text: As a supplier of LMR products to federal, state and municipality agencies, our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. We have retained the assistance of a Cybersecurity expert consultant, to assist internal management to evaluate processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our products and have processes to assess those issues for potential cybersecurity impact or risk. We are also implementing a process to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident.


text: Cybersecurity Governance Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least twice annually, or more frequently as determined to be necessary or advisable.

companyName: BK Technologies Corp

ticker: BKTI

secItem: Item 1C

stage1Category: Board Governance

stage1Method: unanimous


text: Our cybersecurity program is run by our Chief Information Security Officer (CISO) and Chief Financial Officer (CFO), who reports to our Chief Executive Officer (CEO). Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our IT Director and the Cybersecurity consultant expert.

stage1Category: Management Role


text: Risk Management and Strategy Many aspects of our business are dependent upon our computer systems, devices, and networks to collect, process, and store data necessary to conduct many aspects of our business, including the analysis of our products, the maintenance of our intellectual property, the recording and reporting of commercial and financial information, and payroll. We rely on standard operating systems and software from established and reliable third parties to provide security including Microsoft 365, QuickBooks, and Paylocity. The Company does not have in-house information technology personnel. Management makes concerted efforts to select third-party software providers with a demonstrated track-record of effectively addressing cyber-security concerns. In event of a cyber-security incident, we would rely upon these providers. In light of the Company's current size and relatively low cyber-risk profile, management believes that reliance upon experienced third-party providers is the most prudent and cost-effective course.

companyName: Zivo Bioscience, Inc.

ticker: ZIVO

stage1Category: Risk Management Process

stage1Method: majority


text: To date, risks from cybersecurity threats or incidents have not materially affected our company. However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents and protect our systems and information may not successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect our company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.

stage1Category: Strategy Integration


text: Our board stays informed on data privacy and information security issues and vulnerabilities that may be applicable to the Company. We outsource most aspects of our information technology management and these third party providers are available to address any cybersecurity issues that may arise.


text: The Company understands the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of the Company's overall risk assessment process. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: PEDEVCO CORP

ticker: PED


text: NIST SP 800-34, Rev 1, "Contingency Planning Guide for Federal Information Systems," November 2010 NIST SP 800-37 Rev. 2, "Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy," December 2018 IST SP 800-53, Rev. 5, "Security and Privacy Controls for Information Systems and Organizations," September 20, 2020, updated December 10, 2020 NIST SP 800-61, Rev 2, "Computer Security Incident Handling Guide," August 2012 Our approach to cybersecurity aims to protect the confidentiality, integrity, and availability of the data we handle. This process involves measures to identify and prevent cybersecurity threats and mechanisms to mitigate and respond to cybersecurity incidents.

companyName: WIDEPOINT CORP

ticker: WYY


text: We have processes in place to identify, assess and monitor material risks from cybersecurity threats, including the material risks of the Company. These processes are part of our overall enterprise risk management process and have been embedded in our operating procedures, internal controls and information systems. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things, implemented (i) multi-factor authentication and password protection requirements for accessing all Company systems and applications such as Company electronic mail and the Company's banking and accounting environments, (ii) a secure email gateway using GoSecure that combines machine learning, behavioral scanning, exploit detection, signature-based detection and structure heuristics to provide defense against phishing and business electronic mail compromise attacks, spam, polymorphic malware, theft and other dangerous offensive content, (iii) endpoint protection using Microsoft Defender on Company and employee computers and Company-provided devices, (iii) a physical networking room with restricted access to only authorized personnel, (iv) regular cybersecurity training, awareness, and threat updates programs to keep all Company personnel updated and informed regarding emerging threats and best practices, and (v) daily cloud backups of the Company's accounting environment. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Failure of our information technology systems, including cybersecurity attacks or other data security incidents, could significantly disrupt the operation of our business." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

stage1Category: None/Other


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management.


text: Our management team is responsible for the oversight of risks from cybersecurity threats. The Board receives information and updates periodically with respect to the effectiveness of our cybersecurity and information security framework, data privacy and risk management. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, and protect employee, collaborator, and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, response plans, tests on our systems, review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants and computer security firms, to enhance our cybersecurity oversight including by gaining valuable insights into the ever-evolving cybersecurity landscape. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Dermata Therapeutics, Inc.

ticker: DRMA


text: In an effort to deter and detect cyber threats, we annually provide all employees with a data protection, cybersecurity, incident response, and prevention, training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Governance; Board Oversight The Audit Committee of our Board provides direct oversight over cybersecurity risk and provides updates to the Board regarding such oversight on a periodic basis. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Risk Management and Strategy We rely upon technology and information systems to support our mining exploration business. These systems may be susceptible to cybersecurity risks including, but not limited to, external attackers, malware, viruses, and unauthorized access to our information technology ("IT") systems. We have invested in cybersecurity controls and processes to address these threats and reduce the risk of future breaches and cyber-attacks. Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor misconduct, and other external hazards could expose our information systems, and those of our vendors, to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business.

companyName: SOLITARIO RESOURCES CORP.

ticker: XPL


text: Risk Management and Strategy Our cybersecurity program, a pivotal component of our overarching ERM framework, concentrates on several key areas:


text: Incident Response and Recovery Planning: Our comprehensive incident response and recovery plans are designed to manage the aftermath of cybersecurity incidents. Regular testing and evaluation of these plans ensure preparedness and resilience.


text: While we take cybersecurity seriously, we mitigate the common cybersecurity risks that many companies face by greatly limiting the accessibility of and our reliance on our cyber profile and web-based activities. Of our nine employees (six full-time, three part-time), a total of three employees plus one third-party information-technology consultant (our "IT Consultant") that we contract with have access to our cyber system. No vendors or customers have access to our system, which greatly minimizes the risk of unauthorized access. No part of our business entails third-party members of the public accessing our accounts, making purchases, or ordering products or services, which greatly reduces our risks of cyber-attack and minimizes the potential consequences if such an attack were to occur. In addition, although we do have a website, it is maintained offsite and is not connected to our file server, which is maintained separately in our office rather than being connected to the Internet or linked to any third-party cloud storage system.


text: Despite our relatively low risk cybersecurity profile and the minimal threat of cybersecurity incidents that we face, we contract with one IT Consultant to assist us in identifying any potential cybersecurity risks and in implementing and maintaining effective measures to reduce our cybersecurity risks. Our IT Consultant helps ensure that our system is updated with the latest cybersecurity patches and configurations and monitors our system and accounts for suspicious activity.


text: Additionally, we invest in firewall protection through Symantec Corporation, which is a provider of Internet-security technology and business-management solutions. Our Symantec firewall protection is designed to monitor and secure our computers from malicious inbound and outbound traffic and to provide an additional layer of protection to our network and data, which helps mitigate the risks of unauthorized access and cybersecurity threats. In addition to relying on the advice and knowledge of our IT Consultant, our IT Consultant maintains our firewall protection through Symantec.


