text: The Company's Board of Directors is responsible for the oversight of management's efforts to address cybersecurity risks. The Board of Directors has designated the Audit Committee with the responsibility of overseeing and reporting to the Board on management's handling of cybersecurity risk management and on the adequacy and effectiveness of the Company's cybersecurity risk management strategy. Management also updates the Board on an on-going basis concerning any significant cybersecurity incidents or risk exposures that have come to management's attention during the conduct of their assessments, the steps management has taken to mitigate such exposures, and any changes to the processes of identifying, assessing, and monitoring cybersecurity threats. The Company's information security team is led by Dustin Woods, who has over 10 years of experience managing risks and advising on cybersecurity matters.


text: The Company faces various cybersecurity threats. The purpose of the Company's cybersecurity program is to assess, identify, manage and mitigate cybersecurity risk while supporting the achievement of the Company's business objectives.

companyName: NATIONAL PRESTO INDUSTRIES INC

ticker: NPK

secItem: Item 1C


text: Under the Company's comprehensive risk management program, the board of directors (the "Board") of the Company maintains oversight of the most significant risks facing the Company, including cybersecurity risks, while senior management is responsible for the identification and prioritization of risks that are material to the Company's business, corresponding risk-mitigation efforts and day-to-day management of the Company's risk management program. At least annually, the Board receives cybersecurity briefings from senior executives.


text: The Company's cybersecurity program sets the framework for the Company's approach to cybersecurity. Each business segment of the Company designates individuals with appropriate qualifications and experience to be responsible for addressing cybersecurity matters, including assessing, identifying and managing risks from cybersecurity threats, with a direct reporting line to senior management. Under the Company's approach to cybersecurity, each business segment designs and operates its own information and cybersecurity program tailored to its market, customer requirements, regulatory requirements and threats. The Company's cybersecurity policy and procedures are designed to ensure senior management receives timely and adequate information regarding cybersecurity matters, including threats and incident response, as appropriate to the matter.


text: As part of the Company's approach to cyber risk management, the Company performs internal audits of internal processes and controls relating to cybersecurity. Every year, the Company engages third-party experts to conduct cyber penetration testing. Based on their findings and recommendations, the Company makes the appropriate updates to its cybersecurity software.


text: Although the Company has designed its cybersecurity program and oversight to mitigate cybersecurity risks, the Company faces unknown cybersecurity risks, threats, and attacks. To date, these risks, threats or attacks have not had a material impact on the Company's operations, business strategies or financial results, but the Company cannot provide assurance that they will not have a material impact in the future. See Item 1A - Risk Factors above for additional discussion of various cybersecurity risks.


text: Risk Management Strategy As a financial institution, cybersecurity presents significant risks. Accordingly, the protection of customer and business information is taken very seriously. Cybersecurity risk management is a component of the Company's formal Information Security Program. The Information Security Program is incorporated into the Company's Enterprise Risk Management Program, ensuring a holistic approach to risk prevention, detection, mitigation, and remediation of cybersecurity threats.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: The Information Security Program is based on regulation and guidance established by agencies, including but not limited to, the Federal Financial Institutions Counsel ("FFIEC") and the Federal Deposit Insurance Corporation ("FDIC"). The Information Security Program begins with risk assessment. At least annually, the Company's Information Security team completes an information security risk assessment in accordance with regulatory guidance. While cyber threats are included in the overall information security risk assessment, a targeted cybersecurity risk assessment is also completed, utilizing the FFIEC Cybersecurity Assessment Tool ("FFIEC CAT"). The FFIEC CAT specifically assesses the maturity and effectiveness of the Bank's cybersecurity programs. In addition to the FFIEC CAT, the Bank partners with internal and external auditors to conduct various assessments throughout the year to identify, manage, and mitigate cybersecurity risks. The assessments conducted include but are not limited to: vulnerability assessments, penetration testing, social engineering, and onsite security assessments. Risk assessments consider size and complexity, are formally documented, and adapt to changes in the technology and organizational environment. Management and the Board of Directors use risk assessment data to make informed risk management decisions based on a full understanding of the risks. Management and the Board also consider the results of these assessments when overseeing operations. A strong, high-level risk assessment process provides the foundation for more detailed assessments within the functional risk management areas, as well as improves policy and internal control decisions across the organization.


text: Information Security Risk Assessment Information security controls result from an effective risk assessment process. The Company identifies, measures, controls, and monitors threats to avoid risks that threaten the safety and soundness of the organization. In accordance with the Gramm-Leach-Bliley Act (GLBA) and FDIC regulation 12 CFR Part 364 Appendix B III B, the objectives of the information security risk assessment include:


text: Identifying reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems. Assessing the likelihood and potential damage of these threats, taking into consideration the sensitivity of customer information. Assessing the sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risks.


text: Cybersecurity Risk Assessment Cybersecurity is an integral subset of information security and refers to anything intended to protect enterprises and individuals from intentional attacks, breaches, incidents, and consequences. The foundation of this protection begins with identifying the risk of these threats and assessing the controls in place to mitigate such risks. The Company has included cyber threats in its information security risk assessment in accordance with regulatory guidance and conducts a targeted cyber risk assessment using the FFIEC CAT. Utilizing the FFIEC CAT, the Company's inherent risk profile is documented along with its maturity level and effectiveness in managing cyber risk.


text: Both the Information Security Risk Assessment and the FFIEC CAT results are presented to, and approved by, the Audit Committee of the Board of Directors at least annually.


text: Risk Management Plan Once risk assessments are complete, a risk management plan is prepared to ensure controls are developed or enhanced to mitigate risks to acceptable levels. The Risk Management Plan is presented to, and approved by, the Audit Committee of the Board of Directors annually and progress on remediation activities is shared quarterly.


text: Information Security Program Vendor Management. The Company maintains a formally documented Vendor Management Program that includes an information security review of all new and existing third-party vendor relationships. The Vendor Management team ensures initial and ongoing due diligence is performed on all party relationships according to policy. Quarterly Vendor Management program updates are provided and the Policy is reviewed and approved annually by the Audit Committee of the Board of Directors.


text: Implementation of a multi-faceted threat intelligence gathering process. The Information Security and Information Technology teams subscribe to several threat intelligence news feeds and regularly attend cybersecurity threat intelligence webinars, trainings, and peer groups. Information on threat gathering is included in a quarterly report to the Board of Directors.


text: Implementation of a multi-layered defense strategy to fortify information protection. Technical, physical, and administrative control redundancies are deployed to ensure multiple layers of protection are in place against cyber threats. Control design and operating effectiveness is tested regularly by independent audit firms and reported to senior management and the Audit Committee of the Board of Directors.


text: Comprehensive security awareness training and testing for all bank employees. Various communication strategies to communicate new and existing cybersecurity threats are used. Employees receive regular virtual and in-person security awareness training through simulated tests, online training courses, company communications, and in-person training and testing events. Training and testing efforts are included in the quarterly update to the Board of Directors.


