text: Cybersecurity threats, including any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. See the Risk Factor titled "We are subject to cyber-security risks, including those related to customer, employee, vendor or other company data and including in connection with integration of acquired businesses and operations" for a discussion of risk associated with cybersecurity.


text: Risk Management and Strategy We recognize that cybersecurity is integral to safeguarding our operations, intellectual property, patient data and stakeholder trust. Our cybersecurity risk management processes are designed to assess, identify and mitigate material risks from cybersecurity threats. Despite our best efforts to improve cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity risks is constantly evolving and we will continue to assess and update our cybersecurity measures in response to emerging threats.

companyName: Autonomix Medical, Inc.

ticker: AMIX

secItem: Item 1C


text: Risk Assessment and Identification We have implemented security measures as part of an evolving cybersecurity posture and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks and mitigate the damage that could result from such an attack. As the Company does not have a physical office location, it does not have a local network or in-house servers and proprietary applications. We therefore utilize third-party applications and resources to support our information technology ("IT") needs. All applications utilized by the Company are Software as a Service ("SaaS") offerings. As our applications are developed and managed by third parties, we are dependent on these providers for many functions including disaster recovery during a disaster or cyber incident. We prioritize risks based on their potential impact to our financial condition, operational continuity and reputation. Our goal is to only utilize the most secure and trusted providers for our IT needs.


text: Preventive Controls: We deploy advanced firewalls, endpoint protection and intrusion detection systems to secure our network infrastructure. Multi-factor authentication and encryption are enforced across critical systems and data repositories. Monitoring and Detection: Continuous monitoring of our IT environment is facilitated through our third -party service provider. Incident Response: We maintain an incident response plan that outlines procedures for containment, eradication, and recovery from cybersecurity incidents.


text: Employee Training: All employees receive mandatory cyber security awareness training at onboarding, covering phishing prevention, secure data handling and how to recognize common attack strategies and reporting suspicious activities.


text: Third-Party Risk Management We rely on third -party vendors for certain operational and IT services. To mitigate risks associated with these vendors, we will implement a vendor risk management program that includes: Due diligence reviews of third -party vendors' cybersecurity policies and practices prior to, and during, potential engagement. Contractual requirements for third -party vendors to maintain robust security controls, where applicable, and report incidents promptly.


text: Material Impact of Cybersecurity Risks Cybersecurity threats have the potential to disrupt operations, compromise sensitive data or lead to regulatory penalties. Our proactive risk management processes are designed to minimize the likelihood and impact of such events. As of March 31, 2025, we did not experience any cybersecurity incidents.


text: Cybersecurity Governance The Audit Committee is responsible for oversight of cybersecurity risk. Our Chief Executive Officer and Chief Financial Officer are the members of management responsible for managing and assessing our cybersecurity practices. Our Chief Executive Officer and Chief Financial Officer have each served as executive officers of public companies in the past. The plan for the future is that they will report to the Audit Committee on cybersecurity on a semi-annual basis. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Audit Committee and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken.


text: We believe we are appropriately staffed (as supported by our outsourced IT provider) to support a healthy cybersecurity posture given our size and scope. Our Chief Financial Officer, who reports to the Chief Executive Officer, is directly responsible for IT functions.


text: To date, there have been no risks identified from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the company. However, despite all of the above aforementioned efforts, a cyberattack, if it occurred, could cause system operational problems, disrupt service to clinical trial sites, compromise important data or systems or result in an unintended release of confidential information. See "Item 1A. Risk Factors" for additional discussion of cybersecurity risks impacting our Company.


text: Safeguarding the Company's information technology ("IT") systems, intellectual property, and the confidential information and personal data that customers, suppliers, business partners, employees and others share is a critical concern. As such, the Company has processes in place to assess, identify, and manage material cybersecurity threats and incidents. The Company's cybersecurity strategy includes policies, procedures, and technology that proactively safeguard its operations against cybersecurity threats. The Company utilizes IT that enables its team to access both operational and financial performance data in real time, while, at the same time, identifying and preventing cybersecurity threats and risks. The Company aims to incorporate industry best practices throughout its cybersecurity processes and its cybersecurity framework leverages internationally recognized standards, including the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework (Identify, Protect, Detect, Respond and Recover). These processes incorporate preventative, detective and corrective controls to identify relevant cyber risks and include network and endpoint protection technologies that are designed to block and detect security events at the perimeter and within its network as well as evaluation and monitoring of detected security events. The Company continuously monitors activity, frequently scans applications and systems for vulnerabilities to risk from cybersecurity threats. Continuous monitoring of the Company's networks and systems for threats and vulnerabilities is a key component of the Company's strategy, supported by the analysis of threat intelligence from external sources. This multi-layered approach enables early detection and facilitates prompt response to potential cybersecurity threats.

companyName: PARK AEROSPACE CORP

ticker: PKE


text: Management reviews the Company's IT, data security and other systems, processes, policies, procedures and controls at least annually to (a) identify, assess, monitor and mitigate cybersecurity risks; and (b) identify measures to protect and safeguard against cybersecurity threats and breaches of confidential information and data and IT infrastructure and its other assets or assets of its customers or other third parties in the Company's possession or custody.


text: The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected it or are reasonably likely to materially affect it, including its operations, business strategy, results of operations, or financial condition.


text: The Company's management supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by it; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk management and strategy The Company is committed to securing our information technology systems, including accounting software, point-of-sale software, and back-of-house software, against cybersecurity threats and protecting the privacy of the data of our customers', employees', franchisees', licensees' and other business partners. However, as described in "Item 1A. Risk Factors – Cyberattacks and breaches could cause operational disruptions, fraud or theft of sensitive information " of this Form 10-K, we recognize that cybersecurity threats are an ongoing concern in today's digital world and that, despite devoting resources to secure our information technology systems, cybersecurity incidents can occur and, if so, could negatively impact our brand, business, results of operations and financial condition. Cybersecurity threats include any potential unauthorized occurrence on or conducted through our information technology systems or information technology systems of a third party that we utilize in our business that may result in adverse effects on the confidentiality, integrity or access to our information technology systems.

companyName: NATHANS FAMOUS, INC.

ticker: NATH


text: Our cybersecurity risk management program includes a cybersecurity incident response plan. We design and assess our program primarily following the guidelines of the National Institute of Standards and Technology and Payment Card Industry Data Security Standard. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. The objectives of our programs are to protect the confidentiality, integrity, use and availability of the Company's data; to protect against unauthorized access to the Company's data, the Company's network and information technology applications; and to maintain disaster recovery plans to prepare for and respond to the potential for a disruption in the Company's informational technology. Our programs fall under the oversight of our Information Technology manager.


text: To supplement our internal controls and processes and to meet these objectives, the Company engages third-party consultants who work closely with the Company's Information Technology manager to collectively manage our cybersecurity, information technology and data privacy programs, as well as perform application security reviews, scans and penetration tests. The Company's senior management team, including its Chief Executive Officer and its Chief Financial Officer, reviews the assessments performed by its third-party consultants and determines the plans to be executed in collaboration with the Information Technology manager.


text: Our information technology infrastructure includes firewalls, modern endpoint protections, intrusion detection tools and alerts, as well as multi-factor authentication to provide a multi-layered approach to protecting our information technology systems from unauthorized access, use, disclosure, disruption, or destruction. Such applications are regularly monitored and reviewed for adequacy and potential enhancements.


