text: We have developed an incident management process designed to coordinate the activities to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate any reputational damage.


text: Our business strategy, results of operations, and financial condition have not been materially affected as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see "Item 1A, Risk Factors" in this Annual Report.

companyName: TaoWeave, Inc.

ticker: TWAV

secItem: Item 1C


text: Oblong's Director of IT is responsible for assessing and managing cybersecurity risks. It has extensive experience focused on increasing the organization's resilience to security threats and staying current on new developments by monitoring the cybersecurity landscape. The team monitors Oblong's IT environment for potential security threats, investigating and acting on security events to minimize potential risks to the environment.

stage1Category: Management Role

stage1Method: unanimous


text: Oblong's Audit Committee engages in oversight of Oblong's cybersecurity risks and receives regular updates from management on technology and security updates and Oblong's assessment of cybersecurity threats and mitigation plans. The Audit Committee oversees the processes over internal controls and financial reporting, including controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. In the event of a material cybersecurity incident affecting our IT systems or data management, the Audit Committee would promptly work to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity incidents.

stage1Category: Board Governance


text: Plumas Bancorp maintains a cyber risk management program that is designed to prevent, detect, and respond to information security threats. The Board of Directors is responsible for oversight of the Company's information security program, which is designed and implemented by management under the direction of the Chief Information Officer. In addition, the Internal Auditor and Risk Management Officer consider cybersecurity threat risks alongside other company risks as part of our overall risk assessment and management process.

companyName: PLUMAS BANCORP

ticker: PLBC


text: The Chief Information Officer supervises the information security team, which is responsible for maintaining and implementing our enterprise-wide cybersecurity strategy, policy, standards, and architecture processes. The Information Security Officer, in coordination with compliance and human resources, conducts annual and ongoing company-wide information security awareness training. The Chief Information Officer and Information Security Officer have combined over 35 years of IT management experience. We have developed processes to identify and oversee risks from cybersecurity threats associated with third-party service providers, which include the information security team assessing cybersecurity robustness during third-party vendor onboarding, the inclusion of protective provisions in third-party vendor agreements, and risk-based monitoring of third-party vendors on an ongoing basis.


text: The Board of Directors receives regular reports from the Chief Information Officer and the Information Security Officer on Plumas Bancorp's cyber risks and threats, the status of projects to strengthen Plumas Bancorp's information security systems, assessments of Plumas Bancorp's security program, and the emerging threat landscape. Additionally, the Chief Information Officer chairs the Technology Steering Committee, which drives awareness, ownership, and alignment across all business functions for effective cybersecurity risk management and reporting. In addition to conducting internal audits, Plumas Bancorp annually engages third parties to audit its information security programs, whose findings are reported to the Audit and Executive Committees of the Board. The Company also engages with key third-party vendors, industry participants, government agencies, and intelligence and law enforcement communities as part of our efforts, which are reported to the Technology Steering Committee and Board of Directors.

stage1Method: majority


text: The Company has experienced and expects that it will continue to experience cyber-based attempts to compromise its information systems, although none, to its knowledge, has had a material adverse effect on its business, financial condition, or results of operations. Like all financial institutions, the Company faces the risks of such threats, the consequences of which could be material. See Item 1A – Risk Factors – "Cybersecurity breaches and technological discussions could damage our reputation and profitability," above. In addition, given the constant and evolving threat of cyber-based attacks, the Company incurs significant costs in its efforts to detect and prevent security breaches and incidents, and these costs may increase in the future.


text: Risk Management and Strategy We have implemented cybersecu rity and data protection policies and procedures to assess, identify and manage risks from cybersecurity threats. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees receive awareness notices and are informed about new email threats and recent phishing attempts and email frauds. We have capable employees with significant expertise in cybersecurity related to our industry. We evaluate, create and deploy advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks. We also engage third -party service providers and consults to support our cyber risk management efforts, including through periodic security testing.

companyName: TABLE TRAC INC

ticker: TBTC

stage1Category: Risk Management Process


text: Our Information Technology General Controls are firmly established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery.


text: To date, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For additional information about our cybersecurity risks, see "Any disruption in our software and related information technology systems due to a cyber incident could adversely affect our business, operating results and financial condition" under the heading "Risk Factors Relating To Our Business" in Item 1A. of this Annual Report.


text: The Board of Directors has oversight of the cyber security risk management and strategy. The senior leadership, including our Chief Executive Officer and Chief Financial Officer, regularly meets with and provides periodic briefings to our Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our Chief Executive Officer and Chief Financial Officer are responsible for implementing and maintaining our cybersecurity risk assessment and management processes.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Associated Capital Group, Inc.

ticker: ACGP


text: Our cybersecurity risk management program is aligned with the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;


text: a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: training and risk awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process for service providers, suppliers, and vendors.


text: In the last three years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial.


text: The operations of the Company are dependent on technology information and communications systems. A failure of any such system, or a security breach or cyberattack related thereto, could significantly disrupt the Company's operations. The service providers of the Company are also subject to cybersecurity threats. If the Company and/or any service provider of the Company fails to adopt, implement or adhere to adequate cybersecurity measures, or in the event of a breach of any network, information relating to the Company or the Company's operations, as well as personal information relating to the Company's clients, may be lost, damaged or corrupted, or improperly accessed, used or disclosed.


text: Any system failure, security breach or cyberattack on the Company and/or any service provider of the Company could cause the Company to suffer financial loss, disruption to its business, including its trading capabilities and its ability to transfer payments, increased operating costs, liability to third parties, regulatory intervention and reputational damage, among other things, any one or all of which could have a material adverse effect on the Company.


text: Cybersecurity Governance Our Board of Directors is responsible for overseeing cybersecurity threats, among other things. Our Chief Technology Officer, who reports to our Chief Executive Officer and President, provides our senior management and our Board of Directors periodic reports on our cybersecurity risks and any material cybersecurity incidents.


text: Our cybersecurity risk management team, in conjunction with various information technology, internal audit, legal and compliance personnel, has primary responsibility for our overall cybersecurity risk management program.


text: Our team of cybersecurity professionals, led by our Chief Technology Officer, who has over 20 years of experience in the cybersecurity space and advanced training in the field of cybersecurity and technology, has primary responsibility for our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our information technology team also monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk Management and Strategy The Company has processes, policies and procedures for identifying, assessing, managing, and responding to cybersecurity threats and incidents. These are integrated into our overall risk management systems, as overseen by the Board, primarily through the Audit Committee. Our policies and procedures include protocols for assessing potential material impacts from cybersecurity threats, escalating to management and the Board of Directors, engaging external stakeholders, and reporting incidents based on applicable legal requirements.