text: Incident Response. A comprehensive Incident Response Plan has been developed and tested. The Plan contains information for employees to ensure they can recognize, investigate, communicate, prevent, and document an incident that threatens the confidentiality, integrity, or availability of information or systems. All incidents are reported to, and the Plan is reviewed and approved by, the Audit Committee of the Board of Directors.


text: Independent Audit and Testing. The Company's Audit Department schedules and oversees a regular review of program design and effectiveness by independent third-party audit firms that specialize in technology and cybersecurity. Results are reported directly to senior management and the Audit Committee of the Board of Directors.


text: Remediation Tracking. Remediation and tracking sheets are developed for all audit and assessment results. Progress is monitored by the Audit Department and reported to the Audit Committee of the Board of Directors regularly.


text: The Company's Board of Directors provides active oversight of cybersecurity threats in accordance with the Board-approved Information Security Policy and Program. Direct oversight of the Program is delegated to the Audit Committee of the Board of Directors. The Audit Committee has an established risk appetite statement that defines the Company's risk acceptance tolerance. The Audit Committee reviews and approves the Risk Appetite statement annually. The Audit Committee also plays a critical role in overseeing the Bank's efforts to develop, implement, and maintain an effective Information Security Program. With direction and oversight by the Audit Committee, the Bank's Chief Risk Officer ("CRO") oversees the enterprise-wide risk management program, and the Chief Information Officer ("CIO") is the Board-appointed Information Security Officer, responsible for the Information Security Program, including cybersecurity. The CRO and CIO report cybersecurity related matters directly to the Audit Committee.


text: The Information Security team, engaged in enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes, ensures a complete approach to safeguarding the confidentiality, integrity, and availability of sensitive information. The Information Security team consists of experienced information security professionals and is led by the CIO. The CIO has more than 25 years of information technology and banking leadership experience and holds a Certified Information Systems Security Professional ("CISSP") designation. Reporting to the CIO is the Information Security Manager who has more than 10 years of cybersecurity experience in the Financial Institution industry and possesses a master's degree in information systems management with an emphasis in cybersecurity. Complementing the independent Information Security team, is the Information Technology (IT) team. The IT System Administration & Engineering Manager has over seven years financial institution technology experience and a master's degree in information systems management with a cybersecurity management specialization and the Systems Support Manager has over 20 years of financial institution technology experience, ensuring technology operations occur with a security-focused mindset. In addition to experienced information security and information technology teams, the Company engages with industry experts for managed security services. This collaborative effort includes threat intelligence gathering, firewall management, intrusion detection system monitoring, intrusion prevention services, and security information and event management monitoring, ensuring round-the-clock protection.


text: The Vendor Management team ensures compliance with the organization's Vendor Management Policy, including initial and ongoing due diligence of all third-party providers.


text: Risk assessments and risk management plans are developed, communicated, and tracked. Annually, the CIO presents the Information Security Risk Assessment to the IT Steering Committee and to the Audit Committee of the Board of Directors for review and approval. Quarterly, the CIO provides an Information Security Risk Management Plan status report to the Audit Committee and an Information/Cybersecurity Status report to the full Board of Directors. Reports encompass internal information and cybersecurity assessments, business continuity plans, disaster recovery measures, incident response planning and testing, patch management and vendor management program statuses, as well as internal self-audit results. The information security risk assessment and updates on projects aimed at fortifying information security systems and emerging cybersecurity threat insights are communicated to the Audit Committee, maintaining transparency, and ensuring informed decision-making. Annual review and approval of information security-related policies by the Audit Committee underscore our commitment to governance and regulatory compliance.


text: Audits and testing of program effectiveness are coordinated by the Company's Senior Vice President of Audit who oversees the Audit Department and reports to the Audit Committee of the Board of Directors, independent of the technology and cybersecurity functions. The Audit Department utilizes independent third-party audit firms with technology and cybersecurity expertise. Results of all audits and independent assessments are delivered directly to senior management and the Audit Committee of the Board of Directors by the SVP of Audit.


text: The Information Security team serves as the Bank's dedicated cybersecurity incident response team. Cybersecurity incident response is a sub-section of the Bank's Incident Response Plan. The Information Security team handles the technical aspects of the Bank's response to a cybersecurity incident. Escalation instructions are included in the Plan for engaging resources outside the Information Security team. The Board is notified immediately of cybersecurity incidents, as per the incident response instructions.


text: Cybersecurity Incidents As of the reporting period, the Company has not experienced any material cybersecurity events or incidents. Although third-party service providers have encountered cybersecurity events or incidents, these occurrences have not resulted in a material impact on our systems, computing environments, or data.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Cyclo Therapeutics, Inc.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Vice President of Finance, who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings integrated into new employee onboarding processes and annual employee re-training.


text: We engage consultants, experts, or other third parties in connection with our risk assessment processes. These third parties assist us in designing and implementing our cybersecurity policies and procedures, as well as in monitoring and testing our safeguards.


text: We require each third-party service provider who may have access to our systems and/or our sensitive data to confirm that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not experienced any cybersecurity incidents that have been determined to be material in the past, however, like other life sciences technology companies, we have experienced cybersecurity incidents and may continue to experience them in the future. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including, for example, the risk factor entitled " Our business and operations would suffer in the event of computer system failures or security breaches.."


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole.


text: Our Vice President of Finance and our management committee on cybersecurity, which includes our Chief Financial Officer and outside consultants, who collectively possess significant experience in evaluating, managing and mitigating security and other risks, including cybersecurity risks, are primarily responsible to assess and manage our material risks from cybersecurity threats.


text: Our Vice President of Finance and our management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Vice President of Finance and representatives from our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: monitoring of Company computer and information systems for potential malware, ransomware and other malicious activity, and remediation of identified issues, including mitigation of identified risks and containment and elimination of any malicious software; mandatory cybersecurity training as part of new employee onboarding along with required annual employee cybersecurity re-training; monitoring of systems and network infrastructure by security information and event management application;


text: prompt incident reporting directly to the Company's CFO l; and escalation to the Company's audit committee and board of directors as warranted based upon the nature of the identified issue.


text: Our Vice President of Finance and/or representatives from our management committee on cybersecurity provide periodic briefings to our Board of Directors regarding our Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Cybersecurity Risk Management and Strategy We have established certain processes for identifying, evaluating, and managing material risks from cybersecurity threats as a part of our overall technology management strategy. These processes are designed and reassessed on a periodic basis to help protect our technology assets and operations from internal and external security threats. We also engage with third parties, including consultants, to enhance our security processes.

companyName: AVENUE THERAPEUTICS, INC.

ticker: ATXI


text: We have previously engaged and currently engage third parties to assess the effectiveness of our cybersecurity and technology management strategy and continue to seek to implement new, and improve existing, processes regularly to adjust for changes in technology, internal or external threats, business strategy, and regulatory requirements. We, and our third parties, have deployed managed detection and response services to monitor our technology infrastructure and information systems for possible threats. Our technology management strategy also includes ongoing security training and education for employees regarding threats, including their role and responsibility in detecting and responding to such threats.