text: We obtain System and Organizational Controls ("SOC") 1 or SOC 2 reports on an annual basis from vendors that host our significant financial applications to aid in our assessment of information security risk amongst our relationships with the host vendors. We also perform quarterly access reviews for these systems that are subject to Sarbanes-Oxley oversight.


text: Over 98% of our restaurants are operated by franchisees who themselves are at risk of potential cybersecurity threats. There is no connectivity between the Company's network and the networks on which our franchisees and licensees operate. Furthermore, there is no interface between the Company-owned restaurants point-of-sale system and the Company's network and no interface between the Company's primary manufacturer, Smithfield Foods, Inc. and the Company's network.


text: The Company routinely leads training exercises, at least annually, for its employees to reinforce the risk from common tactics and scams like email phishing campaigns, as well as more sophisticated descendants (i.e. spear phishing and smishing) to defend against potential business email and network compromise.


text: We have developed an incident response plan outlining immediate response actions, including internal and external communication protocols. The incident response plan is reviewed regularly by our third-party consultants in collaboration with our Information Technology manager evaluating our capabilities and our readiness. Under the plan, we have identified a management group comprised of our Chief Executive Officer, Chief Financial Officer, Corporate Controller and Information Technology manager. The plan provides that any cybersecurity incident will be reviewed by this group to determine whether any such incident is material for securities laws purposes and whether public disclosure is required, following consultation with outside counsel, the Audit Committee and/or Board of Directors.


text: We maintain cyber risk insurance coverage that is intended to mitigate the financial impact of cybersecurity and data privacy incidents experienced by the Company. There can be no assurance that our cyber insurance policies will be sufficient in scope or amount to cover the costs and expenses related to any future cybersecurity incidents and it does not remedy the reputational and future business impacts.


text: The full Board of Directors has overall responsibility for risk oversight, including cybersecurity matters. It is supported by the Audit Committee, which reports to the full Board of Directors. The Audit Committee receives updates from management, as necessary, on the cybersecurity landscape and cybersecurity risks impacting the Company. At least annually, the Board of Directors receives a cybersecurity update as part of our Company's risk management program. Such updates are designed to ensure that the Company's senior management team remain informed about and can monitor the prevention, detection, mitigation, and remediation of potential cybersecurity incidents.


text: At a management level, our cybersecurity program is led by our Information Technology manager, who reports to the Chief Financial Officer. Our Information Technology manager is supported by our third-party consultants. Our Information Technology manager along with the support of our third-party consultants, is equipped to help navigate the landscape of cybersecurity risks and challenges and to implement and to manage a comprehensive security strategy.


text: While cybersecurity threats have not materially affected our business strategy, results of operations or financial condition, future incidents may interrupt our operations and could materially adversely affect our business, results of operations and financial condition.


text: Risk Management and Strategy The Company's cybersecurity risk management program is integrated with its overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across functions to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Seneca Foods Corp

ticker: SENEA


text: The Company designs and assesses the cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The Company uses the NIST CSF as a guide to help identify, assess, and manage cybersecurity risks relevant to its business; this does not imply that the Company's cybersecurity program meets any particular technical standards, specifications, or requirements.


text: Awareness and training for employees, involving phishing campaigns, informational sessions at management meetings, and annual mandatory training with simulations of common cybersecurity threats; Security tools and technologies, along with control policies and active review procedures which strengthen authentication and access protection;


text: Third-party risk management process and monitoring procedures for service providers, suppliers, and vendors who have access to critical systems and information;


text: Risk and vulnerability management encompassing both proactive and predictive defenses which provides opportunities to assess, remediate, and validate; and Managed detection and incident response, including advanced endpoint protection and data loss prevention.


text: In evaluating the risks identified as a part of the annual assessment process, the Company's information technology team considers the likelihood and severity of the respective risk and the potential impact of the risk on the Company, its customers, and its employees. These risks are then prioritized and monitored by the information technology team.


text: The Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems to assess its cybersecurity readiness and maturity of the cybersecurity program. Tests are conducted by the information technology team and reputable third-party consultants and auditors. In developing and evaluating the testing procedures, the Company considers both its individual risks and industry standards.


text: The cybersecurity risk management program includes an incident response plan with a cross-functional team comprised of designated members of the information technology department, senior management, and other appropriate individuals. The team is responsible for assessing and managing the cybersecurity incident response process, as outlined within the incident response plan, and taking necessary corrective actions to mitigate and eliminate the issue.


text: As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents and potential impact to the Company, see the cybersecurity risk factor within "Item 1A. Risk Factors" in this Form 10-K.


text: The information technology department, led by the Senior Vice President of Technology and Planning, Chief Information Officer ("CIO"), is responsible for the Company's cybersecurity program. The CIO, along with the certified Information Security Officer and the VP of Information Technology have significant experience spanning over 20 years in information security, infrastructure, and compliance.


text: The Board of Directors considers cybersecurity risk as part of its overall risk oversight function. The Board of Directors receives briefings from the CIO regarding the Company's cybersecurity risk management program at least annually. These briefings include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.


text: Cybersecurity Governance The Board of Directors (the "Board") of the Company is responsible for the oversight of the Company's cybersecurity program and recognizes the risks that cybersecurity threats may impose on the Company, its business partners, employees and investors. The Company's IT Director is responsible for overall IT governance, risk and compliance including the Company's cybersecurity program. The Audit Committee of the Board collaborates with the full Board and the IT Director to facilitate alignment of overall IT related controls and processes. We have a formalized IT Security Incident Report process which provides a method to document and communicate details of security incidents to appropriate stakeholders. The Board and the Audit Committee receive periodic briefings on cybersecurity and help set priorities and strategic direction. As part of continuous improvement, our cybersecurity program is being aligned with the NIST Cybersecurity Framework 2.0 to help ensure comprehensive controls and oversight.

companyName: FRIEDMAN INDUSTRIES INC

ticker: FRD


text: Cybersecurity Controls We have implemented a modern, comprehensive set of controls that restrict access to systems using a combination of firewalls, virtual private networks, multi-factor authentication and enforced use of corporate controlled compliant devices. We utilize automated intrusion prevention, detection and response systems which constantly monitor activity, build usage patterns and respond or alert when unusual activity is detected. We have experienced staff who perform root cause analysis, respond to any immediate threat, and implement improved controls for future prevention. Our cybersecurity tools are fully integrated and collect data from various sources to build relationships and detect more complex multi-channel attack strategies. Application controls are role-based and designed to protect data confidentiality and provide overall data integrity. A risk-based approach is taken regarding third-party systems utilized in our business.


text: We have controls specifically focused on E-mail phishing including impersonation attempts. Although our automated controls prevent most phishing attempts, some can be delivered to employees. To mitigate this risk, we provide training to employees using various methods including E-mail phishing campaigns which send phishing-style E-mails, monitors user responses and automatically assigns further training as appropriate. Employees have been trained to send any suspicious activity to a central IT Service Desk for evaluation and appropriate timely action.


text: All critical systems have rigorous data backups and are designed for disaster recovery, ensuring business continuity in the event of a catastrophic incident. As part of continuous improvement, disaster recovery testing is being conducted and documented.


text: We are not aware of any unmitigated risk or any prior incident that may have materially affected the Company's data integrity, confidentiality, operations, business strategy or financial reporting. Given our reliance on modern systems, we are aware a significant incident could impact the Company's overall goals so we strive to provide modern counter measures to manage this risk.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan and is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. Our cybersecurity risk management program includes the following key elements:

companyName: CYANOTECH CORP

ticker: CYAN


text: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services and our broader enterprise information technology ("IT") environment;


text: A team comprised of IT personnel responsible for directing ( 1) our cybersecurity risk assessment processes; ( 2) our security controls; and ( 3) our response to cybersecurity incidents;


text: The use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our cybersecurity processes; A cybersecurity incident response plan.


text: During the fiscal year ended March 31, 2025, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition, as we have described in the Risk Factors section of this Form 10-K.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as critical to the enterprise and oversees management's design, implementation and enforcement of our cybersecurity risk management program, while our executive officers are responsible for the day-to-day management of the material risks. Our Board of Directors receive annual updates, and/or significant updates as needed, on relevant information regarding cybersecurity.