companyName: OCULUS INC.

ticker: OVTZ


text: We use specialized IT tools and services, including with the support of third -party service providers, to understand, manage, mitigate and continually remediate identified threats. The Company logs identified cybersecurity threats and tracks corresponding risk management activities. Identified cybersecurity threats are discussed with management for resolution planning and escalation. Testing of our security controls in connection with the auditing of our financial systems is completed annually.


text: We regularly evaluate the cybersecurity threats associated with third -party suppliers and service providers that have access to the Company's networks, confidential information, and information systems. We provide third -party vendors, consultants, and partners with detailed security requirements for securing their connections to our IT networks. In addition, we seek to make third -party service providers contractually responsible for identifying and remediating security issues within their technology and service environment.

stage1Category: Third-Party Risk


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. While we have implemented a cybersecurity program, the techniques used to compromise IT systems continue to evolve. Accordingly, we may not be able to timely detect cybersecurity threats or anticipate and implement adequate security measures. For additional information regarding risks relating to privacy and cybersecurity, see "Item 1A – Risk Factors."


text: The Board is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Company. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. The CEO and CFO report on cybersecurity matters, including material threats, to the Audit Committee at regularly scheduled Audit Committee meetings, which is then discussed with the Board of Directors.


text: It is management's responsibility to manage cybersecurity threats, as described above, and bring to the Board's attention any material threats. Under the oversight of the Audit Committee, the Company's CEO is primarily responsible for the assessment and management of cybersecurity threats and utilizes third-party consultants retained by the Company for advice.


text: The Company maintains general cybersecurity policies and procedures to assess, identify, and manage cyber threats, and has designated personnel to implement and maintain these policies and procedures, subject to oversight by our management and board of directors.

companyName: Vaxart, Inc.

ticker: VXRT


text: The Company has implemented various technical, physical and administrative security controls to account for these and other cybersecurity threats. For example, we have implemented technical security controls focused on ensuring the security and protection of computer systems and networks; all pertinent domestic operating entities of the Company are required to adhere to a standardized "Company Confidentiality System," which is centrally overseen and enforced, subject to oversight by our management and board of directors. This Company Confidentiality System includes specific provisions for information pertaining to network security, data security, and information that, if compromised, could have detrimental effects on the public interest and the Company. The Company and its employees are also required to sign confidentiality agreements for purposes including helping to ensure cybersecurity. The Company has taken measures to better ensure that key employees are aware of data security threats (including cybersecurity threats), and Company security policies and procedures, as appropriate. Improper or illegitimate use of the Company's information system resources or violation of the Company's information security policies and procedures may result in disciplinary action.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have in the reporting calendar year materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: The Company relies on third-party service providers for critical or key infrastructure and solutions across various Company operations. Cybersecurity incidents that impact third-party service providers have significantly increased in recent years and represent a continuing risk to the Company. The Company has sought to mitigate this risk through specific cybersecurity controls, designed to assess the business and security controls implemented by key information services to the Company, which are annually audited and subject to oversight by management and the board of directors.


text: One of the key responsibilities of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function through the audit committee, which provides oversight of our cybersecurity program as part of its periodic review of overall risk management program.

companyName: Moleculin Biotech, Inc.

ticker: MBRX


text: Avalon faces various cyber risks, including, but not limited to, risks related to the storage of members' information, and security breaches could expose us to a risk of loss or misuse of this information, litigation and potential liability. We utilize a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cyber and information security. Additionally, we devote significant resources to protecting the security of our computer systems, software, networks and other technology assets. Our efforts are designed to adapt with the evolution of information security risks and appropriate best practices and include physical, administrative and technical safeguards. The risk assessment is discussed with the audit committee and board of directors on at least an annual basis. Our practices are generally developed from, and benchmarked against, recognized cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework. Our management team also engages certain outside advisors and consultants to assist in the identification, oversight, evaluation and management of cybersecurity risks on a regular basis, as well as to advise on specific topics. We have not experienced a material cybersecurity incident and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected the Company.

companyName: AVALON HOLDINGS CORP

ticker: AWX


text: Cybersecurity Risk Management and Processes The Company is actively working towards the integration of a cybersecurity risk management program into its comprehensive risk management framework to protect the confidentiality, integrity, and availability of its critical systems and information.

companyName: High Roller Technologies, Inc.

ticker: ROLR


text: Our cybersecurity risk management program is being designed based on various cybersecurity frameworks, including National Institute of Standards and Technology and the Center for Internet Security, as well as information security standards issued by the International Organization for Standardization, including ISO 27001 and ISO 27002. The Company uses these frameworks and information security standards as a guide to identify, assess, and management cybersecurity risks relevant to the business. Formalization and implementation of robust IT security policies; Conducting vulnerability assessments; Revision of user access request documentation to clearly define the roles and permissions assigned to users; Thorough review of the accuracy and completeness of user listings and access;


text: Preservation of evidence related to system modifications; and Continued collaboration with external specialists to aid in the ongoing evaluation of existing policies and procedures. Establishment of a dedicated cybersecurity governance committee; Standardization of cybersecurity incident response procedures and formats; Conducting penetration tests on a quarterly basis; Enhancement of segregation of duties to mitigate the risk of self-review of transactions within the system;


text: The Company has not identified any risks from known cybersecurity threats and did not have any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company.

stage1Category: Strategy Integration


text: Cybersecurity Governance The Board of Directors actively collaborates with management to supervise cybersecurity risks. In its risk oversight role, our Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Management considers cybersecurity risk as part of its risk oversight function and is in the process of establishing a cybersecurity governance committee. Once established, the cybersecurity governance committee will oversee the management's implementation of the cybersecurity risk management program.


text: Risk Management and Strategy We have established policies and procedures for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We monitor cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that we use through third party providers that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct annual risk assessments and perform as needed updates to our risks to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. We engage consultants, third parties and auditors in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as monitoring and testing our safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic training and communications.


text: As of December 31, 2024, and through the date of the filing of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual report on Form 10-K.