text: We monitor daily reports from the firewall protection, which would indicate any suspicious activity in our accounts or system as well as notify our IT Consultant, who would contact our Chief Financial Officer. Our Chief Financial Officer would consult with our IT Consultant to assess and determine the materiality of the risk presented by the suspicious activity and to determine what steps should be taken to protect the limited data we maintain online. Depending on the materiality of the risk, our IT Consultant and Chief Executive Officer would consult with our Audit Committee of the Board of Directors to determine an appropriate notification and risk-management plan.


text: We did not identify any cybersecurity incidents during the year ended December 31, 2023 that have materially affected or are reasonably likely to materially affect Solitario's business strategy, results of operations, or financial condition.


text: Despite the low accessibility of our server and system and the resultant low cybersecurity risks that we face, we recognize that no system is completely protected from cyber threats, that cybersecurity risks are increasingly difficult to detect, and that the increasingly digitalized landscape that businesses operate in increase the pervasiveness and severity of cyber-attack risks. While we do not believe our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity threats or incidents, there is no assurance that we will not be materially affected by such threats or incidents in the future. We will continue to monitor cybersecurity risks with our IT Consultant and stay apprised of changes in the cyber environment.


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the responsibilities relating to the operational (including IT risks and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our executive officers and it reports any material findings and recommendations to the full Board for consideration.


text: Cybersecurity risk management is part of the Company's overall risk management program. Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to the best of their ability to ensure that such potential cybersecurity risk exposures are monitored, putting in place reasonably appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Treasurer with assistance from the management team. Any significant Cyber incidents that they become aware of are reported to the board of directors. There were no material cyber security incidents discovered in 2023.

companyName: Idaho Strategic Resources, Inc.

ticker: IDR


text: Our Board of Directors (Board) oversees the management of the risks inherent in the operation of the Company's business, principally through the Governance Committee. Our Governance Committee oversees our risk management efforts, with cybersecurity being an element of our comprehensive Enterprise Risk Management (ERM) strategy. Our executive officers report information to the Board through the Governance Committee regarding the risks that impact the organization, including cybersecurity risks, and any material events.


text: Collaborative Approach: We employ a holistic, cross-functional strategy to identify, prevent, and mitigate cybersecurity threats. Our approach includes rapid escalation protocols for specific cybersecurity incidents, enabling timely decision-making on public disclosure and reporting by management.


text: Education and Awareness: We understand the importance of informed personnel, so we conduct mandatory, regular training on cybersecurity threats. This training aims to equip our staff with the necessary tools to confront these threats effectively and disseminate updates on WidePoint's evolving information security policies, standards, processes, and practices.


text: We are committed to maintaining robust cybersecurity defenses through regularly evaluating and improving our policies, standards, processes, and practices. This commitment is actualized through a diverse array of assessment and testing activities, which include: Comprehensive Audits and Assessments: We conduct audits and assessments to scrutinize the efficacy of our cybersecurity measures.


text: Tabletop Exercises and Threat Modeling: Engaging in tabletop exercises and threat modeling allows us to simulate and prepare for potential cybersecurity scenarios, ensuring readiness and adaptability. Vulnerability Testing: Vulnerability testing is performed to proactively identify and address potential security weaknesses.


text: External Evaluations: We regularly commission third parties to conduct in-depth assessments to ensure an unbiased and comprehensive evaluation. These include information security maturity assessments, audits, and independent reviews of our information security control environment and its operational effectiveness.


text: Based on the insights gleaned from these assessments, audits, and reviews, we dynamically adjust and refine our cybersecurity policies, standards, processes, and practices to continuously enhance our cybersecurity posture.


text: By engaging in these rigorous and diverse testing and assessment activities, we verify the current effectiveness of our cybersecurity measures and identifies areas for continual improvement, ensuring our defenses evolve in line with the dynamic nature of cyber threats.


text: Executive Experience and Qualifications Our CEO, CFO, each with over thirty (30) years of risk management experience, and the COO with over twenty (20) years of experience including cybersecurity, possess deep expertise in their respective fields, evidenced by their academic qualifications and professional trajectories. This collective experience underpins our robust approach to managing cybersecurity risks. In addition, we have numerous employees with experience and qualifications related to cybersecurity. We expect to name a Chief Information Security Officer during 2024 as part our cybersecurity program. Our executive officers are responsible for informing the Board and Governance Committee of any material cyber events or risks.


text: Cybersecurity Threats are discussed in ITEM 1 A. RISK FACTORS, under the heading RISKS RELATED TO PRIVACY, CYBERSECURITY AND TECHNOLOGY in this Annual Report on Form 10-K. We are not aware of any material cybersecurity incidents in the past that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition.


text: Risk Management and Strategy The Company recognizes the importance of a cybersecurity risk management program designed to assess, identify, and manage risk associated with cybersecurity threats. Our cybersecurity risk management program (the "Program") is consistent with the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, which incorporates bank regulatory guidance and principles from the National Institute of Standards and Technology Cybersecurity Framework and includes the following risk-based principles: Identification, measurement, mitigation, monitoring and reporting of cybersecurity threats based on internal and external information sharing and resources; Safeguards designed to protect against identified threats, including documented policies and procedures, controls, and employee education and awareness;

companyName: F&M BANK CORP

ticker: FMBM


text: Processes to detect cybersecurity events and improve incident response, including routine testing of incident response, recovery and business continuity plans and processes; and Third-party risk management process to manage cybersecurity risk with service providers, suppliers, and vendors.


text: The Program is designed to adapt to an evolving landscape of emerging cybersecurity threats and advancing technology to determine the Company's cybersecurity preparedness. Through routine data gathering, emerging risks, internal incidents, technology investments and internal controls, our Program and overall cybersecurity risk strategy is adjusted as needed.


text: The Program is supported by regular training of information security employees and awareness training and activities for executives, directors, and employees through which we communicate our cybersecurity policies, standards, processes, and practices to foster a culture of cybersecurity risk management across the Company.


text: Integrated Risk Management The Program is integrated into the Company's enterprise risk management framework and functions to identify risk, form a strategy to manage risk, implement the strategy, test the implementation, and monitor our technology environment to control risk. The information technology team works closely with stakeholders across security, risk, compliance, operations, other business stakeholders, and senior leadership to conduct an annual cybersecurity risk assessment utilizing the FFIEC Cybersecurity Assessment Tool.