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity measures are primarily focused on ensuring the security and protection of its information technology systems and data. The Company recognizes the increasing volume and sophistication of cybersecurity threats and takes seriously its responsibility to protect these information technology systems and data. The Company considers risks associated with cybersecurity alongside the Company's other risks as part of its overall risk assessment process. The Company's Vice President of Information Technology and his staff monitor the Company's information systems to provide a comprehensive approach to assess, identify, manage, mitigate, and respond to cybersecurity threats.

companyName: CROWN CRAFTS INC

ticker: CRWS


text: The Company uses cost-effective controls that are commensurate with the risk and sensitivity of its specific information systems, control systems and enterprise data. The Company's cybersecurity program incorporates best practices and industry standards from multiple sources and includes, but is not limited to, risk assessment, policies and procedures, training and awareness, auditing, log collection and analysis, threat hunting and intelligence surveillance, compliance monitoring and testing, and incident response.


text: When necessary, the Company's Vice President of Information Technology and his staff collaborate with external third -party subject matter specialists. The Company has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of these providers. All third parties engaged for such matters are subjected to scrutiny to ensure they satisfy the Company's security standards. The Company periodically reviews its third -party engagements to ensure that the providers maintain the necessary levels of protection and competency, as well as to oversee and identify potential cybersecurity risks and threats from such engagements.


text: As of May 31, 2025, the Company has not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operation or financial condition. The Company has further disclosed how risks from cybersecurity threats could potentially have a material impact on the Company, including its business strategy, results of operations, or financial condition, in Part I, Item 1A, "Risk Factors" of this Annual Report.


text: Cybersecurity Governance Cybersecurity, as an important part of the Company's risk management processes, is a critical area of focus for the Company's Board of Directors (the "Board"), which is responsible for oversight of the Company's cybersecurity risk, including the effectiveness of cybersecurity risk management policies and protocols. As part of the Board's oversight, the Board receives periodic reports from the Company's Vice President of Information Technology and other members of the Company's executive management team. These reports include updates on the Company's cybersecurity risks and threats, the status of projects intended to strengthen its information security systems, assessments of the cybersecurity program, and the emerging threat landscape.


text: In the event of a cybersecurity incident, the Company has processes by which the incident would be escalated internally and, when appropriate, reported to the Board or an appropriate committee of the Board, as well as for updating the Board regarding the incident until it has been resolved.


text: The Company's Vice President of Information Technology is responsible for the Company's cybersecurity strategy and execution. He has more than 30 years of experience in technology and information systems leadership and reports directly to the Company's Chief Executive Officer.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature, ("Information Systems and Data").

companyName: EMERSON RADIO CORP

ticker: MSN


text: Our information technology ("IT") department helps identify, assess and manage the Company's cybersecurity threats and risks. Our IT department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, using manual tools and conducting threat assessments designed to identity internal and external threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, conducting risk asse ssments and maintaining business continuity and disaster recovery plans.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program. The IT department works with Company management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Board, which evaluates our overall enterprise risk.


text: We use third -party service providers to perform a variety of functions throughout our business, such as internet hosting companies, distributors, and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with any particular provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10 -K, including "An information systems interruption or breach in security, including as a result of cyber-attacks, could adversely affect the Company's business, results of operations and reputation."


text: Our Board addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee of the Board (the "Audit Committee") is responsible for overseeing the Company's risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Operating Officer ("COO"). Our COO, assisted by our Senior Vice President for Operations, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our COO and Senior Vice President for Operations are responsible for reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our COO.


text: The Board may receive reports from our IT Department and/or Management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.


text: Risk Management and Strategy We perform a formal risk assessment each year. As part of our risk assessment, we consider the potential for cybersecurity threats, including but not limited to interruptions, outages and breaches to its operational and financial systems. We have policies, processes, internal controls and tools to assess, identify, and manage material risks from potential cybersecurity threats. We utilize a combination of cybersecurity awareness training, manual processes, specialized software and automated tools, and third-party assessments to build our cybersecurity program. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program. We are also currently developing a cybersecurity incident response plan that establishes a formal framework for responding to cybersecurity incidents, including defining what constitutes a reportable cybersecurity incident; establishing specific escalation and communication channels; identifying parties responsible for managing and responding to each incident; and other preparedness and response activities.

companyName: PodcastOne, Inc.

ticker: PODC


text: The Audit Committee of our board of directors provides oversight over our internal control program, including the adequacy and effectiveness of our information technology infrastructure and cybersecurity program. Each quarter, our management provides updates to the Audit Committee regarding our internal control program, including any significant changes to its information technology infrastructure or cybersecurity program. Our management also reports any material risks from cybersecurity threats to the Audit Committee. Our management periodically provides the Audit Committee with updates on cybersecurity risks and/or trends.


text: Our management team, specifically our President and Chief Financial Officer, are responsible for the day-to-day administration of our business operations, including our risk management of cybersecurity risks. Our management is responsible for the design and implementation of policies, processes and internal controls to manage our cybersecurity risks. Our management team regularly meets with their information technology resources, including our third-party service providers, to ensure that we are appropriately positioned to manage our cybersecurity risks. Our management team also sponsors periodic cybersecurity awareness training for employees.


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For further discussion of the cybersecurity risks, see "Part I—Item 1A. Risk Factors," specifically the risk titled "Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business and our products." No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.


text: Risk management and strategy We rely on our information technology to operate our business. We have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: ADM TRONICS UNLIMITED, INC.

ticker: ADMT


text: Due to our highly regulated stature for medical device development and manufacture, we have been practicing cybersecurity for a long time. We are ISO-13485 Certified for medical device manufacturing. Elements of that certification include risk management. And we are knowledgeable about ISO-27001. We have an engineer responsible for the security of our computers, network, etc.


text: We have robust firewalls for all access points. We have top line anti-virus on all computers and networks. We have prioritized the risks to protect our networks. To protect our departments we have implemented an architecture of a separate network for administration and one for engineering. This gives redundancy and protection. There is onsite as well as offsite backup as well as a separation of WiFi for visitors to prevent access to our network.


text: A plan is in place to restore our networks if attacked by both our on-site backup and, if needed the off-site backup. We have very complex software for our engineering. We also have a robust accounting ERP software. These are regularly maintained and updated.


text: We have an independent consultant who is a cybersecurity expert who has advised us on the above systems and procedures. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.


text: Our committee for the review and implementation of cybersecurity policies and procedures are made up of the CEO, CSO and VP of Regulatory and through the CEO, provides an update to the Board of Directors on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Board of Directors of any material threats or incidents that arise.


companyName: LiveOne, Inc.

ticker: LVO


text: Our management team, specifically our Chief Executive Officer and Chief Financial Officer, are responsible for the day-to-day administration of our business operations, including our risk management of cybersecurity risks. Our management is responsible for the design and implementation of policies, processes and internal controls to manage our cybersecurity risks. Our management team regularly meets with their information technology resources, including our third-party service providers, to ensure that we are appropriately positioned to manage our cybersecurity risks. Our management team also sponsors periodic cybersecurity awareness training for employees.