text: We review the processes of our third party vendors and consider their ability to adhere to relevant industry practices and maintain adequate technology risk programs. In addition, we maintain cyber and cyber-related crime insurance coverage policies as part of our overall risk management strategy, however, our policies may not be sufficient to cover against all potential future claims, if any.


text: In the last two fiscal years, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition. Although we proactively attempt to prevent all threats, we are unable to eliminate all risk from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A. Risk Factors "Our business and operations would suffer in the event of computer system failures, cyber-attacks, or deficiencies in our or third parties' cybersecurity".


text: Cybersecurity Governance While our Board of Directors is responsible for oversight and risk management in general, our Audit Committee provides oversight of our technology management strategy to ensure that cybersecurity threats and risks are identified, evaluated, and managed. The Audit Committee receives periodic updates from our management team regarding the overall state of our technology management strategy and any relevant risks from cybersecurity threats and cybersecurity incidents.


text: Our management team is responsible for assessing and managing the material risks from cybersecurity threats. Our management team members have expertise in information systems, compliance and corporate governance, which we believe are disciplines that are effective in the management of the Company's cybersecurity risk. Our management team is informed of and monitors the prevention, detection, and mitigation of cybersecurity threats and incidents.


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a security incident at a third-party vendor or customer, including assessment and monitoring of security standards and control procedures for external suppliers and vendors, with enhanced engagement or internal controls depending on the results of the assessment.

companyName: Aterian, Inc.

ticker: ATER


text: Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions. As part of our risk management process, we conduct application security assessments, vulnerability management, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually. We have a unified and centrally coordinated team, led by our Chief Technology Officer and our General Counsel, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at Aterian in close coordination with senior leadership and other teams across Aterian. In addition to our in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. These third parties also consult on best practices to address new challenges upon request. Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our risk assessments that are reviewed by the Audit Committee and our Board of Directors. As of the date of this report, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Despite the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company or its stakeholders.


text: Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "Risks Related to Information and Cyber Security," which should be read in conjunction with the information above. The Audit Committee, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. The Audit Committee receives reports regarding such risks from management, including our Chief Technology Officer, and reports to the Board at least quarterly. The Audit Committee also oversees the Board's response to any significant cybersecurity incidents. Our Chief Technology Officer, who has extensive cybersecurity knowledge and skills gained from over ten years working in the technology industry, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at Aterian, working closely with our General Counsel who has a certification in Data Security and Privacy Policy from Cornell University. Both our Chief Technology Officer and General Counsel report directly to one of our co-CEOs.


text: Cybersecurity Risk Management and Strategy The Company recognizes the risks posed by cybersecurity threats, including the risk of harm to our customers, our financial condition and results of operations, and our reputation. Following a layered defense-in-depth strategy, the Company utilizes a variety of controls and both internal and third-party resources to assess and manage identified risks. The following components of our information security program address cybersecurity risk management, and have been integrated into the Company's overall risk management systems and processes:

companyName: NATIONAL BANKSHARES INC

ticker: NKSH


text: Cybersecurity risks are identified and prioritized for resource allocation using two annual risk assessments: an internal risk assessment utilizing the Federal Financial Institutions Examination Council's ("FFIEC") Cybersecurity Assessment Tool, and a formal risk assessment prepared in conjunction with an external consultant.


text: A comprehensive set of security technologies constantly monitor our information systems and data, including endpoint detection and response services, intrusion detection and prevention, various filtering technologies, and event correlation technologies that alert management to potential cybersecurity threats.


text: Skilled internal personnel manage and update cyber defense functions including engineering, configuration, data protection, identity and access management, security operations, and threat intelligence. Training programs continuously educate employees about cybersecurity risks and protection practices. Periodic social engineering testing assists management in identifying training needs.


text: An incident response plan outlines the Company's response to a cybersecurity incident. Periodic testing of the plan ensures readiness and identifies refinements. Reputable third-party assessors are engaged to conduct various assessments on a regular basis.


text: Supporting the Company's information security program is a third-party risk management program that manages the life cycle of external service providers and ensures that vendors meet the Company's cybersecurity requirements. This includes a periodic risk assessment of vendors and the review of vendor assessment documentation including audit reports and other independent control assessments.


text: The Company's cybersecurity risk management and strategy are regularly reviewed and updated to support our business strategy and objectives, our overall risk management, and address evolving potential cybersecurity threats.


text: Material Effects of Cybersecurity Threats Cybersecurity risks have the potential to materially affect the Company's business, financial condition and results of operation. The Company strengthened its cybersecurity framework in response to cyber attacks in 2016 and 2017 and does not believe that risks from cyber security threats or attacks have materially affected the Company since 2017. However, the sophistication of emerging cyber threats and the utilization of new attack methods continues to evolve. The Company's cybersecurity risk management and strategy may not protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors of this Form 10-K.


text: Board of Directors Oversight The Company's Board of Directors is charged with overseeing the establishment and execution of the Company's enterprise risk management framework, including cybersecurity risk, and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. The Company's Information Security Officer ("ISO") provides the Board Risk Committee with regular updates on information security risk management and an annual comprehensive information security status report, which assesses the effectiveness of the program and updates the Risk Committee on developing trends and emerging threats.


text: Management's Role The Company's ISO, supported by skilled internal personnel, is responsible for identifying, assessing and managing cybersecurity risks and designing, implementing and maintaining the Company's information security program. The ISO has many years of experience and holds multiple certifications appropriate to the role. The ISO reports to the Senior Vice President/Sr. Operations, Risk & Technology Officer and the Board of Directors. Management's enterprise risk management committee receives regular updates from the ISO on cybersecurity related risks, including trends and emerging threats.


text: Cybersecurity Risk Management and Strategy The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and has integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our information technology department continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs.

companyName: HMN FINANCIAL INC


text: Because of the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage their specialized knowledge and insights, ensuring our cybersecurity strategies and processes are appropriate. Our collaboration with these third parties includes ongoing system penetration testing, regular audits, threat assessments, and consultation on security enhancements.


text: Because the Company is aware of the risks associated with third-party service providers, management implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure they meet our cybersecurity standards.


text: We are not aware of any previous cybersecurity incidents which have materially affected, or are reasonably likely to materially affect, us to date, including our business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition.


text: The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and is composed of members with diverse expertise including, risk management, technology, and finance, allowing them to effectively oversee cybersecurity risks. The Director of Information Technology (DIT) plays a pivotal role in informing the Board on cybersecurity risks. He provides comprehensive briefings to the Board on a quarterly basis which include updates on the results of vulnerability testing, status of software patching installations, results of business continuity exercises, a summary of recent cybersecurity events/articles, and an update on third-party consultant activities. In addition, our external consultants meet with the Board on an annual basis to update them on the results of their reviews.