text: Engagement of Third Parties in Connection with Risk Management The Company engages various third parties to evaluate the effectiveness and maturity of the Program. The Company engages an independent third party to audit the cybersecurity risk strategy and preparedness. The Company also maintains cybersecurity insurance, however, the costs related to cybersecurity threats or disruptions may not be fully insured. The Company also engages third parties to perform regular penetration tests, vulnerability scans, disaster recovery tests and cyber exercises to simulate threat actor attacks. Our relationships with third parties enable us to leverage their cybersecurity expertise and industry knowledge to assess our Program and adjust as needed.


text: Oversight of Third-party Risks Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could impact the Company in certain circumstances. In response, we have implemented processes for overseeing and managing these risks. The processes include limiting the exposure of our information systems to external systems to the least practical amount, assessing the third parties' information security practices before allowing them to access our information systems or data, requiring third parties to implement appropriate cybersecurity controls in our agreements with them, conducting ongoing monitoring of their compliance with those requirements, and requiring third parties to agree to contractual requirements designed to ensure cybersecurity concepts are appropriately addressed.


text: Risks from Cybersecurity Threats As of the date of this report, we have not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Board of Directors Oversight Our Board's Operational Risk Committee oversees cybersecurity risk.


text: Management's Role in Cybersecurity Risk Management Given the important role of technology in the Company's operations and customer service, the Company has established an Information Technology Steering Committee, which consists of our IT Manager, President, Chief Financial Officer, Chief Experience Officer, Director of Risk Management and Information Security Officer. The Information Technology Steering Committee reviews, monitors, aligns, and prioritizes all significant strategic information technology initiatives and security risks. The Information Technology Steering Committee reports to the Operational Risk Committee and minutes of the committee's meetings are subsequently reported by the Operational Risk Committee to the Company's Board of Directors. Our IT Manager, in collaboration with our Information Security Officer, makes quarterly reports to the Information Technology Steering Committee. Such reports include updates related to key metrics, key risk indicators, key performance indicators, penetration test results, risk assessment results, project updates, incident reports, compliance matters, and operational issues.


text: Risk Management Personnel The Information Security Officer has the primary responsibility for managing the Program to identify, assess, manage, and control cybersecurity risk. The Information Security Officer reports directly to the President. The Information Security Officer has approximately 15 years of experience in cybersecurity, information security risk management, identity and access management, security architecture, vulnerability management, threat intelligence, security operations and incident management and response.


text: Monitoring Cybersecurity Incidents The Information Security Officer is continually informed of and monitors cybersecurity risks and incidents. In the event of a cybersecurity incident, the Company has developed an incident response plan to timely report cybersecurity incidents to the executive management team, the Operational Risk Committee and Board of Directors, as necessary. In addition to facilitating timely evaluation, escalation and reporting of cybersecurity incidents, this plan also sets forth the process for identifying and assessing the severity of cybersecurity incidents, as well as monitoring post-incident mitigation and remediation.


text: Reporting to Board of Directors The Operational Risk Committee receives reports from the President, Information Security Officer, and Director of Risk Management, and briefings on our information security and enterprise risk management programs at least quarterly, including the results of any external audits, bank regulatory examinations and evaluations, as well as maturity assessments of our information security program.


text: CYBERSECURITY GOVERNANCE The Company's Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. The Audit Committee of the Board of Directors is responsible for board-level oversight of cybersecurity risk, however the full Board is typically present for Information Technology (IT) and Cybersecurity briefings. As part of it's oversight role, the Audit Committee receives reporting about the Company's cybersecurity program, activities, threats and incidents (if any) through periodic updates. The cybersecurity program is managed by our outsourced IT infrastructure team with oversight and coordination by our CFO, who reports directly to our CEO. Utilization of an outsourced IT infrastructure team allows Data I/O to access the necessary breadth and depth of leading cybersecurity programs, staff, expertise, and tools. The IT infrastructure team monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity function, including the operation of the Company's incident response plans, which include appropriate escalation to the CFO, CEO and the Audit Committee.

companyName: DATA I/O CORP

ticker: DAIO


text: Our cybersecurity risk management program includes the following: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: 374Water Inc.

ticker: SCWO


text: CYBERSECURITY RISK MANAGEMENT AND STRATEGY The Company has processes in place to identify, assess, and monitor material risks from cybersecurity threats, which are part of the Company's overall cybersecurity risk management and have been embedded in the information systems operating procedures and internal controls. Our IT function manages IT operations and continually evolves and enhances our systems to meet the constantly changing digital environment. Periodic cybersecurity risk assessments are performed to identify, assess, and prioritize potential risks to information, data assets, infrastructure and third party vendors. Additionally, a third-party review and testing of the financial controls over IT as part of our Sarbanes-Oxley internal controls testing is performed annually. The Company addresses significant risks through corrective or mitigating actions as necessary.


text: The Company has also established cybersecurity and information security awareness training programs. Employees with access to the Company's network receive annual training on topics such as phishing, malware, and other cybersecurity risks. Training is administered and tracked through online learning modules with ongoing follow-up testing. All employees and contractors enter into non-disclosure confidentiality agreements. We work to continually evolve our systems to meet the constantly changing digital environment and continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.


text: There have been no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. The nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on the Company's business, financial conditions or results of operations. For more information about the cybersecurity risks we face, refer to the Risk Factors in section "Cybersecurity Risks" in Part I, Item 1A, "Risk Factors".


text: Risk management and strategy We depend on our information technology to conduct our business operations. This technology is predominantly operated on third-party platforms and services. Our business servers are owned and managed by an experienced third-party provider that addresses issues promptly in the event of a cybersecurity threat or incident.

companyName: Lowell Farms Inc.

ticker: LOWLF

stage1Category: Third-Party Risk


text: We have tailored our business applications and hosting services to reduce the impact of cybersecurity incidents. We utilize the Google Cloud Suite for email, office documents, and communication. Our ERP and Financial System operate on RDP and SQL server, which are backed up nightly through a SQL backup. All our servers are backed up to tape and transferred off-site every night. Our third-party provider has the necessary tools to restore and clone servers in a timely manner.


text: Our strategy to mitigate cybersecurity risks includes monitoring and detection efforts, and the deployment of the anti-malware application ESET on all workstations and servers. The management of our Anti-Virus and Anti-Malware is performed by an experienced third party provider. Regarding third parties that manage or utilize our information technology or data, we conduct continuous monitoring of all third-party providers to ensure they adhere to our cybersecurity standards. To date, we have not experienced cybersecurity threats or incidents that have significantly impacted our business.


text: Our Board of Directors delegates the responsibility for cybersecurity oversight to the Audit Committee and our VP of Integration and IT Operations, who also manages our general technology risk.


text: Our VP of Integration and IT Operations collaborates closely with our information technology partners to pinpoint new risks and evaluate our risk management framework. This team includes employees familiar with our products and systems who also possess experience in managing cybersecurity risks.


text: The VP of Integration and IT Operations regularly updates the Audit Committee on cybersecurity-related risks. Our incident response plan involves informing the Management Team and then the Board of Directors about any substantial threats or incidents that occur.


text: The Company has a cybersecurity strategy designed to protect our information systems and data from an evolving cyber-threat landscape. Our cybersecurity program, administered by the Company's Senior Network Administrator and overseen by the Audit and Compliance Committee, has the support of executive leadership and the Board of Directors, and the Company continues to invest in cybersecurity to protect the Company's systems.

companyName: TENAX THERAPEUTICS, INC.

ticker: TENX


text: Our cybersecurity program focuses on all areas of our business, including cloud-based environments, devices used by employees and contractors, facilities, networks, applications, vendors, disaster recovery, business continuity and controls and safeguards enabled through business processes and tools. We continuously monitor for threats and unauthorized access. We learn of security threats through automated detection solutions as well as reports from users and business partners. We draw on the knowledge and insight of external cybersecurity experts and vendors and employ an array of third-party tools to secure our information infrastructure and protect systems and information from unauthorized access.