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For further discussion of the cybersecurity risks, see "Part I — Item 1A. Risk Factors," specifically the risk titled "We are subject to cybersecurity risks to our systems, infrastructure, and technology, and data processed by us or third-party vendors." No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.


text: SPAR Group Inc. recognizes the increased global cybersecurity threats and sophisticated, targeted computer crime and the risk it poses to our operations. We rely on information technology and data to operate our business and develop, market and deliver our products and services to our customers.

companyName: SPAR Group, Inc.

ticker: SGRP


text: Our cybersecurity risk management program is led by our Chief Information Officer ("CIO"), who is directly responsible for establishing cybersecurity strategies and structures and managing ongoing cybersecurity risk management activities. Our CIO is part of the executive management team, and updates our CEO and executive management on a monthly, or even more frequent basis, on cybersecurity enhancement and the development and implementation of our roadmap.


text: We have strategically embedded cybersecurity risk management within an enterprise-wide framework, ensuring that it permeates across various facets of our operations. This integrated approach encompasses administrative protocols, operational strategies, organizational structures, physical safeguards, and technical measures, all tailored to align with the scope and nature of our business.


text: Cybersecurity Risk Management and Strategy We believe this integrated approach allows cybersecurity considerations to be an integral part of our decision-making processes. Our day-to-day cybersecurity work is led by our CIO and Head of Infrastructure. Both are highly experienced professionals. This group works closely with our executive management to continuously evaluate and address cybersecurity risks in alignment with our business and operational needs.


text: Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third -party assessments, internal audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things:


text: Proactively review threat intelligence and other information obtained from governmental, public or private sources Perform network vulnerability scans, cyber-hygiene assessments, and continually evaluate and address perceived gaps. Conduct companywide cyber awareness training and on-going new employee cyber training. Deploy a wide array of industry leading 3rd party solutions to continuously monitor network and endpoints. On-going testing and evaluation of backup processes. Perform disaster recovery tabletop exercises to assess readiness for possible events.


text: As noted, to operate our business, we utilize certain third -party service providers to perform a variety of functions and provide certain security-related services, such as outsourced business critical functions, professional services, SaaS platforms, managed services, cloud-based infrastructure, data center facilities, content delivery to customers, encryption and authentication technology, corporate productivity services, and other functions; as well as third parties that assist us to identify, assess and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity software providers, penetration testing firms and other vendors that help to identify, assess or manage cybersecurity risks. Response, eradication and recovery, Post-incident analysis and future preparations.


text: The plan also provides the process and workflow of communication for escalation of incidents to executive leadership to determine incident classification, impact severity, and if and what further actions are warranted. Incident responses are overseen by leaders from our Software, Infrastructure Engineering, and Executive team.


text: Cybersecurity Governance Cybersecurity holds a significant role within our risk management procedures and remains a focal point for our Board and management. Under the Board's oversight of general risk identification and management activities, the Audit Committee monitors cybersecurity risks. Committee members engage in comprehensive discussions with management regarding these risks, as well as the measures taken to safeguard the company's information systems and security, along with reviewing management's steps towards data privacy protection. Additionally, the Audit Committee receives annual cybersecurity updates from senior management, covering both existing and emerging risks, management's responses and mitigation efforts, any cybersecurity or data privacy incidents, and the status of key information security initiatives. Furthermore, our Board members regularly hold informal discussions with management about cybersecurity news events and any updates to our cybersecurity risk management and strategy programs.


text: The leadership of our cybersecurity risk management and strategy is guided by experts from our Software, Infrastructure Engineering, and Executive teams. With backgrounds spanning: information technology, security, systems, programming, and corporate strategy, these individuals are equipped to oversee prevention, detection, mitigation, and remediation of cybersecurity incidents. They actively engage in managing our cybersecurity risk processes, including executing our incident response plan, and regularly report relevant matters to the executive management and the Audit Committee.


text: We carry insurance that provides protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover, or be sufficient to cover, all losses or claims that may result from a cybersecurity incident.


text: During the last fiscal year, 2024, the Company did not encounter any material cybersecurity incidents, nor did it incur any notable expenses as a result.


text: Cybersecurity risk, management, and strategy Tilray recognizes that cybersecurity is critical to protecting our systems, data, and operations. We are committed to addressing the significant risks posed by cyber threats by proactively managing the evolving landscape through a comprehensive, enterprise wide approach. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management framework to other legal, compliance, operational, and financial risk areas. The Company is committed to maintaining robust processes to assess, identify and mitigate material risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents.

companyName: Tilray Brands, Inc.

ticker: TLRY


text: Our business is subject to various cybersecurity risks, including but not limited to, unauthorized access to sensitive data, including customer information and medical information, disruption of operations or supply chain due to cyberattacks, theft or manipulation of intellectual property, such as proprietary strains or cultivation techniques, regulatory non-compliance resulting from cybersecurity breaches, including violations of data privacy laws. To address these risks, we have implemented a comprehensive cybersecurity program, which includes, regular risk assessments and vulnerability testing to identify and remediate potential weaknesses in our infrastructure, deployment of advanced access controls, encryption, and endpoint protection to safeguard sensitive data such as customer and medical information, mandatory annual cybersecurity training and awareness programs for all employees to reduce the risk of social engineering and phishing attacks, and continual monitoring and incident response protocols to detect, contain and respond to cybersecurity incidents in a timely and effective manner. We also have information security and data privacy policies and procedures in place applicable to our directors, officers, employees, contractors and suppliers. Third parties service providers also contribute to our overall cybersecurity. We engage third parties that are cybersecurity experts to support in the design, implementation and continuous improvement of our cybersecurity program.


text: As of the date of this Form 10 -K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" for further information about these risks.


text: Cybersecurity governance Cybersecurity is an important part of our risk management processes and is an area of focus for our Board, Chief Information Officer ("CIO") whom reports directly to the Chief Executive Officer, and management team. Our CIO plays a pivotal role in assessing and managing material risks stemming from cybersecurity threats and is primarily responsible for the oversight of our overall cybersecurity risk management program, and coordinates with our external cybersecurity consultants. Additionally, given that cybersecurity risks can impact various areas of responsibility of the Committees of the Board, our Board of Directors oversees cybersecurity risk management and regularly reviews our cybersecurity strategy and initiatives. The Board receives quarterly and as needed updates on cybersecurity matters from the CIO and management on topics including threat landscape developments, incident response readiness, and program enhancements.