text: Risk Management Personnel Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with the DIT, Mr. Roberts Hoenisch. With over 30 years of experience in the information technology field, Mr. Hoenisch brings a wealth of expertise to his role. He, in conjunction with his staff and external consultants, oversees our governance programs, tests our compliance with standards, remediates known risks, and implements our employee training program.


text: Monitor Cybersecurity Incidents The DIT is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The DIT, along with his staff and third party consultants, implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the DIT is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors The DIT, in his capacity, regularly informs the Chief Financial Officer (CFO) and Chief Executive Officer (CEO) of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, any significant cybersecurity matters, and strategic risk management decisions would be escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Plumas Bancorp maintains a cyber risk management program that is designed to prevent, detect, and respond to information security threats. The Board of Directors is responsible for oversight of the Company's information security program, which is designed and implemented by management under the direction of the Chief Information Officer. In addition, the Internal Auditor and Risk Management Officer consider cybersecurity threat risks alongside other company risks as part of our overall risk assessment and management process.

companyName: PLUMAS BANCORP

ticker: PLBC


text: The Chief Information Officer supervises the information security team, which is responsible for maintaining and implementing our enterprise-wide cybersecurity strategy, policy, standards, and architecture processes. The Information Security Officer, in coordination with compliance and human resources, conducts annual and ongoing company-wide information security awareness training. The Chief Information Officer and Information Security Officer have combined over 35 years of IT management experience. We have developed processes to identify and oversee risks from cybersecurity threats associated with third-party service providers, which include the information security team assessing cybersecurity robustness during vendor onboarding, the inclusion of protective provisions in vendor agreements, and risk-based monitoring of vendors on an ongoing basis.


text: The Board of Directors receives regular reports from the Chief Information Officer and the Information Security Officer on Plumas Bancorp's cyber risks and threats, the status of projects to strengthen Plumas Bancorp's information security systems, assessments of Plumas Bancorp's security program, and the emerging threat landscape. Additionally, the Chief Information Officer chairs the Technology Steering Committee, which drives awareness, ownership, and alignment across all business functions for effective cybersecurity risk management and reporting. In addition to conducting internal audits, Plumas Bancorp annually engages third parties to audit its information security programs, whose findings are reported to the Audit and Executive Committees of the Board. The Company also engages with key vendors, industry participants, government agencies, and intelligence and law enforcement communities as part of our efforts, which are reported to the Technology Steering Committee and Board of Directors.


text: The Company has experienced and expects that it will continue to experience cyber-based attempts to compromise its information systems, although none, to its knowledge, has had a material adverse effect on its business, financial condition, or results of operations. Like all financial institutions, the Company faces the risks of such threats, the consequences of which could be material. See Item 1A – Risk Factors – "Cybersecurity breaches and technological discussions could damage our reputation and profitability," above. In addition, given the constant and evolving threat of cyber-based attacks, the Company incurs significant costs in its efforts to detect and prevent security breaches and incidents, and these costs may increase in the future.


text: We maintain a cybersecurity risk management program and related policies and processes to identify, assess and manage material risks from cybersecurity threats. Our program includes working groups responsible for the monitoring of and response to threats. Security workgroups assess and monitor risk posture by continuously evaluating IT infrastructure, deploying security information and event management software tools, and enforcing an assortment of other IT security controls. We communicate regularly with partner contractors and agencies to support risk management, threat monitoring, and incident response efforts.

companyName: FIREFLY NEUROSCIENCE, INC.

ticker: AIFF


text: Our Tellenger subsidiary engages consultants for security assessments and quality system reviews to provide feedback on existing processes and recommend improvements. Additionally, Tellenger has completed numerous assessments for contract and Federal compliance of our internal systems and the systems we work on.


text: To date, cybersecurity threats have not materially affected our Company, including our business strategy, results of operations or financial condition. We are unaware of any ongoing or previous cybersecurity incidents.


text: The Chief Executive Officer, with assistance from other members of management, is responsible for managing our cybersecurity program, policies and strategy. Our Board of Directors is responsible for overseeing the management of cybersecurity risks, including the review of, as required, our processes around the management and monitoring of such risks.


text: The Bank, as part of its risk management process, has implemented an information security program that encompasses the Bank's cybersecurity efforts. The Bank's goals of confidentiality, availability and integrity of its information are key to this process and program. The Bank's goals of protecting confidential information and safeguarding our digital assets are foundational objectives of the program.

companyName: PEOPLES FINANCIAL CORP /MS/

ticker: PFBX


text: The Boards of Directors of the Company and Bank and the Audit Committee of the Company are responsible for ultimate oversight of cybersecurity risks managed daily by management pursuant to the Bank's information security program. The Boards of Directors of the Bank and Company annually approve this information security program and regularly receive a report from the Bank's Information Security Officer that outlines the steps undertaken to protect the information and data assets of the Bank and Company. Additionally, the Information Security Officer updates the Boards of Directors of the Bank and Company monthly through supplementary reports on issues related to Cybersecurity readiness.


text: The Bank's information security program is developed and implemented by the Bank's Information Security Officer. Together with an Information Security Committee comprised of relevant information technology and business unit stakeholders within Bank management, the Information Security Officer of the Bank works to manage, control and mitigate cybersecurity risks. The Bank's employees are regularly trained on cybersecurity awareness, and testing is performed to monitor the success of the training. The Board of Directors of the Company and the Bank receive training on an annual basis.


text: The Bank engages trusted third parties to audit and examine its processes, review the security of its network infrastructure, and assist the Bank in designing and implementing robust cybersecurity systems. These trusted third parties help the Bank and the Company improve and test their cybersecurity readiness. The Bank engages third party vendors to monitor and test its network infrastructure. These third-party vendors take an active role in ensuring that the Bank's systems are protected by testing, reviewing and advising the Bank to strengthen cybersecurity controls when necessary.


text: The Bank has a vendor oversight risk management process that helps to validate the security and integrity of information collected and maintained by third party vendors that the Bank uses to provide banking services. A key goal of the Bank's vendor management program includes assessing risks, which include but are not limited to operational, strategic, reputational, cyber, and credit risks. These processes are supported by specialized vendors that assist the Bank's management and Board of Directors with properly assessing these risks. Finally, the Bank also has an incident response and business continuity program that is intended to address operational concerns, including cybersecurity risks, during contingency scenarios that may create unknown circumstances. This program is tested annually.


text: Although the Company and Bank have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected their business strategy, results of operations or financial condition, there can be no guarantee that the Company or Bank will not experience such an incident in the future.


text: As regulated financial institutions, the Company and Bank are also subject to financial privacy laws and their cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Regulation and Supervision –Cybersecurity" included in Part I. Item 1 – Business of this report.


text: The Company recognizes the critical importance of identifying, assessing and managing material risks from cybersecurity threats and is committed to implementing and maintaining a comprehensive information security program to manage such risks and safeguard its systems and data.

companyName: MainStreet Bancshares, Inc.