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: As of the date of this Annual Report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For more information on our cybersecurity related risks, see "Risk Factors - Risks Related to Our Industry" included elsewhere in this Annual Report on Form 10-K.


text: We have established procedures for evaluating, recognizing, and managing significant risks stemming from potential unauthorized events occurring on or through our electronic information systems. These procedures comprise an important part of our overall enterprise risk management systemand are aimed at preventing, detecting, or mitigating data breaches, theft, misuse, unauthorized access, or any other security incidents or vulnerabilities affecting digitally stored data. Internally we have an Internet, Email and Computer Use Policy and all of our employees have been trained on the policy and related tools. Additionally, we employ processes to manage and identify risks arising from cybersecurity threats linked to supplier and customer relationships and our utilization of third-party technology and systems.

companyName: ENDRA Life Sciences Inc.

ticker: NDRA


text: We adhere to a risk management framework based on applicable laws and regulations to handle cybersecurity risks across our products, services, infrastructure and corporate assets. We regularly conduct risk assessments to gauge the effectiveness of our systems, identifying areas for improvement. These processes enable us to make informed, risk-based decisions and prioritize cybersecurity measures and risk mitigation strategies. Our risk mitigation efforts encompass a range of technical and operational actions.


text: Our cybersecurity risks and related responses are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by our Board of Directors. Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents. However, we cannot guarantee that our efforts will prevent any cybersecurity incident from occurring.


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have, or are likely to, materially affect us, our business strategy, results of operations, or financial condition.


text: The banking industry is increasingly reliant on information technology systems and digital platforms to conduct business operations, process transactions, and interact with customers. As a result, we are exposed to various cybersecurity risks, including but not limited to Cyber attacks: We are vulnerable to cyber attacks including malware, phishing, ransomware, and denial-of-service attacks, could disrupt operations, compromise sensitive information, and result in financial losses.

companyName: COMMUNITY BANCORP /VT

ticker: CMTV


text: Data Breaches: Despite implementing robust security measures, systems and networks may be breached, leading to unauthorized access to customer data, proprietary information, or intellectual property.


text: Third-Party Risks: We rely on third-party service providers and vendors which exposes the Company to cybersecurity risks associated with systems and processes. A breach or failure in critical systems could impact operations and reputation.


text: Regulatory Compliance: The Company is subject to various regulatory requirements related to cybersecurity, data protection, and privacy. Non-compliance with these regulations could result in financial penalties, legal liabilities, and reputational damage.


text: Reputation Risk: A significant cybersecurity incident could damage the Company's reputation and erode customer trust, leading to customer attrition, negative publicity, and loss of business opportunities.


text: Operational Disruption: Cybersecurity incidents may disrupt operations, including online banking services, payment processing, and customer support, resulting in financial losses and operational inefficiencies.


text: Financial Impact: Cybersecurity incidents may result in direct financial losses, such as fraud-related expenses, remediation costs, and legal fees, as well as indirect costs associated with business interruption and reputational damage. Regular risk assessments and vulnerability testing of systems and networks. Deployment of advanced cybersecurity technologies, including firewalls, intrusion detection systems, and encryption protocols. Employee training and awareness programs to enhance cybersecurity awareness and promote best practices. Incident response and business continuity plans to ensure a timely and effective response to cybersecurity incidents.


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: The Information Security Program is led by the Company's Information Security Officer (ISO) who works with the Privacy Officer, Security Officer, and IT Manager to review and identify security risks and controls within each functional area of the Bank. Risk assessments are updated at least annually or more frequently if circumstances warrant. Status and compliance with the program is reported by the ISO to the Information Technology Steering Committee and the Board annually or more frequently if circumstances warrant. The report discusses material matters relating to the program including the risk assessment; risk management and control decisions; service provider arrangements; results of monitoring and testing; security breaches and management's responses; gaps; and recommendations for changes to the program.


text: However, despite these efforts, we cannot guarantee that these cybersecurity measures will prevent all cyber threats or mitigate all potential impacts. Cybersecurity threats are constantly evolving, and the Company may be susceptible to new and unforeseen risks in the future.


text: In conclusion, cybersecurity risks pose significant challenges to business operations and financial stability. The Company continuously monitors and evaluates its cybersecurity posture to adapt to emerging threats and safeguard customers' information and assets.


text: Risk Management and Strategy Securing our business information, intellectual property, customer and employee data and technology systems is essential for the continuity of our business, meeting applicable regulatory requirements and maintaining the trust of our stockholders. Cybersecurity is an important and integrated part of our enterprise risk management function that identifies, monitors and mitigates business, operational and legal risks.

companyName: ENGLOBAL CORP


text: To help protect us from a major cybersecurity incident that could have a material impact on operations or our financial results, we have implemented policies and controls, including investments in technology tools that focus on cybersecurity incident prevention, identification and mitigation. The steps we have taken to reduce our vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to: software tools to collect, aggregate, and analyze volumes of data from an organization's applications, devices, servers, and users in real-time so security teams can detect and block attacks, establishing information security policies and standards, implementing information protection processes and technologies, and monitoring our information technology systems for cybersecurity threats. We engage a consulting firm on an annual basis to help us test the effectiveness of our internal controls over financial reporting, which includes general controls related to IT. We are currently working with them to update our control environment to include key controls designed to reduce the risks of cybersecurity threats. We also require third-party service providers to provide an annual SOC-1 report, which includes among other assurances that controls are in place to maintain the confidentiality and privacy of the information processed by the service organization. In addition, we annually purchase a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.


text: Our Board of Directors is actively engaged in overseeing and reviewing our strategic direction and objectives of the Company, taking into account our risk profile and related exposures, including oversight of risks from cybersecurity threats. As part of this oversight function and the recognition of the increasing exposure of cybersecurity threats, the Company is in the process of working with the Board on measures to strengthen our cybersecurity program and establishing a more formal process to evaluate and enhance the effectiveness of our cybersecurity policies and procedures. Our management team is responsible for managing risk and bringing to the Board's attention any material near-term and long-term risks to the Company, including risks from cybersecurity threats.