text: Our Chief Financial Officer and Head of IT and Cybersecurity, a consultant, are primarily responsible for assessing and managing our material risks from cybersecurity threats. In this regard, our Chief Executive Officer and Head of IT and Cybersecurity have assistance from service providers, other consultants and third parties. Our Chief Financial Officer has served as an executive officer for over twenty-five years, including over fifteen years as an executive officer of public companies. Our Head of IT and Cybersecurity has served as an information technology professional for over nine years and has held senior IT positions at multiple companies, where his primary responsibilities included maintaining direct oversight over his companies' cybersecurity risks.


text: Our Chief Financial Officer and Head of IT and Cybersecurity oversee our cybersecurity policies and procedures, including those described in "Risk Management and Strategy" above. Under such policies and procedures, our Chief Financial Officer and Head of IT and Cybersecurity are responsible for reporting to our audit committee regarding any cybersecurity incidents. The audit committee, in turn, provides periodic reports to our board of directors regarding our cybersecurity processes, including the results of cybersecurity risk assessments.


text: NextPlat uses, stores, and processes data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems, and our business operations.

companyName: NextPlat Corp

ticker: NXPL


text: Cyber Risk Management and Strategy Our cybersecurity risk management processes are integrated into our overall risk management processes. Our strategy consists of utilizing a combination of employee education, preventative controls, detective controls, and periodic third-party cybersecurity testing. We engage with external cybersecurity experts, including assessors, consultants, and auditors, to enhance our cybersecurity measures and ensure compliance with industry best practices. We have established processes to oversee and manage cybersecurity risks associated with our use of third-party service providers, ensuring they adhere to our security standards. We review third-party service provider contracts to ensure they contain data privacy and security provisions, aligning with our standards and regulatory requirements. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks.


text: Risk Management Oversight and Governance Our Chief Compliance Officer and the Chief Financial Officer lead the oversight of company-wide cybersecurity strategy, policy, standards and processes. We utilize third-party IT consultants to help manage cybersecurity risks. Our Chief Compliance Officer and Chief Financial Officer have the requisite experience in risk assessment and a strong understanding of business operations, including experience with security frameworks, compliance regulations, and the ability to communicate effectively with both technical and non-technical stakeholders. Our consultants have the requisite combination of technical experience in network security, system administration, and incident response.


text: Our Audit Committee liaises with our management team to communicate with and monitor management's mitigation efforts to reduce cybersecurity risks by monitoring incident response, discussing and assisting with identifying potential cyber threats, analyzing vulnerabilities, and prioritizing risks.


text: The goal of the Company's cybersecurity risk management strategy is to mitigate cybersecurity risks. Cybersecurity risks include the potential misappropriation of assets or confidential information, corruption of data, disruptions to operations, or regulatory developments that could materially impact the Company's privacy and cybersecurity risk exposure, and similar threats that could have a material impact to the Company's business, reputation, results of operations and financial condition. To this end, management has implemented processes which seek to identify, assess, and manage material cybersecurity risks, and which include (i) monitoring of cybersecurity threats in the current environment, (ii) training employees on a regular basis in cybersecurity prevention, including social engineering and phishing techniques used by hackers, (iii) requiring multifactor authentication to access the Company's networks, (iv) updating applications on an on-going basis to patch or remediate security vulnerabilities, and (v) the encryption of confidential data and critical servers. The Company has in-place security information and event management tools for the purpose of detecting, analyzing, and responding to security threats in an effort to prevent or reduce potential harm to business operations. These tools include: (i) antivirus applications to detect threats, (ii) end point detection and response applications to record and store on-line user behavior for the purpose of detecting, investigating, and blocking suspicious activities, and (iii) third party monitoring applications. The Company has also adopted a network segmentation strategy intended to divide networks into smaller parts to improve security and efficiency, and the Company also maintains redundant back-up copies of its networks that are stored in multiple locations, including cloud-based backups that are performed daily. Further, on an annual basis, the Company hires a consultant to perform penetration tests against the Company's security infrastructure with the goal of identifying security vulnerabilities and making recommendations for security improvements. The Company also has business continuity and incident response programs in place to respond to and mitigate cybersecurity attacks. The Company conducts periodic exercises in an effort to improve its cybersecurity business continuity and incident response plans and updates the plans if new threats are identified or ongoing reviews of the plans suggest an update is needed.

companyName: BBX Capital, Inc.

ticker: BBXIA


text: During the period covered by this report, the Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: The Company's Board of Directors is responsible for the oversight of management's efforts to address cybersecurity risks. The Board of Directors has designated the Audit Committee with the responsibility of overseeing and reporting to the Board on management's handling of cybersecurity risk management and on the adequacy and effectiveness of the Company's cybersecurity risk management strategy. Management also updates the Board on an on-going basis concerning any significant cybersecurity incidents or risk exposures that have come to management's attention during the conduct of their assessments, the steps management has taken to mitigate such exposures, and any changes to the processes of identifying, assessing, and monitoring cybersecurity threats. The Company's information security team is led by Dustin Woods, who has over 10 years of experience managing risks and advising on cybersecurity matters.


text: Our cybersecurity policies and procedures have been developed to ensure an adequate and consistent approach to the management, control, and protection of our information ("Information Assets"). Our Information Assets include business information, customer information and external business partner information, including, without limitation, classified information, information relating to research, intellectual property, personally identifiable information, business and product development, clinical test and evaluation data, and business plans, customer and supplier information, supply chain, manufacturing, distribution, finance, human resources, consulting, partnerships, contracts, and corporate transactions, maintained in any form or format or location, including audio, video, paper, magnetic, electronic and optical.

companyName: Clene Inc.

ticker: CLNN


text: Device and Network Security Our device and network security policies and procedures are designed to mitigate risk by ensuring our network and computing devices ("Computer Equipment"), electronic systems, and resources used in our business ("Information Systems"), whether owned or leased by us, our employees, or third parties, and the Information Assets contained therein, are protected from security threats.


text: To mitigate risk, we utilize (i) firewalls to protect our network and Computing Equipment, (ii) anti-malware software to protect our Computer Equipment, (iii) device monitoring, (iv) physical security, (v) security and application lifecycle security, (vi) security updates and backups, and (vii) vulnerability and risk assessments.


text: Firewalls. Our network and Computer Equipment is protected by one or more authorized firewalls, with any changes requiring approval from authorized personnel including the review and approval of an information technology ("IT") change control document. Administration of firewalls is restricted to a minimum number of authorized personnel as necessary. We also employ intrusion detection at critical points of our network. All external access to our network, or to any computing resource on our network connected to a non-Clene network (including, but not limited to the internet) must pass through a hardware firewall, appliance, or equivalent device, where all traffic between our network and external networks can be continuously controlled, monitored, and examined for any access violations.