ticker: MNSB


text: The Company's Board of Directors has ultimate oversight of cybersecurity-related risks and it is assisted in this role by the Technology Committee and the Audit & Risk Committee. Processes for identifying, assessing, and managing cybersecurity-related risks are integrated into the Company's overall enterprise risk management process, which is overseen by the Audit & Risk Committee. The Audit & Risk Committee is responsible for monitoring risks that are being taken by the Company, understanding the enterprise-wide effect of those risks and reporting such risks to the Board. In fulfilling this role, the Technology Committee has primary oversight responsibility over management's efforts to manage and mitigate cybersecurity-related risk and reviews and approves the Company's cybersecurity strategy for protecting the Company's information assets and technology platforms. The Audit & Risk Committee oversees the Company's Internal Audit Department, which conducts reviews and assessments related to information security. Management provides periodic reports to the Technology Committee and the Audit & Risk Committee, both of which provide reports of their meetings to the full Board. These reports to the Board and its Committees address the threat environment, vulnerability assessments, specific cyber incidents and management's efforts to monitor, detect and prevent cyber threats.


text: The Company's information security program is primarily administered at the management level by the Information Security Department, which is led by the Company's Chief Information Officer (CIO), and is supported by Chief Information Security Officer (CISO), and the Information Technology Department, which is led by the Company's Chief Technology Officer (CTO). The Company's Information Security Department is responsible for day-to-day management of the Company's information security program, including data loss prevention, access control, threat monitoring, incident response and employee education and training. The Information Security Department also maintains policies related to cybersecurity and data security that provide the required governance for the information security program. Additionally, the Company's Information Technology Department maintains policies that govern technical aspects of the Company's information security program. Each policy is reviewed and approved by the Board at least annually. The Information Security team maintains and runs the Company's security operations center and is responsible for cybersecurity event management and maintaining security tooling. The Company also maintains an Information Technology Management Committee, which is comprised of representatives from the Information Security, Information Technology, Enterprise Risk, Operations, and members of executive management. This committee meets at least quarterly to discuss and review the Company's information security program and receives qualitative and quantitative update reports from the Information Security Department, Internal Audit Department, and Information Technology Department.


text: The Company engages third party assessors, consultants and auditors in connection with its information security program, including to conduct external penetration testing, independent audits and risk assessments. The Company also utilizes third party service providers in the ordinary course of business. The Information Security Department performs information security assessments for third party service providers that store or process Company confidential data. These information security assessments include a review of any systems and organization control reports, proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes and third party data protection controls (which can include, but is not limited to: access reviews and controls, backups, monitoring, encryption standards and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.


text: As a regulated financial institution, the Company is also subject to financial privacy laws and its cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see Item 1A – Risk Factors.


text: Although the Company has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that the Company will not experience such an incident in the future.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a process for overseeing and managing cybersecurity and related risks. This process is supported by both management, as well as our Board of Directors and our Science and Technology Committee. The current chair of our Science and Technology Committee is a NACD certified cybersecurity expert.

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually.


text: Our Science and Technology Committee specifically assists the Board in its oversight of risks related to cybersecurity. To help ensure effective oversight, the Science and Technology Committee receives reports on information security and cybersecurity from the Company's information technology managers at least four times a year.


text: Multi-Layered Defense and Continuous Monitoring – We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. We engage third-party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats.


text: Third-Party Risk Assessments – We conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties.


text: Training and Awareness – We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access participate periodically in required training, including phishing, spear phishing and other security and awareness training.


text: Supplier Engagement – We review critical third-party systems at least annually, including the various System and Organizational Controls ("SOC") reports or perform risk assessments.


text: While we have experienced cybersecurity incidents in the past, to date none have materially affected the Company or our consolidated financial position, results of operations and/or cash flows. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."


text: Risk Management and Strategy Because it is essential to our operations and business strategy that our website, technology and network infrastructure remain secure, we have processes in place for assessing, identifying, and managing material risks from cybersecurity threats. We have integrated these processes into our cybersecurity risk management program.

companyName: Avinger Inc


text: The key processes, or components, of our cybersecurity risk management include: conducting periodic risk assessments to assist in identifying cybersecurity threats or risks; cybersecurity strategic roadmap;


text: security and IT infrastructure management team, responsible for managing our cybersecurity processes, implementing security applications and protocols, monitoring and executing security or network controls, and responding to incidents or threats; cybersecurity training programs and cybersecurity awareness events for employees; incident response plan, including assessing and monitoring potential cyber threats; similar processes or applications to mitigate or manage cybersecurity risk from third-party service providers;


text: We sometimes engage external cybersecurity experts, or applications, to enhance our cybersecurity program. These serve to assist our internal cybersecurity team in mitigating cyber threats, in addition to monitoring and responding to potential cyber incidents.


text: Additional information regarding risks from cybersecurity threats is discussed in Part I, Item IA, "Risk Factors," under the heading "If our technology infrastructure is compromised, damaged or interrupted by a cybersecurity incident, data security breach or other security problems, our operating results and financial condition could be adversely affected," which should be read in conjunction with the information herein.


text: Cybersecurity risk management is an important priority integrated into our overall governance structure. Our Board of Directors oversees risks from cybersecurity threats and includes the involvement of the Audit Committee in the governance strategy.


text: Our IT security management team, led by certain key functional leaders in our organization, who reports quarterly in meetings to our Audit Committee and periodically to our Board of Directors regarding updates to our cybersecurity program and related risks. Topics in the meetings include discussion of the company-wide risks, protocols to mitigate such risks, and the progress of initiatives in the cybersecurity program. Specific cybersecurity briefing areas may include topics such as security, infrastructure, cybersecurity tooling/applications, and compliance.


text: Cybersecurity Risk Management and Strategy We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our critical systems and information. While everyone at our company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by our Board of Directors and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.

companyName: CREATIVE REALITIES, INC.

ticker: CREX


text: Our cybersecurity risk management program includes: physical, technological, and administrative controls intended to support our cybersecurity and data governance framework, including protections designed to protect the confidentiality, integrity, and availability of our key information systems and customer, employee, partner, and other third-party information stored on those systems, such as access controls, encryption, data handling requirements, and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices;


text: a defined procedure for timely incident detection, containment, response, and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents;


text: cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services, and broader enterprise IT environment; cybersecurity awareness training of our employees, incident response personnel, and senior management; a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents;


text: the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls; and.


text: annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information, such as consumer information.


text: Over the past fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents we have experienced from time to time, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material adverse effect on our operations, business strategy, operating results, and financial condition. For more information regarding cybersecurity risks that we face and potential related impacts on our business, see the section titled " Risk Factors " in Part I, Item 1A of this Report.


text: Board Governance Our full Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Our management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risks, including cybersecurity risks, and any actions management has taken to limit, monitor or control those risks. The Board of Directors receives briefings from management periodically on our cyber risk management program and presentations on cybersecurity topics as part of the Board of Directors' continuing education on topics that impact public companies.