text: Tilray is dedicated to maintaining a robust cybersecurity program to safeguard our assets, data, and stakeholders' interests. We remain vigilant in our efforts to identify, assess, and mitigate cybersecurity risks and are committed to transparency and accountability in our cybersecurity disclosures.


text: We believe that information security is a critical component of our business strategy. Therefore, we maintain and continuously assess and strengthen our cyber security program.

companyName: VALUE LINE INC

ticker: VALU


text: Management is responsible for the day-to-day administration of the Company's risk exposures and has adopted a risk management framework including identification, analysis and response to risks affecting our business. The Company has established a committee of senior leaders which is chaired by the Company's Executive Director of Information Technology.


text: We regularly engage third-party services to conduct evaluations of our security controls, which can include penetration testing, independent audits, or consulting on best practices to address new challenges. These evaluations include testing both the design and effectiveness of security controls.


text: We rely on third-party service providers for a variety of services to run our information systems. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. A cyber-attack at a third-party service provider could have a significant impact on our business, and we continuously monitor the risks associated with our service providers.


text: The Audit Committee has responsibility for the oversight of the Company's risk management program, including technology and cybersecurity risks facing the Company. The audit committee receives briefings from management and the executive director of information technology about cybersecurity risk management and the overall technology and cybersecurity environment.


text: We believe that currently we have not encountered a cybersecurity event that has had a material impact on our business. See Item 1A. "Risk Factors" for a discussion of our cybersecurity risks.


text: Cybersecurity Risk Management and Strategy Like other global companies, we face various cybersecurity threats that could have a material adverse effect on our business strategy, results of operations or financial condition. Cybersecurity, therefore, is an important element of our business and our overall enterprise risk management program, and while we have experienced a small number of cyber incidents over the last few years, none to date have been material or had a material adverse effect on our business or financial condition. To mitigate the risk, we have established a multilayered approach to assessing, identifying and managing material risks from cybersecurity threats, which includes the following:

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: An annual cybersecurity risk assessment as part of our Enterprise Risk Management (ERM) program, which reviews and evaluates the potential impact and likelihood of various cyber risks and defines a framework for mitigating measures and residual risk.


text: A cybersecurity roadmap that is built from the risk assessment and feeds into our annual IT expenditure plan and which outlines the actions and investments we intend to take to enhance our cybersecurity posture and capabilities.


text: A continuous cybersecurity risk monitoring and response process, which involves daily review and real-time alerts of security incidents, a multi-disciplinary escalation and review process, and a reporting and filing protocol for material incidents within four business days of materiality determination.


text: A periodic cyber risk assessment conducted by independent experts, which provides an external validation and benchmarking of our cybersecurity practices and performance.


text: As part of our cybersecurity program, we have and will continue to engage third parties, such as consultants, network security firms, auditors, and forensics providers, to assist us in assessing, managing, or investigating cyber risks or incidents. For example, we have engaged industry recognized third parties to monitor and conduct penetration and vulnerability testing on our networks and to assist us in the conduct of tabletop exercises.


text: In order to oversee and identify risks from cybersecurity threats associated with our use of third -party service providers, we perform third -party risk assessments designed to help protect against the misuse of IT by third parties and business partners and generally request that third -party service providers provide us information about their security policies and procedures.


text: Cybersecurity Governance and Oversight We have a cybersecurity governance structure that involves the oversight and involvement of our board of directors and senior management.


text: Our board of directors, through its Audit Committee, maintains oversight of risks, including cybersecurity risks, and receives an update from the Director of IT Security and the Chief Information Officer (CIO) at each quarterly committee meeting. The Audit Committee also reports to the full board on cybersecurity matters as part of its regular report out after each meeting. The Audit Committee Chair is immediately informed of any breach that could be more than de minimis and is kept apprised of any resulting investigation and is briefed on the substance of any Form 8 -K filing related to a material cybersecurity incident.


text: At the management level, oversight of our cybersecurity program rests with an internal committee comprised of the CIO, the Chief Legal Officer (CLO), and the Director of IT Security, who have in aggregate over 40 years of experience in assessing and managing cyber risks. The committee is responsible for overseeing the implementation and execution of our cybersecurity program and policies, and for engaging external experts as needed. The committee also reviews the log of security incidents as needed to validate that there are no materiality issues in the aggregate. The committee reports to the Audit Committee on a quarterly basis or more frequently as needed. We have an Incident Response Team comprised of IT, legal, and internal audit personnel that is activated with the help of other disciplines in the event of a perceived breach or security risk. The team is responsible for assessing the impact and materiality of the incident in accordance with a written Incidence Response Plan, determining the appropriate response and remediation actions, and communicating with internal and external stakeholders as needed.


text: In an effort to deter and detect cyber threats, we have a required cybersecurity training program that is provided to all new employees during on-boarding and semi-annually to employees with access to our IT resources, which aims to raise awareness and foster a culture of cybersecurity awareness among our workforce. We also have an ongoing process of sending simulated phishing emails to employees. The results of these simulated attempts are monitored and reported to each employee's manager. Training includes such cybersecurity topics as social engineering, phishing, password protection, confidential data protection, asset use and mobile security. The training also emphasizes the importance of reporting all incidents immediately.


text: Risk Management and Strategy We have policies, procedures and processes in place to identify, assess and monitor material risks from cybersecurity threats. These plans are part of our overall enterprise risk management strategy and are part of our operating procedures, internal controls, and information systems. Cybersecurity risks include, among other things, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks. We have developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications or requirements under the NIST.

companyName: ETHAN ALLEN INTERIORS INC

ticker: ETD


text: Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on our networks, including customer and employee information.


text: Cybersecurity incident response plan and testing: We have a cybersecurity incident response plan and dedicated teams to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have cross-functional teams that are responsible for leading the initial assessment of priority and severity, and external experts may also be engaged as appropriate. Our cybersecurity teams assist in responding to incidents depending on severity levels and seek to improve our cybersecurity incident management plan through periodic tabletops or simulations. Our Vice President of Information Technology and other members of his team oversee the implementation of this plan and are made aware of ongoing risks and incidents.


text: Training: We provide security awareness training to our employees so they may better understand their information protection and cybersecurity responsibilities. We also provide additional training to certain employees based on their roles.


text: Supplier risk assessments: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply-chain or who have access to our customer and employee data on our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program. These considerations affect the selection and access to our systems, data, or facilities. We also seek contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect our information that is processed on their systems.


text: Third-party assessments: We have engaged third-party vendors to periodically assess our cybersecurity posture, to assist in identifying and remediating risks from cybersecurity threats. We also regularly engage with consultants, auditors, and other third-parties to help identify areas for continued focus, improvement and compliance.


text: While the Company has experienced cybersecurity incidents, we are not aware of any cybersecurity incidents to date, including as a result of any previous cybersecurity incidents, that has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase and the preventative actions we have taken and continue to take to reduce these risks and protect our systems and information may not successfully protect against all cybersecurity threats and incidents in the future. For more information, see Item 1A. Risk Factors under the heading of "Technology and Data Security Risks", of this Annual Report on Form 10-K.