text: Anti-Malware Software. Our Computer Equipment is protected by anti-malware software. The management and administration of anti-malware software is restricted to a minimum number of authorized personnel as necessary.


text: Real-Time Monitoring. We engage a third -party security operations center that actively monitors our environment and detects and remediates security threats in real-time.


text: Device Scanning, Alerts, and Reporting. We reserve the right to monitor, scan, screen, and quarantine/confiscate all Computer Equipment that accesses our network, in compliance with applicable laws and government regulations. We also reserve the right to scan information systems, monitor or screen content and traffic patterns, block e-mail, quarantine and/or confiscate any Information Systems that may post a threat to us, and if such activities reveal possible evidence of criminal activity, to take any appropriate action which may include providing evidence to law enforcement officials.


text: Physical Security. We control physical access to our facilities, areas within our facilities, data centers, server rooms, and equipment. Installation, maintenance, and repair of equipment is restricted to authorized personnel. We protect our Computer Equipment from power failure, surges, and other electrical anomalies, and cabling is protected from unauthorized access or damage. Access to our network services is restricted to authorized individuals and granted only following individual identification and authentication. Local wireless access is limited to authorized entry points, with various forms of authentication required before access is granted to authorized individuals.


text: Security and Application Lifecycle Security. We perform analysis of security requirements for all systems and applications throughout their lifecycle, including for new systems and applications and significant upgrades to existing systems and applications. All new or upgraded systems and applications are tested for stability, compatibility, and security integrity in a separate environment prior to introduction into our production environment.


text: Security Updates and Backups. We monitor security bulletins, software updates/patches, and functional software updates/patches and apply them in accordance with the timeline prescribed in our policies and based upon recommendations from third -party vendors, as applicable. Systems that no longer provide security updates/patches are discontinued. We research, test, and verify functional software updates/patches before installation. We perform data backups periodically based on business requirements to maximize data availability and prevent information loss, including before any system upgrade or maintenance. Encrypted data remains encrypted throughout our backup processes. Data backups are stored in geographically separate facilities.


text: Information Technology & Information Security Audits. The Bank conducts independent external and internal audits of internal controls relating to information technology and information security in accordance with standards established by the Federal Financial Institutions Examination Council (FFIEC). Pursuant to their respective Charters, the Audit Committees of the Company and the Bank review and monitor the effectiveness of the Bank's internal controls, including those controls related to information security, based on independent external audit and internal audit reports. The Chief Audit Officer, who is also a Certified Information Systems Auditor, coordinates the external and internal audit plan and reporting functions for the Bank.

companyName: BankFinancial CORP


text: Vulnerability Assessments. We conduct assessments over potential vulnerabilities for all new and existing network-connected assets on an annual basis. Any potential vulnerabilities that we identify are remediated. We rate vulnerabilities based on the following criteria: (i) High: A vulnerability exists that could potentially allow an attacker to gain elevated access of the host, divulge system information, and/or lead to system or network compromise; (ii) Medium: A vulnerability exists that could potentially allow an attacker limited access to file contents, security settings or ability to conduct a denial-of-service attack; (iii) Low: A vulnerability exists that could potentially allow an attacker limited access to sensitive host system data, such as installed software version giving the ability to exploit application vulnerabilities; and (iv) Info: An attacker could collect basic host information such as open ports and services.


text: Security Incident Reporting Our security incident reporting policy and procedures enable the identification, monitoring, reporting, and response capabilities to known or suspected security incidents in our network and all IT-managed services and Information Systems. Security identification begins with a broad range of potential risks, including, but not limited to, theft or unauthorized disclosure of Information Assets, unexpected modification of Company Information Assets, disruptions of service that can result in Information Assets being unavailable for an unacceptable amount of time, and suspicious behavior and/or unauthorized activity by any individual or organization that can potentially compromise Information Assets or Information Systems.


text: Our process to monitor, report, and respond to identified or suspected security incidents includes (i) collection of relevant information about an incident, including (a) impacted systems, (b) impacted entities, (c) protection mechanisms that were in place and active at the time of the security incident, (d) audit logs, and (e) the risk classification of the Information Assets that were potentially impacted; (ii) reporting to a centralized ticketing system; (iii) reporting to management and other authorities, such as legal, human resources, IT, and local and/or state law enforcement, etc.; (iv) escalation, if the incident is considered to be critical based upon our assessment of its potential impact, to appropriate management and directors and other authorities; and (v) documentation of the incident and our response actions taken.


text: Change and Configuration Management Our change and configuration management policy and procedures enable the effective management of changes to Information Systems ("Changes") to ensure the confidentiality and integrity of Information Assets and the continued availability of both the Information Systems and IT services. The policies and procedures apply to all changes to Information Systems managed by the Company or its IT external business partners.


text: Changes must be approved by authorized personnel prior to (i) performance of any work related to a Change, (ii) migration of any Change-related work from the quality environment to the production environment, to ensure the Change was adequately tested and performs properly, and (iii) closing of the Change, to ensure the Change was implemented in the production environment and correctly solves the issue that prompted the Change request.


text: Changes are tracked and documented in a change tracking system, and we retain past versions of source components and supporting documentation. Testing is performed in an environment other than the production environment, and user acceptance testing is performed by an independent person not responsible for development, modification, or configuration of applications, programs, or system code. Errors are identified, logged, and resolved.


text: Additionally, for Changes that may impact our manufacturing process, we perform impact assessments prior to performing a Change to understand the (i) level of financial, technical, and compliance risk, (ii) impact on business operations, (iii) impact of configuration and user access security, (iv) impact on connected Information Systems and interfaces, and (v) need for user training. The extent and documentation of impact assessments are commensurate with the level of risk associated with the Change, and the level of testing performed shall be determined by the results of the impact assessment.


text: Identity and Access Management Our identity and access management policies and procedures define the access control measures to our Information Systems to protect the privacy, security, and confidentiality of Computer Equipment, Information Systems, and Information Assets.


text: Unique identification is assigned to all individuals with a defined relationship (e.g., employees, vendors, suppliers, etc.), and if a relationship changes, a new identifier is created to reflect the new relationship. Passwords must be changed upon first logon and all privileged account passwords (e.g., root, super user, and administrator passwords) must follow our password guidelines. Identification and authentication are required every time Medium or High Risk Information Assets are accessed or elevated privileges are exercised, and use of elevated privileges is temporary and is revoked upon implementation of a change.