text: Our cybersecurity risk management team is comprised of technically skilled IT professionals with experience in preventing, detecting, mitigating and remediating cybersecurity incidents and testing cybersecurity processes under the leadership of our IT Director, who reports to our Chief Executive Officer. The team works in close coordination with the Chief Financial Officer and Chief Executive Officer on cybersecurity risk management matters. Our IT Director has over 20 years of experience in cybersecurity, data security, IT infrastructure and cloud services. He holds a Bachelor's Degree of Commerce from the University of Karachi.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our operations, business strategy, regulatory compliance, results of operations, or financial condition


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: We have implemented a number of security measures designed to protect its systems and data, including firewalls, antivirus and malware detection tools, patches, log monitors, routine back-ups, system audits, system hardening, penetration testing and privileged access session management. In addition, we have continued its efforts to migrate its platforms to cloud-based computing, which is designed to further strengthen its security posture.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program and receives updates on the cybersecurity risk management program from management at least annually. In addition, management updates the Audit Committee regarding any material or significant cybersecurity incidents, as well as incidents with lesser impact potential as necessary. The Audit Committee reports to the full Board annually regarding cybersecurity.


text: We have not experienced any material cybersecurity incidents. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.


text: Incident Response and Assessment Policies and Procedures We align with industry-standard cybersecurity frameworks designed to protect the company and customer data from unintentional disclosure, cybersecurity events, and other threats of all severity levels. As part of our alignment with these frameworks we our in the process of implementing a Cybersecurity Incident Response Plan that outlines actions to be taken after identifying a suspected information security breach and the people responsible for managing those actions. Additionally, this plan will outline communication responsibilities during incidents of all severity levels.


text: The Company approaches cybersecurity as an enterprise-wide risk and uses external resources to assess risk and manage its IT and 24x7 cybersecurity operations, including managed service providers who assist in the support of key business systems. The Company may also periodically engage external consultants to assist with cybersecurity incident management, particularly where advanced or specialized expertise may be required. If a material cybersecurity breach occurs, the incident will be reviewed by management to determine whether further escalation is appropriate. The Executive Chairman of the Board and Chief Executive Officer and the Interim Chief Financial Officer have primary responsibility for this review and assessment. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive team, and if deemed necessary or appropriate, the Board of Directors. The Board Audit Committee is responsible for reviewing and discussing the adequacy and effectiveness of the Company's information security policies and the procedures and controls regarding information systems. In addition, we plan to consult with outside counsel as appropriate, including on materiality analyses and disclosure matters, and to assist in making the final materiality determination regarding disclosure and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents as appropriate.

companyName: Catheter Precision, Inc.

ticker: VTAK


text: The Company maintains a cyber liability insurance policy that is designed to cover certain expenses, business losses, business interruption, and fines and penalties associated with a data breach or other similar incident. Cyber liability insurance also provides coverage in the event of a ransomware attack.


text: To date, the Company has not had a cybersecurity event that materially impacted or is reasonably likely to materially affect its business strategy, results of operations, financial condition, or the security of its proprietary data.


text: Lendway's cyber environment at December 31, 2023 consisted primarily of outsourced information technology ("IT") operations. The outsourced provider has a cybersecurity framework which includes multiple products implemented to ensure the security of Lendway's environment. Annual internal and external vulnerability scans are also completed to ensure we mitigate any risks proactively. The Company's internal operations are PC based and the PCs have up to date security software. Regular phishing exercises are conducted, and employee awareness training is conducted annually by our outsourced provider.

companyName: BLOOMIA HOLDINGS, INC.

ticker: TULP


text: Our full Board of Directors and our Audit Committee provide oversight of our risk management program, which includes cybersecurity. The Audit Committee, as part of its charter to review the Company's practices with respect to risk assessment and risk management, receives updates on internal control, including those relating to IT general controls and cybersecurity.


text: With the acquisition of Bloomia on February 22, 2024, the Company will include the IT environment of Bloomia in its cybersecurity processes and oversight at the corporate and board level. Bloomia's cybersecurity is managed by a third party vendor.


text: As of the date of this report, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident.


text: We have not experienced a material cybersecurity breach in the past five years and, as a result, there have been no charges related to a breach in the past five years. Moreover, no risks from cybersecurity threats have materially affected our business strategy, results of operations, or financial condition. While we have implemented processes and procedures that we believe are tailored to address and mitigate the cybersecurity threats that we face, there can be no assurances that such an incident will not occur despite our efforts, as more fully described in Item 1A ("Risk Factors – Our business could be adversely affected by a security breach or other attack involving our computer systems or those of one or more of our vendors.") in this Annual Report.

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cyber security threats, as such term is defined in Item 106(a) of Regulation S-K. We have certain processes for assessing, identifying and managing cyber security risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, and protect employee information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards and routine review of our policies and procedures to identify risks and refine our practices. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: TOMI Environmental Solutions, Inc.

ticker: TOMZ


text: We have not encountered cyber security challenges that have materially impaired our operations or financial condition. Additional information regarding risks from cyber security threats is provided at "Item 1A. Risk Factors."


text: Governance; Board Oversight The Audit Committee of our Board provides direct oversight over cyber security risk and provides updates to the Board of Directors regarding such oversight, when and if appropriate. Management provides periodic updates to the Audit Committee regarding cyber security matters including significant new cyber security threats or incidents, when and if appropriate.


text: Cybersecurity Risk Management and Strategy. We depend on software applications, information technology systems, computing infrastructure and cloud service providers to operate our business. Certain of these systems are managed, hosted, provided or used by third parties, to assist in conducting our business and which have their own cyber security measures in place. We implement generally applicable industry standards and best practices processes for the assessment, identification, and management of material risks from cybersecurity threats to our information technology systems. Our Information Security Coordinator oversees our information security policies and procedures. Our Information Security Coordinator maintains a cyber incident reporting and response process and provides management notifications based on the seriousness of any incident. Our information security policies and procedures are required to be reviewed on a regular basis.

companyName: Onfolio Holdings, Inc

ticker: ONFO


text: We have not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations; however, there can be no guarantee that we will not experience such an incident in the future. For a description of the risks from cybersecurity threats that may materially affect our Company and how they may do so, please see "Risk Factors - Risks Related to Information Technology Systems, Intellectual Property and Privacy Laws" included in Part I, Item 1A of this Annual Report on Form 10-K. If our security measures are breached and an unauthorized party obtains access to our proprietary business information, our information systems may be perceived as being unsecure, which could harm our business and reputation, and our proprietary business information could be misappropriated which could have an adverse effect on our business and results of operations."


text: Cybersecurity Governance. Our Nominating and Corporate Governance Committee has primary responsibility for overseeing our risk-management program relating to cybersecurity, although our Board of Directors participates in periodic reviews and discussion dedicated to cyber risks, threats, and protections.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.


text: KICO's Risk Management Committee, which is comprised of representatives of its technology team, assesses risks based on probability and potential impact on key business systems and processes. Risks that are considered high are incorporated into its overall risk management program. A mitigation plan is developed for each identified high risk, with progress reported to the Risk Management Committee and tracked as part of its overall risk management program overseen by the Corporate Sustainability and Risk Management Committee of our Board of Directors.