text: Risk Management and Strategy The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: CORETEC GROUP INC.

ticker: CRTG


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, the Company implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the SOC reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: General Overview Information, including but not limited to proprietary information and personally identifiable information, is one of the Company's most important assets. Protection of our information assets is necessary to establish trust with our clients, fulfill our fiduciary responsibilities, maintain regulatory and legal compliance, and protect our reputation.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: Our Information Security Program outlines the process of protecting and securing our digital systems that contain and process information vital to our operations. Our cybersecurity management program is a subset of our larger Information Security Program. It provides protection of both client and bank information by preventing, detecting, and responding to cyber-attacks, managing vulnerable access points, practicing active governance, and adhering to risk and compliance regulations. Both programs are managed by our Chief Information Officer ("CIO") who reports directly to the Company's Chief Executive Officer ("CEO") and both are overseen by the Board's Information Technology ("IT") Committee and Audit Committee.


text: The Company has established an information security culture that promotes and communicates the role of all employees in protecting the Company's information and systems. The program defines information security responsibilities and accountability throughout the organization. We communicate these responsibilities to employees upon hiring and regularly throughout employment.


text: We have established policies and procedures, including our Incident Response Plan ("IRP") for identifying and assessing potential threats, responding to cybersecurity incidents and security breaches, informing executive leadership and the Board, and reporting incidents within the approved timeline adopted by the FDIC in 2021 and the Securities and Exchange Commission in December 2023. In addition, the Company complies with the following reporting requirements: FDIC Computer-Security Incident Notification Rule; State statutes and laws regarding cybersecurity; Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA); All other applicable regulations.


text: In order to provide proper management of cybersecurity risk, management has committed to the following plan: (1) foster an environment that values cybersecurity initiatives in order to accomplish business and operational goals; (2) review and update the cybersecurity program on an annual basis; (3) perform a cybersecurity risk assessment on an annual basis requiring that the performance of the assessment meets standards set forth by the Federal Financial Institutions Examination Council ("FFIEC") guidelines and external auditors; (4) foster awareness and training for all employees; (5) enlist additional support of third-party experts in the event of cybersecurity incidents; (6) subscribe to cybersecurity forums where information is distributed; (7) monitor and respond to cybersecurity threats and alerts; (7) review and update the business continuity plan, IRP, and vendor management plan, focusing on cyber-resiliency and third-party management of cyber activities; and (8) keep the Audit Committee, IT Committee and Board informed on the status of cybersecurity.


text: On an annual basis the Company's IT Committee and Board will review and approve the information security and cybersecurity program, review and approve the business continuity plan and testing, and approve the risk assessment guidelines and methodologies.


text: Enterprise Risk Management Our policies and procedures related to Cybersecurity are a vital component of the Company's enterprise risk management program ("ERM") which is managed by the Company's Chief Risk Officer ("CRO") and is overseen by Audit Committee. Our ERM program includes periodic activities to assess cybersecurity risks that could result in material disruption to the Company such as data breaches, malfunction of critical systems to operate key banking functions, "information hostage" incidents, and interference with key vendor programs. Any cybersecurity risks identified are tracked through the ERM program and their assessments are assigned risk owners at the senior leadership level.


text: Cybersecurity training is a key component of annual employee training and is conducted through the year utilizing different methods such as training sessions with the CIO, on-demand third-party cybersecurity and phishing exercise campaigns, and periodic third-party-conducted social engineering testing.


text: Third Party Service Providers The Bank has implemented a third-party management policy (Vendor Management Policy) within the Information Security and Cybersecurity Program which requires due diligence and consideration of cyber risk prior to contract signing. As deemed necessary, vendors identified within the program are reviewed at least annually, and in-depth reviews of critical vendors are documented and presented to management as needed. The overall program is presented to the Board of Directors each year.


text: The Board and IT Committees oversee the responsibility in developing, implementing, and maintaining the information security program and cybersecurity program, and hold senior management accountable for its actions. To accomplish this, the Board maintains a reasonable understanding, and is informed through Committee minutes and Board meetings. The Board of Directors receives annual training on cybersecurity and information security.


text: The IT Committee has direct oversight responsibilities for our cybersecurity program and receives reports on the Company's cybersecurity program from our CIO at each of our regular meetings which occur quarterly. These reports include analyses of any recent cybersecurity threats and incidents at the Company and across the industry, along with a review of internal controls, risk mitigation strategies and third-party service providers. At least annually, the Board of Directors receives reports on the Company's cybersecurity program and a briefing of recent developments from the CIO. Our senior executive management team is actively engaged in the oversight of our cybersecurity program and its future strategy.


text: The CIO has been with the Company since 2011 and in the banking industry since 2002 holding various positions in operations, compliance and information technology. He has a background in software programming and hacking/intrusion and holds various certifications and designations such as Certified Information Systems Security Professional, Certified Data Privacy Solutions Engineer, Certified Regulatory Compliance Manager, Accredited ACH Professional and others in technology, security, risk, and compliance. The CIO has a Bachelor of Science in Electrical Engineering and a Master of Science in Cybersecurity and Information Assurance. Additionally, the CIO participates in Infragard (a partnership between the Federal Bureau of Investigation ("FBI") and the private sector and the American Banker's Association ("ABA") cyber forums. He also participated in the FBI Chief Information Security Officer ("CISO") Academy, Class 10.


text: Senior management documents and reports to the Board (or a Board-appointed subcommittee) on the status of the information security program, which includes, but is not limited to, the following:


text: Risk assessment process, including threat identification and assessment Risk management and control decisions, including risk acceptance and avoidance Third-party service provider arrangements


text: Results of testing If applicable, security incidents and/or breaches or violations of law or regulation and management's response to such incidents; and Recommendations for updates and improvements to the overall information security program.


text: Detection, Mitigation and Remediation The Bank has implemented automated systems designed to detect potential malware and anomalies, and notify management of threats. These systems include anti-virus/anti-malware, network log reporting, network-based intrusion detection and incident response systems, external firewall intrusion detection and prevention systems, endpoint protection, and data leakage protection. Anti-virus/anti-malware systems are designed to be updated as needed and definitions are distributed to Bank computers.


text: Network Log Reporting is consolidated and retained in read-only formats with limited access. Logs are gathered from critical systems on the network and consolidated within a security information and event management ("SIEM") solution.


text: A third-party monitored network-based intrusion detection and incident response program has been contracted. This system draws logs from systems and firewalls, and is driven by classification and risk-based threat analysis of network traffic. This system automatically analyzes network traffic against a world-wide threat exchange to increase the awareness of newly introduced threats and vulnerabilities.


text: All monitoring efforts are expected to communicate directly with the Bank through the IT department. Staff has adequate experience and subject matter knowledge to address or elevate issues, and is entrusted with making final determinations of risk and threats, and escalating issues through management or to third-parties. Where appropriate, the Bank will disseminate information to organizations such as the Financial Services Information Sharing and Analysis Center ("FS-ISAC") or Cybersecurity & Infrastructure Security Agency ("CISA") and other similar incident management user groups.