text: The Company's Board of Directors (the "Board"), as a whole, has oversight responsibility for our strategic and operational risks. The Board regularly reviews and discusses with management the strategies, processes and controls pertaining to the management of our information technology operations, including updates on the internal and external cybersecurity threat landscape, incident response, assessment and training activities, and relevant legislative, regulatory, and technical developments. Our Vice President of Information Technology presents, at least annually, to the Board, an overview of our cybersecurity threat risk management and strategy as well as provides reports regarding the evolving cybersecurity landscape, including emerging risk. Our Vice President of Information Technology and other members of his team remain informed about cybersecurity threats through the reporting framework as described above under Cybersecurity Risk Management and Security – Cybersecurity incident response plan and testing.


text: The Information Technology team is responsible for the day-to-day assessment and management of cybersecurity risks. Our cybersecurity risk management and strategy are led by our Vice President of Information Technology, and our Manager of Security. Such individuals have over 50 years of work experience, collectively, in various roles managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs, as well as relevant degrees and certifications.


text: While the Company does not employ a Chief Information Officer or consider cybersecurity threats to be a material risk to the business strategy, results of operations or financial position of the Company, the Board of Directors discusses risks and threats most applicable to the Company and inquires of management regarding design and effectiveness of controls in place to address the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: GREYSTONE LOGISTICS, INC.

ticker: GLGI


text: Risk Management and Strategy Due to the size of the Company, our information technology ("IT") environment does not utilize overly complicated systems or processes. The Company does not sell products or conduct business in an online environment. We utilize a third party managed services provider ("Provider") for security applications, monitoring, and updates to our information technology environment. The Chief Financial Officer serves as the relationship manager for and has regularly scheduled meetings with the Provider to evaluate whether the services provided meet the Company's needs, review hardware and software obsolescence, and identify any new threats that need to be addressed. The Company uses multi-factor authentication for applications wherever possible to provide access security and we maintain a secure physical environment.


text: Through the Provider, automated security tools are used to monitor all Windows-based systems and provide defense against cyberattacks perpetrated on or against these systems and to protect internal systems from known and unknown cybersecurity threats. These security tools include:


text: Advanced, next-generation endpoint security software, detects attempted attacks on internal Windows-based systems and analyzes the attack providing context for said attacks to analysis teams. This data is then used to mitigate the attack and resolve the incident.


text: Privilege management software provides application context to reviewers to aid in the preemptive identification of malicious activities on a system. When administrative permissions are requested, details regarding the requesting process are forwarded to our provider for review and analysis before granting administrative privileges, limiting an attacker's ability to affect and compromise systems in the environment.


text: The Company employs email security tools provided and managed by our Provider to protect against email-based attacks. These tools include an email security gateway and an additional automated email filtering security. These tools provide advanced, AI-powered phishing detection and remediation for all Microsoft 365 email users in the environment.


text: The Company utilizes various third-party service organizations for critical areas of operations, including stockholder transfer agent services, accounting software, financial reporting software and regulatory filings, and mineral management software. The Company obtains System and Organization Controls ("SOC") reports for each vendor and ensures that internal controls are designed and implemented to adequately meet the applicable user controls identified within the SOC report for each vendor.


text: The Company requires all devices used by employees to be protected with the security measures listed above. It is also Company policy that all devices be used by the employee only and any use by non-employees is prohibited.


text: To date, the Company has not experienced a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations or financial condition; however, there can be no guarantee that we will not experience such an incident in the future.


text: The Company's Audit Committee is responsible for exercising oversight of management's identification and management, and planning for, risks from cybersecurity threats.

companyName: TWIN DISC INC

ticker: TWIN


text: The Company has developed and implemented processes to assess, identify, and manage material risks from cybersecurity threats as part of its overall enterprise risk management system. Its cybersecurity processes include security monitoring and threat hunting through a third-party managed vendor and mandatory, company-wide employee training. The processes also extend to oversight and identification of risks associated with vendors and customers if their computer systems interface with the Company's information systems. Upon detection of a potentially material cybersecurity incident, the Company initiates its cyber incident procedure to investigate, contain, and remediate the incident.


text: The Company has not experienced any material cybersecurity incidents, and the expenses incurred from any security incidents have been immaterial. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to the Company, including potentially to the Company's results of operations and financial condition. The Company relies extensively on information technology systems and could face cybersecurity risk. As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that the Company may expend greater resources to continue to modify and enhance protective measures against such security risks.


text: The Company recognizes the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational resilience and protecting stakeholders' interests. The Company currently manages cybersecurity risks by working with third-party IT consultants and utilizing basic security protocols. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to the best of their ability to ensure that potential cybersecurity risk exposures are monitored, putting in place reasonably appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of the CFO with assistance from the management team. Any significant cyber incidents that they become aware of are reported to the board of directors. The Board of Directors does not have a designated cybersecurity committee, but the Audit Committee receives periodic updates on cybersecurity matters. The Company has not experienced any material cybersecurity incidents to date and there are no material cybersecurity incidents discovered in 2025. Please refer to Item 1A: Risk factors for further insights into cyber attack-related risks.

companyName: Star Gold Corp.

ticker: SRGZ


text: Risk Management and Strategy We are committed to preserving the trust and confidence of our stakeholders by taking appropriate technical and organizational measures for maintaining information security and data privacy. Our cybersecurity program allows us to assess, identify and manage information security and cybersecurity threats through risk assessment and prevention measures to facilitate communication, training, awareness and incident response procedures. We have established policies and procedures to ensure timely and appropriate notifications to relevant parties and regulators as required for cybersecurity threats and data breaches.

companyName: LSI INDUSTRIES INC

ticker: LYTS


text: Our data breach response designates an incident response team comprised of senior leaders within information technology, finance and compliance functions to ensure timely diagnosis and mitigation of cyber events. The incident response team is responsible for determining whether a cybersecurity incident is material and requires current reporting pursuant to SEC Form 8-K Item 1.05 (Material Cybersecurity Incidents). In conducting the assessment, the team considers factors including but not limited to the probability of an adverse outcome; the potential significance of loss; the nature and extent of harm to individuals, customers, and vendors; the nature and extent of harm to our competitive position or reputation; and the possibility of litigation or regulatory investigations.


text: To ensure our cybersecurity programs adhere to industry best practices, we have adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework as a guide for our cybersecurity program. The NIST Cybersecurity Framework models the best practices for security and the capabilities needed to identify, protect, detect and respond to cybersecurity risks and events. In addition to the framework, we have a Security Action Committee comprised of the senior leaders of information technology, finance, and compliance that meets regularly to guide the evolution of our cybersecurity program, review potential incidents, and respond to trends in the cybersecurity landscape. We evaluate our physical, electronic and administrative safeguards on a continuous basis to ensure they are effectively deployed across the business. We also engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.


text: Despite the Company's security measures and programs, our information technology and infrastructure are susceptible to cybersecurity incidents, intrusions and attacks, any of which could have a materially adverse effect on our business, operating margins, revenues and competitive position. See "Part I—Item 1A. Risk Factors" for further discussion of these risks.


text: Our Board of Directors is responsible for the oversight of cybersecurity risks and threats. The Board has delegated certain information security and data privacy oversight to the Audit Committee of the Board. The Audit Committee oversees compliance with information security and data privacy laws and has oversight responsibility for cybersecurity risks related to accounting, audit and financial matters. The Audit Committee and management report to the Board on a periodic basis regarding our information security and data privacy functions, including any cybersecurity threats.