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary.


text: Additionally, we require security training for all employees on a quarterly basis. The training covers a wide range of topics, including phishing, social engineering and data protection.


text: We assess and identify security risk to the organization by: conducting assessments of risk, including likelihood and magnitude, from unauthorized access, use, disclosure, disruption, modification or destruction of information systems and the related information processes, stored or transmitted;


text: We have established a continuous monitoring strategy and program, which includes: a set of defined security metrics to be monitored; performance of security control assessments on an ongoing basis; addressing results of analysis and reporting security status to the executive team; monitoring information systems to detect attacks and indicators of potential attacks;


text: identification of unauthorized use of the information system resources; and deployment of monitoring devices strategically within the information system environment.


text: Our Corporate Sustainability and Risk Management Committee of the Board of Directors has been delegated the power and authority to oversee and make recommendations to the Board with regard to our overall approach to risks relating to business operations, including with regard to information technology and cybersecurity. In an annual presentation, the committee received a presentation from our Chief Technology Officer regarding our approach to cybersecurity, which included the following topics: the confidentiality of nonpublic information and the integrity and security of our information system, the cybersecurity policies and procedures, material cybersecurity risks to us, and the overall effectiveness of our Company's cybersecurity program.


text: Airship's cybersecurity and risk management program is intended to protect the confidentiality, integrity, and availability of our critical information systems and the data resided on them. Due to the nature of our business and our customers, we face various cybersecurity challenges and threats, including attempts to gain unauthorized access to our codebase, proprietary or confidential information, denial-of-service attacks, attacks from foreign nations, as well as threats to our identity and personnel. We have designed our IT systems and processes with the intention that our solutions should defend against the ever-evolving threat landscape while remaining agile to keep up with such threats.

companyName: Airship AI Holdings, Inc.

ticker: AISP


text: Airship leverages a combination of the NIST Cyber Security Framework alongside the CMMC framework to protect its assets and secure our supply chain for our customers. We use the controls from these frameworks as well as guidelines and best practices from the industry to develop our cybersecurity plan. Our cybersecurity plan and its elements are reviewed regularly to ensure they meet the requirements and expectations of our security needs.


text: Airship's cybersecurity program is spearheaded by their cybersecurity department with approval from executive management. The stakeholders have been identified and know their roles within the cyber security process as well as having all roles be documented.


text: Risk is assessed based on multiple factors. First, our IT team updates and maintains our asset inventory to ensure all assets are included in our risk management process. From there, key assets are identified, and risk is assessed based on business impact, availability of information, and attack feasibility. After the risks have been identified, they are reviewed with the stakeholders for action plans or sign-off on the acceptance of risk.


text: Airship leverages third party applications and software to help identify vulnerabilities within our system's boundaries. These vulnerability lists are used to create remediation plans and are prioritized based on severity and attack feasibility.


text: The Company performs security awareness training with its employees. Our security policy is also provided to employees upon employment providing them with the rules and policies to follow so that proper security practices are understood and performed.


text: An incident response plan has been established which provides detailed information on actions to take in the event of an incident. The incident response plan includes the scope of the plan, establishes the incident response team, details the incident response lifecycle, and provides templates to make the process easier to document and follow. Timelines, communication methods, and notification information are included in the plan to ensure the process can be followed in high pressure situations which can occur during incidents.


text: Business continuity and disaster recovery plans are also a part of our cybersecurity process. Ensuring data continuity in times of disaster or other incidents is important so that proper security is followed in times of impact to our business. Our business continuity and disaster recovery plan includes a list of items that are essential to our business along with RTO and RPO information. The plan lists what each employee in the plan is responsible for and provides contact information.


text: Sensitive and confidential data is a part of business. Airship leverages an encryption and signing policy that identifies the type of information Airship stores and what level of encryption and signing is required for the data. This document also details the overarching requirements for encryption such as allowed cyphers, encryption methods, and key storage.


text: Our cybersecurity program includes, among others: a cybersecurity education program with on-going employee activities, which include frequent phishing simulation and testing and annual training; access management and access controls with periodic reviews;

companyName: SMITH MIDLAND CORP

ticker: SMID


text: Airship has had one cybersecurity incident in the last decade. The Company was the victim of a ransomware virus that encrypted several machines on Airship's corporate network. The threat was quickly identified and isolated before significant damage could be done. The attack did not affect business operations and did not have a significant financial impact on the Company. Most files affected had backup and Airship was able to remove affected files and restore them from backup.

stage1Category: Incident Disclosure


text: We review cybersecurity risk as part of our overall risk-management program. This ensures that cybersecurity risk management remains a meaningful priority in our business strategy and operations. Our risk management strategy for cybersecurity generally includes: Identification: We aim to proactively identify the manners in which our business could be materially impacted by cybersecurity risks.

companyName: SUI Group Holdings Ltd.

ticker: SUIG


text: Assessment: We periodically assess our risks relating to cybersecurity threats, including risks relating to our reliance on third parties. In so doing, we consider the likelihood and impact that could result from the manifesting of such risks, together with the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Management: If deemed appropriate, we design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures.


text: We presently do no engage third parties to assist with evaluating the effectiveness of our risk-management and cybersecurity practices. The Company did not have any material cybersecurity breaches during the year ended December 31, 2023.


text: Our criteria for determining the materiality of cybersecurity incidents includes assessing potential or actual financial impacts, reputational damage, and operational disruptions. In the event of a cybersecurity incident, all material and known facts would be recorded, including their nature, scope and financial implications; and Form 8-K filings required in relation to any material cybersecurity incident would be prepared and timely filed (with any reasons for delayed disclosures being documented in writing). The Company believes these steps will help ensure compliance with SEC requirements and maintain overall stakeholder confidence in the Company.


text: The Audit Committee of our Board of Directors is the governance body involved in, and ultimately responsible for, cybersecurity oversight. They will generally coordinate with our Chief Financial Officer in this regard. If needed, the full Board would be updated on cybersecurity risks and incidents. None of our directors on the Audit Committee nor our Chief Financial Officer have particular experience in cybersecurity matters.