text: The Bank has implemented an IRP that identifies roles and responsibilities for Bank employees, as well as general scenarios for management and containment of incidents. The Plan is reviewed and updated at least annually by senior management and reviewed by either the IT Committee or the Board of Directors prior to approval by the Board of Directors.


text: Incidents and Risks We have not experienced a material cybersecurity incident and although we are subject to ongoing and evolving cybersecurity threats, management is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. Please see Item 1A "Risk Factors" for further discussion of the material risks associated with the interruption or breach of our information systems or information assets.


text: The Company relies extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use their own electronic information systems. Any of these systems can be compromised, including by employees, customers and other individuals who are authorized to use them, and bad actors using sophisticated and a constantly evolving set of software, tools and strategies to do so. The nature of our business, as a financial-services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. See "Risks Related to Information Security and Business Interruption" section of the Risk Factors included in Item 1A of this 2023 Form 10-K for additional information. Implementing an Information Security Program that establishes policies and procedures for security operations and governance;

companyName: SECURITY FEDERAL CORP

ticker: SFDL


text: Establishing an Information Technology Steering Committee that is responsible for security administration, including conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; Implementing layers of controls and not allowing excessive reliance on any single control; Employing a variety of preventative and detective tools designed to monitor, block and provide alerts regarding suspicious activity; Continuously evaluating tools that can detect and help respond to cybersecurity threats in real-time; Leveraging people, processes and technology to manage and maintain cybersecurity controls; Maintaining a third party risk management program designed to identify, assess and manage risks associated with external service providers; Performing due diligence with respect to our third-party service providers, including their cybersecurity practices;


text: Engaging third-party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; and Conducting periodic cybersecurity training for our employees and the Company's Board.


text: The Information Security Program is a key part of our overall risk management system, which is administered by our Information Technology Steering Committee. The program includes administrative, technical and physical safeguards to help protect the security and confidentiality of customer records and information.


text: From time-to-time, we have identified cybersecurity threats that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations and financial condition.


text: The Company's management team is responsible for the day-to-day management of cybersecurity risks we face and oversees the Information Technology Steering Committee. The Information Technology Steering Committee manages the oversight of the information security assessment, development of policies, standards and procedures, testing, training and security report processes for the Company. The Information Technology Steering Committee is comprised of officers with the appropriate expertise and authority to oversee the Information Security Program.


text: In addition, the Company's Board is responsible for the oversight of risk management, including cybersecurity risks. In that role, the Company's Board, with support from the Company's management and third party cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. The Board reviews and approves an information security program, vendor management policy (including third-party service providers), acceptable use policy, incident response policy and business continuity planning policy on an annual basis. All the aforementioned policies are developed and implemented by management of the Company. To carry out their duties, the Board receives updates from the Information Technology Steering Committee regarding cybersecurity risks and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity.


text: For purposes of the following disclosure, the terms "cybersecurity incident" and "cybersecurity threat" have the meanings given to such terms in Item 106 of Regulation S-K promulgated under the Securities Exchange Act of 1934.

companyName: PARKERVISION INC

ticker: PRKR


text: Given the small size of our organization, we leverage a third-party information technology ("IT") service provider for management of our information systems needs. Our IT service provider works closely with executive management in the assessment, identification and management of cybersecurity threats. Cybersecurity threats are prevented and detected by multiple approaches, including perimeter defense, vulnerability management, intrusion testing, multifactor authentication and data protection. We are in the process of developing a formal cybersecurity awareness program that will include cybersecurity training for all employees and relevant contractors and will be integrated with our overall risk management process. Material risks from cybersecurity threats, including those associated with the use of third-party service providers, are assessed during our annual review of our enterprise risks and related controls.


text: Our overall Board of Directors ("Board") has oversight of all enterprise risks, including those arising from cybersecurity threats. The Board has not assigned that responsibility to any committee or subcommittee of the Board. Assessments of ongoing and emerging enterprise risks, including cybersecurity threats, if applicable, are an integral part of our regularly scheduled Board meetings.


text: We have an informal cyber incident response plan for mitigating and remediating cybersecurity threats and incidents. Any identified cybersecurity threats and incidents are promptly reported to executive management who, along with our IT professionals, will assess the severity of the event and formulate a response. Our determination of the severity of a cybersecurity incident would generally include an evaluation of the incident's effect on the Company, including (i) our business strategy, results of operations, or financial condition, (ii) the integrity, confidentiality, resiliency, and security of our networks and systems, and (iii) our operations. Based on the severity of the event, the Board will be notified and will provide strategic direction through the incident response and communication.


text: We rely on technology in all aspects of our business, including information systems of our third-party service providers. The information systems upon which we depend have been, and likely continue to be, subject to cybersecurity threats such as unauthorized access attempts, business email compromise, phishing, malware, ransomware, hacking and other cyberattacks attempting to disrupt operations. Our dependence on these information systems exposes us to cyberattacks, both directly and through cyberattacks impacting our service providers. A significant cybersecurity incident could result in service interruptions, security events, regulatory compliance failures, the inability to protect employee or corporate information or assets against unauthorized access or use, or other operational difficulties. As described above, we continuously monitor our cybersecurity threats, including risks associated with our use of service providers. We are not aware of any risks from cybersecurity threats, or previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Securing the Company's IT systems is integral and foundational to its everyday operations. The Company's Security Steering Committee is comprised of cross-functional executive management team members that collectively possess an extensive level of security and technology operations expertise. The mission of our Security Steering Committee is to focus on defining and deploying its information security strategy, sustaining a robust employee cyber awareness and training program, executing security engineering, providing continuous monitoring of its operations, responding and coordinating the response and investigation of cyber threats, building and testing its disaster recovery plans in support of its businesses' continuity plan requirements, and developing its cyber and information security policies.

companyName: ULTRALIFE CORP

ticker: ULBI


text: The Company's cybersecurity strategy is based on recognized best practices, standards, and frameworks for cybersecurity and information technology, including the Center for Information Security ("CIS") Controls and National Institute of Standards and Technology ("NIST"). The strategy focuses on implementing technologies, controls, and processes to constantly monitor, identify, assess, and manage cybersecurity risks.


text: The Company's cybersecurity program includes exercises and trainings designed to sustain a high level of cybersecurity awareness and readiness across our employee base. The Company also has a cybersecurity incident response plan that is designed to provide a framework across all functions for a coordinated identification and response to security incidents.


text: The Company engages leading cybersecurity firms to assist with its security engineering and operations; provide independent evaluations of its security posture through regular assessments; and to audit and provide advice on how to make its security processes and controls more effective.


text: Furthermore, the Company utilizes third-party service providers to perform a variety of functions to assist in operating the business. The cybersecurity risks associated with the use of certain providers are covered under a vendor management process. Depending on the nature of the services provided, the sensitivity and/or quantity of information processed, the vendor management process may include reviewing cybersecurity practices of these providers, contractually imposing obligations on the provider, inspecting independently audited reports, and/or conducting its own security assessments of their services.


