we increasingly rely on digital technologies across our business, some of which are managed by third -party service providers on whom we rely to help us collect, host or process information.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: We recognize the significance of these threats, sometimes referred to as hacking, cybersecurity fraud, and cyberattacks, and maintains processes and procedures designed to protect our critical systems and sensitive information from unauthorized access. However, there can be no assurance that a cyber-attack would timely be detected or thwarted. To date, we are not aware of any material cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, and we have not incurred significant operating expenses related to cybersecurity incidents. For more information on risks related to cybersecurity, please see the section titled "Risk Factors" included under Item 1A of this Annual Report on Form 10-K.


text: Risk Management and Strategy Our cybersecurity risk management program includes operational, technical and physical controls to protect against and respond timely to cybersecurity threats. To address evolving cybersecurity risks and corresponding regulations, our policies and procedures are benchmarked to industry, regulatory and cybersecurity frameworks (including the National Institute of Standards and Technology). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we may use industry, regulatory, and cybersecurity frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Management has engaged third -party vendors to assist in monitoring our cybersecurity risk management programs and identifying and responding to any incidents. Additionally, third -party vendors are routinely engaged to evaluate how effectively management as a whole manages cybersecurity risk. This includes annual testing of our incident response plan through tabletop exercises and simulations to ensure readiness as well as penetration testing and security assessments. We also utilize third -party cybersecurity vendors to assess our protections against identified vulnerabilities, and we have implemented a third -party risk management process for key service providers, based on our assessment of their criticality to our operations.


text: We have developed cybersecurity training for employees concerning cybersecurity risk. This training provides information on security awareness and phishing simulations. All employees are required to attend periodic cybersecurity training. On a regular basis, our IT team shares news and articles related to cybersecurity awareness with all employees.


text: Our cybersecurity risk assessment is performed annually and includes external and internal penetration testing performed by third party vendors to test for vulnerabilities in the Company's environment.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our business and operations may be materially adversely impacted in the event of a failure or security breach of our or any critical third parties' IT Systems or Confidential Information."


text: The Board of Directors has delegated the oversight of risks from cybersecurity threats to the Audit Committee, which has delegated authority to the Chief Financial Officer to oversee the Company's day-to-day cybersecurity risk management, including prevention, detection and responding to any suspected cybersecurity incident.


text: The Audit Committee is updated at least annually by the CFO on the status of cybersecurity matters. Contemporaneous reporting is provided on an as needed basis to the Audit Committee and to the full Board of Directors on significant cyber events including response, legal obligations, and outreach and notification to regulators, and third parties when needed.


text: The Director, Global Information Technology and Financial Systems (the "IT Director"), leads an internal team who work directly with our third-party vendors to manage our cybersecurity risk management program and activities. The internal team monitors our information systems for cybersecurity threats, reviews cybersecurity incidents, analyzes emerging threats, and develops and implements risk mitigation strategies. Under our CFO's authority, the IT Director periodically reports on the cybersecurity program to our executive leadership team, including by providing the team with updates on cybersecurity threats and incidents, the status of ongoing projects and initiatives, performance metrics, and additional cybersecurity topics. On an annual basis, the IT Director reviews the results of the current state of cybersecurity risk management, including the results of our cybersecurity risk assessment and any action plan to address any identified vulnerabilities.


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our Board and our management actively oversee our risk management program, including the management of cybersecurity risks. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that the Company's sustained investment in these efforts and technologies have put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: SOLITRON DEVICES INC

ticker: SODI


text: Risk Management and Strategy At a high level, the key objectives for the Company's cybersecurity program are to implement and sustain effective security controls to stop intrusion attempts and to maintain and continuously improve its ability to respond to attacks and incidents. Success in achieving these objectives relies upon using quality technology solutions, cultivating and maintaining a team of skilled professionals, and improving processes continuously. Our cybersecurity program in particular focuses on the following key areas:


text: Risk Assessment: At least annually, we conduct a cybersecurity risk assessment that takes into account information from our employees, known information security vulnerabilities, and information from external sources, including reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants. The results of the assessment are used to develop initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader Company-wide risk assessment that are then reported to our Board and members of management.


text: Technical Safeguards: We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: Incident Response and Recovery Planning: We have established comprehensive incident response and recovery plans that guide our response in the event of a cybersecurity incident. We continuously test and evaluate the effectiveness of those plans.


text: Cybersecurity Risk Management and Strategy. We have processes for assessing, identifying, and managing cybersecurity threats, and cybersecurity is an integral part of our overall enterprise risk management program which is overseen by our Audit Committee and the Board of Directors. Our strategy includes a comprehensive cybersecurity framework, utilizing advanced technologies and methodologies, such as cloud migrations and deployment of threat detection tools to mitigate potential risks. Continuous risk assessments help us better refine our strategy, guiding the deployment of technical safeguards and shaping our incident response plans. For acquired companies, our integration strategies prioritize establishing comprehensive timelines for harmonizing information security, data privacy, and cybersecurity practices. This includes a strong focus on aligning employee education programs to ensure a seamless transition and uphold security and privacy standards across our entities.