text: Our data access procedures require completion and authorization of access request forms to request, change, or delete access privileges to Information Systems containing Medium or High Risk Information Assets. We perform checks for segregation of duties conflicts and only grant the minimum necessary and least privilege access to users based upon their role. When users are reassigned, promoted, or separated, their access privileges are reviewed and, if necessary, updated in a timely manner. We also perform periodic reviews of user privileges and require training for users with access to Medium or High Risk Information Assets.


text: For additional information on Tripadvisor's cybersecurity program and risks refer to Item 1C. "Cybersecurity" in their 2024 Form 10-K filed on February 20, 2025.

companyName: Liberty TripAdvisor Holdings, Inc.

stage1Category: None/Other


text: Information Asset Protection Our Information Asset protection policy and procedures enables the management, control, and protection of Information Assets from unauthorized disclosure, theft, loss, destruction, unauthorized alteration, unauthorized access, and the denial of availability, all of which could have a direct and significant impact on the future success of the Company. Protection of Information Asset supports the efficient and effective management, control, and protection of our business information and the business information entrusted to us by our customers and external business partners. All Information Asset protection policies and procedures must also be viewed in the context of our obligations to comply with government requirements, such as those related to the protection of personal data, and compliance with our contractual obligations.


text: We use the following approach to manage risks related to Information Asset protection: (i) identification and classification of Information Assets, (ii) identification and assessment of the threats to those Information Assets and the associated risk based upon impact to the business and the likelihood of their occurrence, (iii) assessment and analysis of risk, and determination of the actions required to lower risks to an acceptable level, (iv) implementation of appropriate controls or management acknowledgment or risk where controls cannot be implemented, (v) continuous monitoring and measuring of risk, (vi) ongoing communication of risks and mitigating actions, and (vii) auditing for compliance.


text: Once a risk is identified, we analyze the risk and assign a risk classification based upon a combination of factors, including data volume, legal and regulatory requirements, privacy considerations, and intellectual property considerations. Risks are classified as (i) Low Risk, where unauthorized disclosure could be expected to have a limited adverse effect on operations, assets, or individuals; ( 2) Medium Risk, where unauthorized disclosure could be expected to have a serious adverse effect on operations, assets, or individuals; or ( 3) High Risk, where unauthorized disclosure could be expected to have a severe or catastrophic adverse effect on operations, assets, or individuals. Before granting access to Information Assets, we assess the relationship of the user and associated risks of the Information Assets to determine if access is appropriate, and we periodically review access rights to ensure compliance and prevent unauthorized access.


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our overall risk management program. Our CEO, General Counsel, and Vice President of Quality and Technical Operations ("VP of Quality") directly oversee the development, implementation, operation, and revision of our cybersecurity policies and procedures, and are primarily responsible for the oversight of risks from cybersecurity threats and any security incidents that may occur. These officers have more than 24 years of combined experience in managing IT, operations, and information risk and security. Our VP of Quality has experience developing comprehensive information security programs for organizations, and brings extensive experience in the private sector and is a specialist in IT governance strategies, risk management protocols, and compliance frameworks. All security incidents are managed by our VP of Quality and reported to management, including our CEO, General Counsel, and other personnel based upon the specifics of the incident and its impact. Additionally, if a known or suspected security incident occurs at the Company, based upon its risk classification and if we assess the impact to be critical, the incident is escalated in a timely manner to the Audit Committee of the Board of Directors for oversight of the monitoring, reporting, and response process. The Audit Committee also oversees the implementation of our policies and procedures to prevent or reduce cybersecurity risks on an ongoing basis during the performance of its general committee duties.


text: We face a number of cybersecurity risks in connection with our business and have from time-to-time experienced cybersecurity incidents, which to date have not had a material impact on our financial condition or results of operations. For more information about the cybersecurity risks we face, see Item 1A—Risk Factors "Our internal computer systems, or those used by any CROs or other third -party contractors or consultants we may engage, may fail or suffer security breaches."


text: The Company conducts no business activities other than activities relating to capital management, stockholder relations, and acting as a source of financial strength for its subsidiary, the Bank. Cyber/information security is a significant and integrated component of the Company's risk management strategy. As an insured depository institution, threats to information security are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.


text: Information Security Policy and Risk Management: The Bank maintains an Information Security Policy reviewed and updated as needed, and at least annually by its Board of Directors. The Boards of Directors of the Company and the Bank review a formal Information Security Report at least annually and also receive periodic reports on cyber/information security topics and matters.


text: As required by federal banking laws and regulations, the Bank's cyber/information security risk management practices include risk assessments, controls and practices specifically for cybersecurity, information technology deployment and third -party information technology vendor risk management.


text: The Bank conducts an extensive training program, from entry-level to executive-level, focused on information security and customer data privacy. As part of its Enterprise Risk Management protocols, the Company and the Bank maintain insurance policies appropriate for the scope of its operations, including coverage for risks related to cyber/information security and customer data privacy.


text: Information Security Management. To prepare and respond to incidents, the Bank maintains implemented multi-layered cybersecurity protocols, integrating people, technology, and processes as part of the Bank's Information Security Program. The Information Security Program is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity, third -party vendor management and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities, deploys current information security technologies and ensures awareness, accountability, and oversight for data protection throughout the Bank and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Company engages qualified third -party vendors, consultants and independent auditors to, among other things, conduct network penetration tests and perform cyber/information security audits.


text: The Information Services Division of the Bank is primarily responsible for identifying, assessing and managing material risks from cyber/information security threats. Information security management is conducted by the Chief Information Officer (CIO) and Chief Information Security Officer (CISO) of the Bank. The CIO has over ten years' experience with the Bank, including information security technology deployment and previous information technology audit experience. The CISO has more than 15 years of experience with the Bank, with expertise in large-scale systems information security and customer data privacy management.


text: The CIO monitors, evaluates and adjusts the Bank's Information Security Program, considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, technology development initiatives, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems. The Management Audit/Compliance Committee reviews and coordinates the status and results of information security controls, network penetration, business continuity/disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Technology Coordinating Committee of the Bank, and presents cyber/information security updates on a periodic basis to the Chief Executive Officer and the Bank's Board of Directors.


text: Our employees are the first line of defense with respect to cyber/information security protection. Each employee is responsible for protecting Bank and customer information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from cyber/information security threats and activities intended to compromise cyber/information security.