text: The Audit Committee is responsible for oversight of our cybersecurity policy, procedures and risk mitigation. Our information technology (IT) leadership briefs the Audit Committee and the Board of Directors on a periodic basis on information security matters, including the current cybersecurity landscape, progress on information security initiatives and accomplishments, and reports on material cybersecurity incidents, as needed.


text: The Audit Committee is responsible for reviewing our disclosures on cybersecurity risk management, strategy and governance in our Annual Report on Form 10-K. The Audit Committee assists in determining materiality for timely reporting of cybersecurity incidents and is notified immediately if the incident response team has assessed that a material event may have occurred that may require filing an SEC Current Report on Form 8-K.


text: The Chief Information Officer with the support from the Chief Executive Officer and Chief Financial Officer, assisted by our broader IT team, is responsible for setting the strategic direction and priorities for information security, coordination of enterprise-wide compliance with information security policies and procedures, as well as day-to-day information security management. Additionally, information security awareness trainings and testing are a compliance requirement for employees.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. We have a comprehensive cybersecurity policy hosted on our intranet for all employees, established to govern, guide and mitigate in the event of a cyber-attack. As a result, cybersecurity and data protection are key components of our long-term strategy.

companyName: TRIO-TECH INTERNATIONAL

ticker: TRT


text: Risks from Cybersecurity Threats We have not encountered any cybersecurity challenges that have materially impaired our operations or financial standing in Fiscal 2025 and Fiscal 2024.


text: Our Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Managing technology risks, including cybersecurity risks, is a fundamental part of the Company's risk management framework and processes. We employ a variety of processes, risk assessments, and controls to assess, identify, and manage these risks and have developed and maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. The program is one component of our enterprise risk management system. The technical, administrative and physical controls underlying our program are based on nationally recognized practices and standards for cybersecurity. Trusted partners are an important part of our cyber risk management program. We partner with service providers to conduct periodic risk assessments and to monitor and maintain the performance and effectiveness of security controls used in our environment.

companyName: INTEGRATED BIOPHARMA INC

ticker: INBP


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees our management of enterprise risks, including cybersecurity risks. Members of the management team brief the Board of Directors and Audit Committee on the effectiveness of risk management efforts on an annual basis.


text: Our cyber risk management program helps mitigate risks that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Security breaches and other disruptions could compromise our information and expose us to liability, and could cause our business and reputation to suffer.


text: As of the date of this Annual Report on Form 10-K we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. However, despite our best efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents. See "Risk Factors" in Item 1A in this Annual Report on Form 10-K for further discussion.


text: Cybersecurity Risks We rely on internal and third -party information technology systems and networks to process, transmit and store electronic information in our operations, including our proprietary business information and that of our customers, suppliers and employees. We use various internal and third -party information technology systems and networks to manage our operations and maintain effective internal control over financial reporting. We also collect and store sensitive data, including intellectual property, proprietary business information and personal information of our customers, suppliers and employees, in our data centers and on our networks. The secure operation of these information technology systems and networks, and the processing and maintenance of this information, are critical to our business operations and strategy.

companyName: AYTU BIOPHARMA, INC

ticker: AYTU


text: Despite our security measures, our internal and third -party information technology systems and networks may be subject to damage, disruption, or unauthorized access due to a variety of factors, including cyber-attacks by computer hackers, computer viruses, ransomware, phishing, denial-of-service attacks, physical or electronic break-ins, employee error or malfeasance, power outages, natural disasters, or other catastrophic events. Any such damage, disruption, or unauthorized access could compromise our internal and third -party networks and the information stored there could be accessed, publicly disclosed, lost, or stolen. Any such access, disclosure, or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations, damage to our reputation, loss of customers, potential harm to our competitive position and additional costs to remediate the issue.


text: Cybersecurity Practices We have implemented various measures to manage our risk of information technology systems and networks damage, disruption, or unauthorized access, including regular employee training, monitoring of our systems and networks, maintenance of backup and protective systems and use of modern endpoint detection and response tools, which are integrated into Aytu's risk management systems and processes. We have implemented multi-factor authentication ("MFA") across many of our systems and email accounts to prevent unauthorized access and impersonation. We also utilize a cloud-based environment for a large portion of our operations, which enhances our scalability, flexibility and resilience and utilize third parties to perform early external vulnerability assessment and risk identification. We have established extensive backup and recovery procedures to ensure the continuity of our operations in a cyber incident. We also maintain cyber liability insurance coverage as part of our comprehensive risk management program. However, these measures may not be sufficient to prevent, detect, or mitigate the impact of such damage, disruption, or unauthorized access. Moreover, the regulatory environment related to information security, data protection and privacy is increasingly demanding and complex, and compliance with applicable laws and regulations may result in significant costs or require changes in our business practices that could adversely affect our operations.


text: Cybersecurity Governance Our Board of Directors is actively involved in overseeing our cybersecurity risk management. Our Board of Directors delegates certain oversight functions to our Audit Committee, which reviews our cybersecurity policies, procedures, controls and audit results. Our Audit Committee receives quarterly updates on our cybersecurity posture, threats and incidents from Aytu's management. Our Board of Directors and our Audit Committee regularly assess the adequacy of our cybersecurity risk management framework and the effectiveness of our mitigation strategies.


text: Our cybersecurity operations are led by our Chief Financial Officer. He is responsible for overseeing the development and implementation of our cybersecurity strategy, policies, standards and practices. He also oversees our cybersecurity team, which includes a staff member who has over 20 years of experience in the field. Our cybersecurity team monitors, detects, responds and reports on cybersecurity threats and incidents, and coordinates with our internal and external stakeholders to ensure the security of our information assets.


text: Aytu adheres to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0, which provides a set of standards, guidelines and best practices to manage cybersecurity-related risks. We have developed and documented our systems disaster recovery plan, which outlines the roles, responsibilities and procedures for restoring our critical systems and data in the event of a cyber incident. We have also crafted internal policies to help maintain a secure environment, such as our information security policy, our data classification policy, our incident response policy and our password policy. We regularly conduct phishing simulations, vulnerability scans and audits to test the effectiveness of our controls and backups, and to identify and remediate any gaps or weaknesses in our cybersecurity posture.


text: Cybersecurity Incidents Despite our efforts to prevent and mitigate cybersecurity incidents, we cannot guarantee that we, or third -party providers that we rely on, will not experience any breaches, disruptions, or unauthorized access to our information technology systems and networks. During fiscal 2025, we did not experience any cybersecurity incidents that materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, however, there can be no assurance that the measures we have taken to address IT and cybersecurity risks will prove effective in the future. For additional discussion of the IT and cybersecurity risks facing our business, please refer to Part 1, Item 1A, Risk Factors of this Annual Report.


text: We prioritize investment in cybersecurity risk management and governance. We continually assess the adequacy of our resources and capabilities to address emerging threats, regulatory requirements and changes in technology. As cybersecurity threats evolve, we may need to further enhance our processes and technologies, which could require additional financial resources.


text: Risk Management and Strategy As part of our overall enterprise risk management function, we have implemented and currently maintain various information security processes designed to identify, assess and manage material risks related to information technology, including cybersecurity threats to our critical computer networks, third-party hosted services, and our critical data, ("Information Systems"). Our Information Systems risk management process evaluates and mitigates cybersecurity risks in alignment with our business objectives and operational needs.