companyName: TRANSCAT INC

ticker: TRNS


text: We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third -party service providers, ensuring the service providers adhere to our security standards, thereby safeguarding our integrated operations. The strategic migration of our data centers and infrastructure to secure cloud environments, coupled with the implementation of targeted technical cybersecurity measures, underscores our dedication to establishing foundational security across our users, applications, data, systems, and networks.


text: We have established a comprehensive incident response plan to swiftly address and recover from cybersecurity incidents, minimizing operational impact. We conduct regular trainings and simulations to enhance our team's awareness and preparedness against cyber threats. Our proactive approach to addressing identified vulnerabilities affirms the continuous improvement of our security posture.


text: Use of Consultants and Advisors. We engage various third -party cybersecurity service providers to assess and enhance our cybersecurity practices and assist with the protection and monitoring of our systems and information. This encompasses a range of services, including network monitoring, endpoint protection, vulnerability assessments, and penetration testing. Additionally, we engage cybersecurity consultants, auditors, and other third parties, such as a third -party consulting firm, to rigorously evaluate our cyber processes. This includes a comprehensive assessment of our incident response procedures, ensuring they meet the highest standards of readiness and effectiveness.


text: To ensure the integrity and security of our operations, we have implemented stringent processes to evaluate third -party service providers and vendors that have access to sensitive systems, as well as company and customer data. This evaluation may include due diligence procedures such as assessments of the service provider's cybersecurity posture or recommendations for specific mitigation controls. Following an assessment, we determine and prioritize service provider risk based on potential threat impact and likelihood. These risk determinations are crucial in driving the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Board Oversight and Management ' s Role. The Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee oversees the proper functioning of our cybersecurity risk management program to ensures strategic alignment and governance of our cybersecurity efforts at the highest level. In particular, the Audit Committee assists the Board of Directors in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.


text: Management has implemented robust risk management structures, policies, and procedures, with day-to-day cybersecurity risk management being a core responsibility. Our Chief Information Officer ("CIO") spearheads the assessment and management of cybersecurity risks, ensuring that our strategies and actions are both proactive and responsive to the evolving cybersecurity landscape. Supporting this effort, we have a cross-departmental approach to cyber security management. This ensures that our executive leadership team receives comprehensive quarterly updates on cybersecurity from various teams within the organization. Such updates are instrumental in promoting stakeholder engagement across all levels and enhancing management's oversight of cybersecurity. The content of these updates includes progress on ongoing cybersecurity initiatives, insights from recent threat assessments or incidents, findings and action plans derived from external vulnerability and penetration tests, and key performance metrics aligned with industry standards. Our CIO and our Chief Financial Officer report risks to the Audit Committee on a quarterly basis.


text: Risks from Material Cybersecurity Threats. Despite ongoing cyber-attacks, such as unauthorized access, phishing, and ransomware, we have not identified any cybersecurity incidents that have materially affected or are reasonably anticipated to have a material effect on our business strategy, results of operations, or financial condition. Our proactive security measures, alongside those of our third -party vendors, aim to protect our information technology systems and the sensitive data they hold. To bolster our cybersecurity posture, Transcat has engaged a third -party Managed Security Services Provider ("MSSP") to enhance our defensive capabilities. This partnership includes comprehensive vulnerability scanning both internally and externally to detect potential security weaknesses before they can be exploited. Our MSSP also provides round-the-clock monitoring through a 24x7x365 Security Operations Center ("SOC"), safeguarding our digital assets ("Endpoint Detection and Response - EDR"), identities ("Identity Detection and Response - IDR"), and integrating supplemental logging sources such as firewalls and Enterprise Resource Planning systems ("Extended Detection and Response - XDR"). Furthermore, we have established Incident Response as a Service ("IRaaS") to ensure rapid and effective action in the event of a security breach.


text: The Company's Board of Directors (the " Board ") recognizes the importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is responsible for overseeing the Company's risk management process, and cybersecurity represents a component of the Company's overall approach to enterprise risk management (" ERM "). In general, the Company seeks to address cybersecurity risks through an approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Charlie's Holdings, Inc.

ticker: CHUC


text: Collaborative Approach: The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident.


text: The Company engages in the occasional assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. The results of such assessments, audits and reviews are reported to management and the Board when necessary, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Board, in coordination with management, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. Key members of the management team monitor and assess a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and key executives discuss the Company's approach to cybersecurity risk management.


text: The Company's Chief Operating Officer ("COO"), Chief Financial Officer ("CFO") and retained third party cybersecurity providers work collaboratively across the Company to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communications, this group monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Board when appropriate.