text: In the event of a cybersecurity concern or event, our incident response approach would have our Chief Financial Officer report to our Audit Committee and full Board of Directors, as well as legal counsel.


text: Risk Management and Strategy Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks, and resiliency against incidents. Our cybersecurity risk management processes include accessing security controls, monitoring systems, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We engage a third-party information security officer who maintains, monitors, and ensures the security of our digital assets. We implement risk-based controls to protect our information, the information of our customers, suppliers, and other third parties, our information systems, our business operations, and our products. We maintain security programs that include physical and technical safeguards. We monitor cybersecurity vulnerabilities and potential attacks, and we evaluate the potential operational and financial effects of any threat and of cybersecurity countermeasures made to defend against such threats. We continue to integrate our cyber practices into our enterprise risk management practices, which is overseen by our Board of Directors. In addition, we assess the risks from cybersecurity threats, periodically engage third-party tools to assist us in enhancing and monitoring our cybersecurity risks, primarily spam and suspicious email filters, and regularly back up company information.

companyName: UNITED STATES ANTIMONY CORP

ticker: UAMY


text: We have experienced cybersecurity incidents, primarily related to phishing emails, and may in the future experience, whether directly or indirectly, cybersecurity incidents. While prior incidents have not materially affected our business strategy, results of operations, or financial condition, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations, or financial condition. See risks related to cybersecurity and business disruptions in "Risk Factors" in this Form 10-K.


text: Our Board of Directors is responsible for risk oversight. Our chief executive officer and chief financial officer, with input from and potentially attendance by our third-party information security officer, provide presentations to the Board of Directors on cybersecurity risks or threats as necessary. In the event of a potentially material cybersecurity event, the Chairman of the Board is notified and briefed, and a meeting of the full Board of Directors would be held, as appropriate.


text: Management and the Company's third-party information security officer discuss information technology needs and activity and assess and manage material cybersecurity risks and the Company's practices for the prevention, detection, mitigation, and remediation of cybersecurity incidents, as necessary and appropriate. Our third-party information security officer has 30 years of experience in the IT management field and has consulted with large and mid-size corporations on proper IT processes and security. Our CEO during the year ended December 31, 2023 and our CFO have managed information technology departments during their careers. Our CFO was trained as an auditor and an information technology auditor at the public accounting firm of Ernst & Young LLP and audited public companies, information technology departments, and third-party information technology service providers for 12 years.


text: We use, store and process data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: Fyntechnical Innovations Inc

ticker: FYNN


text: Cyber Risk Management and Strategy Under the oversight of the Board of Directors since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident. We also have a process to require corporate employees to undertake cybersecurity training and compliance programs annually.


text: We utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing.


text: Further, we have processes in place to evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that will have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement, and system monitoring.


text: We continue to evaluate and enhance our systems, controls, and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems.


text: We use, store and process data for and about our customers, employees, partners, and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: Laser Photonics Corp

ticker: LASE


text: Cyber Risk Management and Strategy Under the oversight of the Board of Directors and Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident. We also have a process to require corporate employees to undertake cybersecurity training and compliance programs annually.


text: Further, we have processes in place to evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that will have access to Company data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement, and system monitoring.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, please see Item 1A. Risk Factors, the section titled "Risk Factors—Risks Related to our Business and Our Industry— Internalsystem or service failures could disrupt our business and impair our ability to effectively provide our services and products to our customers, which could damage our reputation and adversely affect our revenues and profitability." and " As a U.S. defense contractor, we are vulnerable to security threats and other disruptions that could negatively impact our business. "


text: Risk Management Oversight and Governance The Board of Directors has oversight of the Company's cybersecurity program and has delegated the quarterly assessments and management of cybersecurity risks to the Audit Committee.


text: Our IT Manager and our IT Administrator oversee our information security program and lead our information security team. Our IT Manager has primary responsibility for assessing and managing our cybersecurity threat management program, informed by over ten years of experience leading cross-functional organizations in the development and operation of large-scale systems.


text: Our IT Manager reports quarterly to the Audit Committee of the Board of Directors on the information security program and related cyber risks and provides an annual update to the Board of Directors on the Company's overall risk management strategy, which includes addressing cybersecurity risks. Any cybersecurity incidents at the Company are reported to the Audit Committee by the IT Manager.


text: We place the utmost importance on the security of our systems and the data we handle. We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes.

companyName: TPT GLOBAL TECH, INC.


text: To identify and assess risks from cybersecurity threats, we evaluate a variety of developments including threat intelligence, vulnerabilities of third parties, including any auditors or consultants who advise on our cybersecurity systems, evolving regulatory requirements, and observed cybersecurity incidents, among others. We regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify any areas for remediation and opportunities for enhancements. The results of such assessments are evaluated by management and reported to our board of directors, and we continue to adjust our cybersecurity policies, standards, processes, and practices as necessary.


text: Our Board is responsible for the oversight of risks from cybersecurity threats and directly oversees our cybersecurity policies and practices, internal controls regarding information security, and compliance with legal and regulatory requirements regarding cybersecurity risks. The Board receives regular reports and updates on cybersecurity matters from our management, including developments on existing and new cybersecurity risks and how management is addressing and/or mitigating such risks, cybersecurity and data privacy incidents (if any), the status of key information security initiatives, vulnerability assessments, as well as on existing and emerging threat landscapes. Additionally, on at least an annual basis, the Board reviews and discusses with management our policies and programs with respect to cybersecurity threats.


text: We do not have a dedicated security team, but our Chief Executive Officer monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in accordance with our incident response and recovery plans. Threats and incidents that are identified as potentially significant are promptly reported to the Board. Our dedicated CEO has over 20 years of experience in managing and monitoring cybersecurity.


text: While risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. See "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K for further information regarding cybersecurity risks.


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity program is designed to protect its assets and information, and to maintain the secure storage and of proprietary information relating to our customers, employees, applicants, vendors, and other parties, including financial information and personal information. The Company's cybersecurity program is formed using a risk-based approach with recommendations from cybersecurity consultants, cybersecurity insurers, and other third-party consultants.


text: Our Board of Directors has overall responsibility for risk oversight and oversees the implementation and continuous improvement of our cybersecurity program and compliance with disclosure requirements. The Board of Directors receives regular reports and periodic briefings from the Chief Financial Officer on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities. Our cybersecurity program is overseen by the Chief Financial Officer in conjunction with a third-party service provider. The third-party service provider has the primary responsibility for the Company's cybersecurity risk management program. At the time an incident is identified, the Company completes an evaluation and summarizes the incident that is shared with the Board of Directors to effectively manage resources to reduce risk and prevent future incidents.