text: Customer Data Privacy. The Bank maintains and publishes its Customer Data Privacy Principles on its official website. The Principles include disclosures of the use and sharing of certain customer information, as well as the significant restrictions the Bank places on such activities. In addition, the Bank maintains policies restricting the knowing use or collection of information about children under age 13 by the Bank, other than to provide parental notice or consent. The Bank also maintains policies and controls over the use of electronic mail solicitations, including a customer's ability to "opt-out" of electronic solicitations at any time.


text: The Bank maintains policies, controls and training programs concerning customer information security, including transaction processing. The Bank deploys universal conditional access policies, requires multi-factor authentication for external network access and on-line banking access by Bank customers, and maintains additional access controls for network security and transaction processing. The Bank also has policies and controls to identify, classify and limit access to non-public customer information, including a comprehensive third -party vendor management cyber/information security risk management program.


text: Customer Data Privacy Reviews. The Bank conducts independent external and internal reviews of internal controls relating to customer data privacy and data security in accordance with the requirements of the Gramm-Leach-Bliley Act, the Right to Financial Privacy Act, and standards established by the FFIEC. Pursuant to their respective Charters, the Audit Committees of the Company and the Bank review the effectiveness of the Bank's internal controls, including those controls related to customer data privacy based on independent external audit and internal audit reports.


text: Information Security Incident Responses. The Bank maintains information security incident response plans for various information security/data breach scenarios. The Bank tests its incident response plans at least annually. Pursuant to applicable federal and state laws, regulations and FFIEC standards, the Bank maintains incident response notification procedures for affected customers, including notification of federal regulatory authorities and law enforcement. For the preservation of all possible avenues for law enforcement, the Bank does not disclose information security incidents to the general public unless required by law or as directed by applicable lawful authority.


text: For purposes of the following disclosure, the terms "cybersecurity incident" and "cybersecurity threat" have the meanings given to such terms in Item 106 (a) of Regulation S-K promulgated under the Securities Exchange Act of 1934.

companyName: PARKERVISION INC

ticker: PRKR


text: Given the small size of our organization, we leverage a third-party information technology ("IT") service provider for management of our information systems needs. Our IT service provider works closely with executive management in the assessment, identification and management of cybersecurity threats. Cybersecurity threats are prevented and detected by multiple approaches, including perimeter defense, vulnerability management, intrusion testing, multifactor authentication and data protection. We have also implemented a formal cybersecurity awareness program that includes cybersecurity training for all employees and relevant contractors and is integrated with our overall risk management process. Material risks from cybersecurity threats, including those associated with the use of third-party service providers, are assessed during our annual review of our enterprise risks and related controls.


text: Our overall Board of Directors ("Board") has oversight of all enterprise risks, including those arising from cybersecurity threats. The Board has not assigned that responsibility to any committee or subcommittee of the Board. Assessments of ongoing and emerging enterprise risks, including cybersecurity threats, if applicable, are an integral part of our regularly scheduled Board meetings.


text: We have an informal cyber incident response plan for mitigating and remediating cybersecurity threats and incidents. Any identified cybersecurity threats and incidents are promptly reported to executive management who, along with our IT professionals, will assess the severity of the event and formulate a response. Our determination of the severity of a cybersecurity incident would generally include an evaluation of the incident's effect on the Company, including (i) our business strategy, results of operations, or financial condition, (ii) the integrity, confidentiality, resiliency, and security of our networks and systems, and (iii) our operations. Based on the severity of the event, the Board will be notified and will provide strategic direction through the incident response and communication.


text: We rely on technology in all aspects of our business, including information systems of our third -party service providers. The information systems upon which we depend have been, and likely continue to be, subject to cybersecurity threats such as unauthorized access attempts, business email compromise, phishing, malware, ransomware, hacking and other cyberattacks attempting to disrupt operations. Our dependence on these information systems exposes us to cyberattacks, both directly and through cyberattacks impacting our service providers. A significant cybersecurity incident could result in service interruptions, security events, regulatory compliance failures, the inability to protect employee or corporate information or assets against unauthorized access or use, or other operational difficulties. As described above, we continuously monitor our cybersecurity threats, including risks associated with our use of service providers. We are not aware of any risks from cybersecurity threats, or previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: The Company has implemented data security measures and has not, to date, been subject to any material data security breaches, data loss or cyber-attacks. However, despite the Company's efforts to protect sensitive information and confidential and personal data, comply with applicable laws, rules and regulations and implement data security measures, the Company's facilities and systems may be vulnerable to security breaches and other data loss, including cyber-attacks. In addition, it is not possible to predict the impact on the Company's business of the future loss, alteration or misappropriation of information in the Company's possession related to the Company and EEI's employees, former employees, or others. This could lead to negative publicity, legal claims, theft, modification or destruction of proprietary information or key information, damage to or inaccessibility of critical systems, operational disruptions and other significant costs, which could have an adverse impact on the Company's revenues and earnings.

companyName: EVERFLOW EASTERN PARTNERS LP


text: Because of our company's small size and the nature of our operations, our information technology systems are minimal. The records stored on the company's systems are primarily non-financial in nature. We have outsourced all of our internal bookkeeping and accounting functions to a third-party accounting firm that maintains all of our financial records on its systems. We rely on the third party's cybersecurity protections and procedures to safeguard our information, and a consideration of the protections put in place by that firm and any other service provider that receives our information is a critical part of management's decision to engage the provider.

companyName: CKX LANDS, INC.

ticker: CKX


text: Our President is responsible for assessing, identifying and managing risks to us from cybersecurity threats. Under his direction, we have contracted with a third-party IT and cybersecurity consultant that monitors our IT systems and firewall protections, as well as those of Matilda Stream Management, which provides offices and administrative services to us.


text: It is management's judgment that the processes in place for monitoring cybersecurity risk, including the services provided by the IT consultant, are appropriate given the nature of our systems and our business. We have not encountered cybersecurity incidents or challenges that have materially affected or are reasonably likely to materially affect our company, strategy, results of operations or financial condition.


text: Our full board of directors is responsible for overseeing and managing risk to our business. Given the extent of our IT systems and the nature of our business, management has determined that it is not currently necessary to make regularly scheduled reports to the board regarding our IT systems and cybersecurity. However, management continually reassesses the most significant risks to our business and would promptly report to the board of directors any material change in the level of risk to our business from cybersecurity threats. Management will continue to consult with our third-party IT firm to monitor this risk and adopt any recommended security protections and best practices.