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: We periodically engage third -party consultants and service providers to obtain an independent assessment regarding internal efforts to prevent threats to our Information Systems. Continuous vigilance over safeguarding the Company's Information Systems has resulted in our current approach and these assessments are shared with our Audit Committee.


text: To mitigate the occurrence of an incident as defined by the Company's formal documentation, which classifies and defines the properties of potential threats, the Company has in place a host of defenses which include, but are not limited to, the use of gateway consoles in all our global locations, limited access to key Information Systems from in-office networks or VPN with multi-factor authentication by means of a third -party mobile identity management tool to limit access to authorized users.


text: Internally to manage potential cybersecurity threats, we have established an Incident Response Plan that is designed to control the workflow of a reported incident. This plan formalizes incidence response stages such that reporting, identification, scope, response, and recovery are executed in a timely manner and identifies the order and coordination of internal and external communication. In addition, the Company addresses crisis management and business continuity with respect to Information Systems to ensure reliable redundancy and recovery of backed-up databases.


text: Management is not aware of any material security breaches on its Information Systems and risks from cybersecurity threats have not previously materially affected us. Certain of our vendors have experienced cyberattacks in the past and the threat and development of cyberattacks is continuous. It is impossible to say with certainty whether the Company's efforts will prevail in a coordinated attack on its Information Systems. Currently we expect the risks from cybersecurity threats will continue, but are not reasonably likely to materially affect us mostly due to our profile and not because our defenses are impenetrable or the efforts of criminals will not become more sophisticated. A cybersecurity attack on our systems could have a material negative impact upon our business, results of operations or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."


text: Role of the Board The Audit Committee of our Board of Directors (the "Board") has the responsibility for the oversight of risk management, including those risks related to cybersecurity. The Board holds strategic planning sessions with senior management to discuss strategies, key challenges, risks and opportunities for mitigation. The involvement of our Board in setting our business strategy is a key part of its oversight of risk management, its assessment of management's appetite for risk, and its determination of what constitutes an appropriate level of risk for us. Our senior management attends meetings of our Board and its committees on a quarterly basis, and management communicates with the Board and its members regularly between Board meetings as otherwise needed and are available to address any questions or concerns raised by our Board on risk management and any other matters.


text: Role of Management Our senior management, with the oversight of the Board, is responsible for the day-to-day management of the material risks the Company faces, including those related to cybersecurity. We believe it is important to work at all levels of the Company's hierarchy to manage cybersecurity risks and threats. Therefore, all users must use an online IT ticketing system, which is monitored around the clock, to report any incidents. Qualified individuals in IT determine what resources to allocate to each case and escalation of an incident, if deemed necessary. The Systems Administrators and IT Director, who has more than 18 years of experience with the Company, communicates on a day-to-day basis with the Chief Financial Officer, and President/Chief Operating Officer who would bring any material cybersecurity issues to the attention of the Company's Chief Executive Officer, the Audit Committee, and the Board.


text: We recognize the importance of cybersecurity in safeguarding sensitive information, withstanding and recovering from adverse events, and protecting stockholders' interests. We currently manage cybersecurity risks by utilizing basic security protocols, such as network monitoring and access controls. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes that are designed to ensure such potential cybersecurity risks are monitored, putting in place reasonable appropriate mitigation measures and maintaining cybersecurity programs. Any significant incidents are reported to the board of directors, however the board of directors does not have a designated cybersecurity committee. During the fiscal year ended June 30, 2025, we have not identified any indication of a cybersecurity incident that would materially affect our business.

companyName: MOVING iMAGE TECHNOLOGIES INC.

ticker: MITQ


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. To this end, our processes are designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems (including such risks associated with the use of any third -party service providers) that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by third -party experts under supervision of management, and, where necessary or desired, include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. We also consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: ReposiTrak, Inc.

ticker: TRAK


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our processes and resources are also designed to help enable us to actively identify, protect, detect, respond to, and recover from risks and threats. Nevertheless, we face certain ongoing cybersecurity risk threats that, if realized, are reasonably likely to materially affect us. As of the date of this report, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition.


text: Third-party experts assist our senior management team in assessing and managing material risks from cybersecurity threats. All employees and consultants are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly discussions with our senior officers and independent registered accounting firm.


text: Risk Management and Strategy As a component of and integrated into our overall risk management strategy and system, we maintain a cybersecurity risk management program designed to assess, identify, manage and protect our information systems and data from unauthorized access, use, disclosure, disruption, modification or destruction. Our program is based on applicable industry frameworks and standards, including those provided by the National Institute of Standards and Technology, and is comprised of core functions to identify, protect, detect, respond to and recover from cybersecurity threats and events. We constantly monitor cybersecurity threats and test the performance and effectiveness of our cybersecurity program, with the assistance of third-party experts, on an annual and ongoing basis. We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments. As described in "Item 1A. Risk Factors" in this Form 10-K, we are subject to risks from cybersecurity threats that could have a material adverse impact on our business and financial results. As of the date of this report, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business, results of operations, financial condition and cash flows.

companyName: INSTEEL INDUSTRIES INC

ticker: IIIN


text: Our Information Services Department manages our cybersecurity risk management program which is overseen by the Vice President of Information Services. The Vice President of Information Services has a master's degree in business administration with a focus on technology and has decades of professional experience in cybersecurity threat assessments and detection, applicable technologies, incident response and employee training. Our Information Services Department includes a team of experienced professionals who have developed an Incident Response Policy that is regularly reviewed and updated. The Incident Response Policy establishes the required steps to assess, respond to and limit the impact of an incident, details tactical and strategic team membership and points of contact related to the response process and provides for escalating notifications to senior executives, including the Chairman of the Board and Chief Executive Officer, depending on the severity of the threat.


text: The Board of Directors, having ultimate oversight of the company's cybersecurity risk, receives annual and periodic updates on the cybersecurity program, including those related to material risks and incidents, from the Vice President of Information Services and participates in discussions regarding cybersecurity risks. Cybersecurity information provided to the Board comprises a broad range of topics including, but not limited to, emerging cybersecurity threats, ongoing cybersecurity initiatives, incident reports and compliance with regulatory requirements, industry standards and relevant benchmarking. In addition to Board oversight, we provide mandatory quarterly employee training on how to identify, assess and manage risks from cybersecurity threats.


text: Our Senior Vice President of Information Technology manages our security program. Oversight of the program occurs via IT metrics-based updates provided to an Information Technology Steering team (consisting of the executive officers and other key employees of the Company) on a quarterly basis. Additionally, multiple elements of our cybersecurity security program are tested internally and externally on a bi-yearly basis in alignment with our Sarbanes-Oxley information security controls, and we engage independent third parties annually to assess the risks associated with our information technology assets. Our cybersecurity program is part of our enterprise risk management strategy and includes policies and procedures designed to safeguard the confidentiality, integrity, and availability of our information assets. Lastly, a cybersecurity risk assessment is provided to our Board of Directors on an annual basis which includes metrics, security incidents, key risk indicators, and risk mitigation plans as well as on the status of material risks, mitigation measures, and incidents related to such risks. Our Board of Directors has overall responsibility for risk oversight, with the Information Technology Steering team assisting the Board in performing this function based on its respective areas of expertise. As such, the Information Technology Steering team performs materiality determinations of cyber incidents and advises the Board of Directors accordingly.

companyName: GEOSPACE TECHNOLOGIES CORP

ticker: GEOS