text: The Company's Board of Directors has ultimate oversight of the Company's cybersecurity risk. Management updates the Board of Directors on the Company's cybersecurity and information security posture at least quarterly at the Company's board meetings, or more frequently as determined to be necessary or advisable. These updates include a review of cybersecurity incidents determined to have a moderate to high business impact, even if immaterial to the Company as a whole. The Audit Committee has responsibility for assisting the Board in the review and oversight of risks affecting the Company, and oversees the enterprise risk management process, which includes, with the assistance of senior management, assessing the Company's exposure to cybersecurity risk and the effectiveness of the Company's processes and controls to address and respond to those risks. Management is responsible for hiring appropriate personnel, integrating cybersecurity considerations into the Company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Notwithstanding the focus and emphasis on cybersecurity, the Company has experienced and will continue to experience cybersecurity incidents, and there can be no guarantee that future incidents will not have a material adverse effect on its business. See "Risk Factors - Breaches in security, whether cyber or physical, and related disruptions and/or our inability to prevent or respond to such breaches, could diminish our ability to generate revenues or contain costs, compromise our assets, and negatively impact our business in other ways" for more information on the Company's cybersecurity risks.


text: Avalon faces various cyber risks, including, but not limited to, risks related to the storage of members' information, and security breaches could expose us to a risk of loss or misuse of this information, litigation and potential liability. We utilize a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cyber and information security. Additionally, we devote significant resources to protecting the security of our computer systems, software, networks and other technology assets. Our efforts are designed to adapt with the evolution of information security risks and appropriate best practices and include physical, administrative and technical safeguards. The risk assessment is discussed with the audit committee and board of directors on at least an annual basis. Our practices are generally developed from, and benchmarked against, recognized cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework. Our management team also engages certain outside advisors and consultants to assist in the identification, oversight, evaluation and management of cybersecurity risks on a regular basis, as well as to advise on specific topics.

companyName: AVALON HOLDINGS CORP

ticker: AWX


text: Cybersecurity incidents continue to become more prevalent requiring adequate and and continuous assessment, identification, and management of material risks associated with cybersecurity threats. These risks include, among other things, disruption of our business processes and proprietary software, and potential unwanted disclosure of protected personal information which may cause harm to our employees, and clients, violations of privacy laws and regulations, breach of confidentiality and other contractual obligations, litigation and legal action, and financial and reputational harm. We utilize cybersecurity technologies and established procedures and processes to identify, assess, and manage these material cybersecurity risks.

companyName: HireQuest, Inc.

ticker: HQI


text: Risk Assessments Our Chief Information Officer ("CIO") heads our technology team which establishes processes and procedures to assess technology related risks, including cybersecurity risks, to the company. Protections we have in place include regular network monitoring, vulnerability assessments, and tabletop exercises to inform the company of potential risks and mitigation strategies. We also execute enterprise risk management assessments, which include cybersecurity threat risks.


text: Our CIO has reviewed the standards created by the National Institute of Standards and Technology and has incorporated their approaches where appropriate. We conduct internal and external risk assessments.


text: Our Board of Directors has ultimate oversight with respect to cybersecurity. At each regularly scheduled board meeting, the Board discusses the steps the Company has taken to ensure proper security. While we have not experienced material cybersecurity incidents in the past, our policies and procedures require us to inform the Board of any material incident.


text: Ongoing Activities To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, we undertake the following activities: All corporate machines are protected by anti-virus software and enterprise network protection; We require two-factor authentication on all corporate machines; We require two-factor authentication for all corporate email accounts; We require all corporate employees to complete quarterly cybersecurity training provided by a third-party; Our CIO and other members of our technology team, proactively monitor all potential risks and immediately respond to threats; Our data is backed up in multiple offline air-gapped devices; We test all backups quarterly; We monitor regulations to ensure our policies and procedures are up-to-date and compliant.


text: Incident Response Our incident response plan identifies the key employees responsible for responding to a cybersecurity incident including our CIO, CLO, CEO, and other executives along with the technology department, and coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The Company has not experienced incidents in the past which were material to our operating results or business.


text: Third-Party Risk Management Our polices and processes address cybersecurity threat risks associated with the use of third-party service providers, including those who access, use and/or store our client, candidate, associate and employee data or have access to our network and systems. Third-party risks are included within our enterprise risk management assessment program, as well as our information security-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform due diligence on third parties that have access to our systems, data or facilities that house such systems or data. This allows us to identify high-risk providers and continually monitor for cybersecurity threat risks appropriately. Additionally, we require contracts with all third parties that have access to our network and systems to include baseline security requirements for adequate data handling, as well as to provide the company with audit rights. Such contractual requirements are reviewed during each subsequent contract renewal process.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Associated Capital Group, Inc.

ticker: ACGP


text: Our cybersecurity risk management program is aligned with the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;


text: a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: training and risk awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.


text: In the last three years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial.


text: The operations of the Company are dependent on technology information and communications systems. A failure of any such system, or a security breach or cyberattack related thereto, could significantly disrupt the Company's operations. The service providers of the Company are also subject to cybersecurity threats. If the Company and/or any service provider of the Company fails to adopt, implement or adhere to adequate cybersecurity measures, or in the event of a breach of any network, information relating to the Company or the Company's operations, as well as personal information relating to the Company's clients, may be lost, damaged or corrupted, or improperly accessed, used or disclosed.


text: Any system failure, security breach or cyberattack on the Company and/or any service provider of the Company could cause the Company to suffer financial loss, disruption to its business, including its trading capabilities and its ability to transfer payments, increased operating costs, liability to third parties, regulatory intervention and reputational damage, among other things, any one or all of which could have a material adverse effect on the Company.


text: Cybersecurity Governance Our Board of Directors is responsible for overseeing cybersecurity threats, among other things. Our Chief Technology Officer, who reports to our Chief Executive Officer and President, provides our senior management and our Board of Directors periodic reports on our cybersecurity risks and any material cybersecurity incidents.


text: Our cybersecurity risk management team, in conjunction with various information technology, internal audit, legal and compliance personnel, has primary responsibility for our overall cybersecurity risk management program.


text: Our team of cybersecurity professionals, led by our Chief Technology Officer, who has over 20 years of experience in the cybersecurity space and advanced training in the field of cybersecurity and technology, has primary responsibility for our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our information technology team also monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk Management and Strategy We have processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into our overall risk management systems and include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. We conduct security assessments of certain third-party providers before engagement and have established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Mobile Infrastructure Corp

ticker: BEEP


text: Board of Directors The Audit Committee of our Board (the "Audit Committee") oversees, among other things, the controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in our disclosure controls and procedures. Further, our Chief Financial Officer and our VP of Technology report on cybersecurity matters, including material risks and threats, to the Audit Committee, and the Audit Committee provides updates to our Board, in each case as frequently as is appropriate.