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a security incident at a third-party vendor or customer, including assessment and monitoring of security standards and control procedures for external suppliers and vendors, with enhanced engagement or internal controls depending on the results of the assessment.

companyName: Aterian, Inc.

ticker: ATER


text: Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions. As part of our risk management process, we conduct application security assessments, vulnerability management, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually. We have a unified and centrally coordinated team, led by our Chief Technology Officer and our General Counsel, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at Aterian in close coordination with senior leadership and other teams across Aterian. In addition to our in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. These third parties also consult on best practices to address new challenges upon request. Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our risk assessments that are reviewed by the Audit Committee and our Board of Directors. As of the date of this report, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Despite the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company or its stakeholders.


text: Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "Risks Related to Information and Cyber Security," which should be read in conjunction with the information above. The Audit Committee, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. The Audit Committee receives reports regarding such risks from management, including our Chief Technology Officer, and reports to the Board at least quarterly. The Audit Committee also oversees the Board's response to any significant cybersecurity incidents. Our Chief Technology Officer, who has extensive cybersecurity knowledge and skills gained from over ten years working in the technology industry, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at Aterian, working closely with our General Counsel who has a certification in Data Security and Privacy Policy from Cornell University. Both our Chief Technology Officer and General Counsel report directly to our CEO.


text: In July 2023, the SEC adopted a new rule, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, which requires registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. For registrants, the final rules were effective September 5, 2023, with the new disclosures required beginning in annual reports for fiscal years ending on or after December 15, 2023. With respect to compliance with the incident disclosure requirements, all registrants other than smaller reporting companies must begin complying on December 18, 2023, with smaller reporting companies being given an additional 180 days, or June 15, 2024. The Company adopted these new cybersecurity disclosure requirements in the prior fiscal year, as detailed below.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners, and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized cybersecurity industry frameworks established by the National Institute of Standards and Technology, and other applicable industry standards. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Additionally, we utilize internal and external independent controls to monitor and mitigate the risk of these threats, including a Security Incident Response Plan ("SIRP") and periodic Information Technology training for all employees.


text: Cybersecurity Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity risk management program includes the following key components:


text: Risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment.


text: The IT team including its executive leadership is in charge of managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to security incidents.


text: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: The Company has in place an incident response and recovery plan that addresses the Company's response to a cybersecurity incident.


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by external resources accessing the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third -party systems.


text: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, EDR tools, and PEN test exercises that focus on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the executive management team and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: We experienced a cyberattack in January 2023. We believe the incident has not had nor will have a material impact on our business, operations, ability to serve our customers, or financial results. At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. The impact of potential cybersecurity threats is difficult to predict, but one or more of them could result in the loss of information or capabilities, harm to individuals or property, damage to our reputation, loss of business, regulatory actions, and potential liability, any of which could have a material adverse effect on our financial position, results of operations and/or cash flows. These threats could lead to losses of sensitive information or capabilities, harm to personnel, infrastructure, or products, and/or damage to our reputation as well as our vendor's ability to perform on our contracts. See "Risk Factors - Cyberattacks, like our 2023 cybersecurity incident that was previously disclosed, can lead to disruption of business, reduced revenue, increased costs, liability claims, or harm to our reputation or competitive position."


text: The executive management team and the Board oversee the Company's ERM process, including the management of risks arising from cybersecurity threats. The executive management team and the Board each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The executive management team and the Board also receive prompt and timely information regarding any cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the executive management team and the Board discuss the Company's approach to cybersecurity risk management to monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time.


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program, and cybersecurity is a critical element of this program.

companyName: Firsthand Technology Value Fund, Inc.

ticker: SVVC


text: Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. In general, the Adviser seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Adviser's information systems or the information that the Adviser collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.


text: Identification and Reporting: The Adviser has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Adviser's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner.


text: The Company is committed to complying with all applicable cybersecurity regulations and standards. We regularly review our cybersecurity practices to ensure they align with industry best practices and regulatory requirements.

companyName: HG Holdings, Inc.

ticker: STLY


text: Technical Safeguards: The Adviser implements technical safeguards that are designed to protect the Adviser's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary.


text: Incident Response and Recovery Planning: The Adviser has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Adviser's response to a cybersecurity incident. The Adviser conducts occasional tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.


text: Third-Party Risk Management: The Adviser maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors and service providers Education and Awareness: The Adviser provides periodic training for all levels of personnel regarding cybersecurity threats as a means to equip the Adviser's personnel with effective tools to address cybersecurity threats, and to communicate the Adviser's evolving information security policies, standards, processes, and practices.


text: The Adviser conducts periodic assessment and testing of its policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events The results of such assessments and reviews are evaluated by management and reported to the Board, and the Adviser adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.


text: The Board, in coordination with the Adviser, oversees the Company's risk management program, including the management of cybersecurity threats. The Board receives regular updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company. The Board also receives prompt and timely information regarding any material cybersecurity risk, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106 (a) of Regulation S-K. These risks include, among other things, operational risks, the risk of intellectual property theft, fraud, harm to employees or third parties with which we conduct business and violation of data privacy or security laws.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We have established policies and controls for assessing, identifying and managing material cybersecurity risks and responding to material cybersecurity incidents.


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments when there is a material change in our business practices that we believe could affect information systems that are vulnerable to cybersecurity threats. These risk assessments include identifying reasonably foreseeable internal and external risks and the potential harm if the risks were to materialize. We conduct these risk assessments directly and also periodically engage third -party providers to support these processes.


text: Following these risk assessments, we evaluate how to appropriately implement and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We have implemented cybersecurity tools, conducted employee training, and monitored emerging laws and regulations related to data protection and information security. We may a lso obligate certa in third -party business partners to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect the Company.


text: Cybersecurity events and data incidents are evaluated, assessed based on severity and prioritized for response and remediation. Under our incident response policies, incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.


text: Third-Party Risk Management Our third -party risk management program is integrated into our overall cybersecurity strategy. We recognize the significant challenges posed by the need to govern third -party service providers and vendors, and have implemented robust processes to oversee and manage these risks:

companyName: Guerrilla RF, Inc.

ticker: GUER


text: We have not, to date, experienced a cybersecurity incident that was determined to be material, although, as a technology provider, we have experienced incidents in the past. Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to "Item 1A, Risk Factors" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management team. Our board of directors has delegated responsibility to the Audit Committee for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive regular updates from senior management, including leaders from our information technology, legal and compliance teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, information on how management is addressing and/or mitigating those risks, cybersecurity incidents (if any) and the status on key information security initiatives.


text: Our Chief Executive Officer and Chief Financial Officer are principally responsible for overseeing the cybersecurity risk management program, in partnership with outside consultants, as well as managing and responding to material cyber incidents if any occur. Our CFO also serves as a board member at a cybersecurity and mobile IT solutions company. Although our CEO and CFO do not otherwise have cybersecurity expertise, their many years in Company management and risk oversight more generally position them well to oversee the cybersecurity risk management program, which they do in partnership with outside consultants. They provide periodic briefings to the Audit Committee and to the Board of Directors about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, our policies for managing and responding to cybersecurity incidents include procedures for appropriate escalations to our Audit Committee Chair.


text: We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of data we produce and collect.

companyName: Planet 13 Holdings Inc.

ticker: PLNH


text: Managing Material Risks & Overall Risk Management We have a cross-departmental approach to addressing cybersecurity risk, including input from our employees, senior management, and Audit Committee of our Board of Directors (the " Board "). The Company devotes significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats promptly and effectively.


text: We have a set of Company-wide cybersecurity policies and procedures and continue building these important document libraries. Management approves initial policies and reviews them periodically for updates and changes. Our network security provider follows the internationally recognized risk framework, ISO 27001. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a multi-faceted cybersecurity strategy based on prevention, detection, and mitigation. The Company continues to work to ensure the inclusion of our cybersecurity risks are fully incorporated into the Company's overall risk management approach.


text: Third-Party Risk Management and Oversight As part of our cybersecurity program, we also engage with external service providers as part of our continuing cybersecurity efforts, assisting us in the evaluation and enhancement of the effectiveness of our information security policies and procedures. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity policies and procedures are comprehensive, up-to-date, and aligned with regulatory requirements.


text: The use of these third -party providers is regularly reviewed and monitored by the appropriate members of management. We conduct thorough assessments of all third -party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impacted our strategic plan, operations, or financial standing. For additional information, see "Risk Factors."


text: Our cybersecurity program is managed by our Vice President of Operations ("VP Operations") and our Director of Information Technology ("IT Director"), whose team ("Cybersecurity Team") is responsible for facilitating the enterprise-wide cybersecurity program. Our VP Operations and IT Director have experience with large information technology footprints, including cybersecurity. Their in-depth knowledge and expertise are instrumental in supporting our cybersecurity program and policies and overseeing our governance and compliance programs. The Audit Committee of our Board of Directors oversees management's process for identifying and mitigating risks, including cybersecurity risks. The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: we deploy systems safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence;

companyName: Sky Harbour Group Corp

ticker: SKYH


text: Management's role in assessing and managing material risks from cybersecurity threats involves leadership, governance, resource allocation, and proactive risk management. Management's involvement is crucial in safeguarding the Company's digital assets, reputation, and long-term success. Our Cybersecurity Team provides periodic reports to our Audit Committee, as well as our Co-CEOs, and other members of senior management as appropriate.


text: The Audit Committee actively participates in discussions with management regarding cybersecurity risks. The Audit Committee performs an annual assessment of the Company's cybersecurity program, which includes a discussion of management's actions to identify and detect threats, and scenarios for potential response or recovery situations. In addition to regularly scheduled meetings, the Audit Committee and appropriate levels of senior management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106 (a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Usio, Inc.

ticker: USIO


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third -party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our consumer products) and implement appropriate changes.


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses are overseen by leaders from our Information Security, Network Administration, Compliance and Legal teams regarding matters of cybersecurity.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: We also conduct tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation and remediation strategies.


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. As of 2024, our Information Security Management System has been certified to conform to SOC 2 Type 2 and PCI, and are working to conform to ISO 27001.


text: Our risk management program also assesses third party risks, and we perform third -party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third -party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third -party service providers and potential fourth -party risks when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform risk management during third -party cybersecurity compromise incidents to identify and mitigate risks to us from third -party incidents.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " If our security applications are breached by cyberattacks or are not adequate to address changing market conditions and customer concerns, we may incur significant losses and be unable to sell our services " included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10 -K.


text: The Board of Directors is responsible for overseeing the Company's enterprise risk, and has established its Risk and Cybersecurity Committee with specific responsibility for overseeing cybersecurity threats, among other things. The Company's cybersecurity organization is led by the CTO, who is responsible for assessing and managing material risks from cybersecurity threats and reports to Usio's CEO, CAO, and Legal team, as well as to the Risk and Cybersecurity Committee. The CTO has served in this role for 17 years, and more than 21 years with the Company developing, maintaining, and securing our corporate network and information technology systems. The CTO holds a bachelor's degree in information technology from the University of Texas at San Antonio with over 11 years of previous software and hardware systems engineering experience.


text: The CTO and the Risk and Cybersecurity Committee monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of the Company's incident response plans, which include escalation to the CTO and the Risk and Cybersecurity Committee, as appropriate. As discussed above, the CTO reports out to the Risk and Cybersecurity Committee about cybersecurity threat risks, among other cybersecurity related matters, at least quarterly.


text: We rely on information technology and data to operate our business and advance our pipeline of product candidates. Our critical information technology includes computer networks, third-party hosted services, communication systems, software and infrastructure and our critical data includes confidential, personal, proprietary and sensitive data (collectively, Information Assets). Accordingly, we maintain a process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We routinely assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our Information Assets and mitigate harm to our business.

companyName: BioCardia, Inc.

ticker: BCDA


text: To operate our business, we utilize certain third-party service providers to provide a variety of functions, such as outsourced business functions, professional services, software-as-a-service platforms and encryption and authentication technology. Depending on the services provided, the sensitivity and quantity of information processed and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, or requiring that the vendor certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with its work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Our information technology team consists of professionals with deep cybersecurity expertise across multiple industries. Our executive leadership team, along with input from the above professionals, are responsible for our overall enterprise risk management process and regularly consider cybersecurity risks in the context of other material risks to the Company.


text: As part of our risk management system, we track and log privacy and security incidents to facilitate our efforts to remediate and resolve any such incidents. Any significant incidents are reviewed with our Chief Financial Officer and incidents that are assessed as potentially being or potentially becoming material are escalated within the appropriate members of management and reported to our executive leadership team. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our executive leadership team makes the final materiality determinations and disclosure and other compliance decisions.


text: The Board of Directors has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. Our executive leadership team regularly discusses cyber risks and trends and, should they arise, any material incidents with the Board of Directors.