text: Incident Disclosure To date, the Company has been subject to cyber related incidents, as previously disclosed in the Company's Quarterly Report for the quarters ended June 30, 2023 and September 30, 2023 and within this Annual Report. Since the identification of the incident, we have implemented additional safeguards designed to detect and prevent cybersecurity events that may have a material adverse effect on the Company.


text: Cybersecurity Risk Management and Strategy Assessment, identification and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes to promote a company-wide culture of cybersecurity risk management. Our Chief Financial Officer is responsible for the evaluation of material risks from cybersecurity threats and reports to both the Company's executive management team and the Audit Committee of the Board of Directors. We also regularly use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including cybersecurity consultants, as well as data backup and recovery providers.

companyName: Loop Industries, Inc.

ticker: LOOP


text: We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature ("Information Systems and Data").


text: The Chief Financial Officer is responsible, with the support of the Company's internal IT staff and external service providers, for helping to identify, assess and manage the Company's cybersecurity threats and risks, using internal resources as well as third-party service providers, by monitoring our threat environment using, among other things, manual processes, automated tools, internal audits, threat and vulnerability assessments, evaluating threats reported to us, evaluating our risk profile, and subscribing to reports and services that identify cybersecurity threats.


text: We implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include amongst others data encryption, risk assessments, network security and access controls, physical security, asset management, and systems monitoring. In addition, to oversee and identify any risks associated with our use of third-party service providers, we review Service Organization Controls reports of such third-party service providers when onboarding the provider and annually thereafter.


text: To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools, some of which are managed by a third-party service provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Cybersecurity threats have not materially affected the Company, including its business strategy, results of operations or financial condition. The Company does not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which it is aware are reasonably likely to materially affect the Company.


text: Cybersecurity Governance Our Board of Directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. Pursuant to the Audit Committee Charter, the Audit Committee of the Board of Directors oversees management's processes for identifying, monitoring and addressing enterprise risks. In addition, the Audit Committee of the Board of Directors discusses with management the adequacy and effectiveness of the Company's policies and procedures regarding information technology risk management and internal controls related to cybersecurity.


text: Our Chief Operating Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Operating Officer, who leads a team responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, has extensive experience and background in information technology, cybersecurity, enterprise strategy, risk management. Additionally, our Chief Operating Officer chairs our Cybersecurity Incident Response Team, which is responsible for prevention, identification, containment, eradication and remediation of cybersecurity incidents.

companyName: AEHR TEST SYSTEMS

ticker: AEHR


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of the Company's management. In particular, the Chief Financial Officer is responsible for hiring appropriate personnel and engaging external service providers with relevant cybersecurity expertise, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes and technologies, and reviewing security assessments and other security-related reports. In addition, the Chief Financial Officer provides reports to the Audit Committee concerning the Company's cybersecurity posture and significant threats and risks and the processes to address them.


text: Our security incident response plan ("SIRP") is designed to escalate certain cybersecurity incidents to members of the Company's executive management team depending on the circumstances. The Chief Financial Officer and relevant department heads work with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. The SIRP provides for escalation of potentially material cybersecurity incidents to the Audit Committee.


text: Cybersecurity Risk Management and Strategy We have established processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. To prevent, detect and respond to information security threats, we maintain a cyber risk management program that employs Cyber Security Framework ("CSF") in accordance with the National Institute of Standards and Technology ("NIST") security framework. CSF is a set of voluntary guidelines that help organizations assess and improve their cybersecurity posture by implementing processes for identifying and mitigating risk, and detecting, responding to and recovering from cyberattacks.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.


text: Our Security Awareness Program includes training that reinforces our information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by Company-wide testing initiatives.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers or who have access to our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We are exposed to cybersecurity threats or incidents."


text: Cybersecurity Governance One of the key functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee has primary responsibility for oversight of information security risks, including fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks, and provides regular updates to the Board of Directors on such matters. The Audit Committee receives regular reports from our Chief Operating Officer on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. Information security risk is a significant oversight focus area for the Audit Committee, as well as the entire Board of Directors. Over the course of fiscal year 2024, the Audit Committee received four separate cybersecurity briefings from our Chief Operating Officer.


text: Cybersecurity Risk Management and Strategy We have established and implemented a comprehensive cybersecurity risk management program aimed at safeguarding the confidentiality, integrity, and availability of our critical information technology ("IT") systems and sensitive information.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: Our cybersecurity risk management program is fully integrated within our broader enterprise risk management framework, leveraging consistent methodologies, incident reporting channels, and governance processes. These approaches are used not only for cybersecurity risks but also for managing other areas of risk, including legal, compliance, strategic, operational, and financial. The program is continuously assessed and refined, using the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") as a guiding tool to identify, prioritize, and manage cybersecurity risks that could significantly affect our operations, financial performance, or business objectives.


text: Cybersecurity Incident Response Plan ("CIRP"): Our CIRP ensures we are prepared to respond to, report, and remediate any cybersecurity incidents effectively. Led by the Chief Information Officer ("CIO"), our corporate compliance and risk management team manages all aspects of incident response. For significant incidents, additional third-party resources would be mobilized to mitigate impact on the business.


text: Continuous Vulnerability Management: We continuously monitor our IT networks and legacy systems to identify threats that may adversely affect critical systems and information, ensuring that our broader IT environment remains secure.


text: Third-Party Cybersecurity Consultants: We engage trusted third-party cybersecurity experts to enhance our security posture, perform assessments, and provide strategic guidance, ensuring continuous improvement in our cybersecurity approach.


text: Cybersecurity Awareness Training: Employees, incident response teams, and senior management undergo regular training to ensure awareness of evolving cybersecurity threats and the appropriate responses.


text: Risk Management for Third-Party Providers: We conduct due diligence when selecting and periodically reviewing third-party service providers, suppliers, and vendors to ensure they comply with necessary cybersecurity standards.


text: Cybersecurity Governance Our executive team and Board of Directors are actively involved in overseeing cybersecurity risks. The executive team and the CIO oversee the Company's information security efforts and cybersecurity governance. This team regularly reviews our cybersecurity posture and any significant incidents that have occurred.


text: The management of our cybersecurity risks is led by the CIO and the executive team who bring over 35 years of combined experience in cybersecurity, IT, and risk management. This team is responsible for the overall cybersecurity risk management program, collaborating with internal teams, external consultants, and cross-functional divisions. Their efforts are supported by threat intelligence from various sources, and they regularly benchmark our security practices against the NIST CSF.


text: Our CIO reports regularly to the executive team, providing updates on cybersecurity strategies, current threats, and long-term planning. Additionally, the CIO provides an annual cybersecurity update, presenting an overview of significant cybersecurity risks and their potential impact on internal controls.


text: In the event of a significant cybersecurity incident that escalates to a corporate crisis, the executive team and the Board will be engaged in alignment with the corporate compliance and risk protocols.


text: While LightPath Technologies faces various cybersecurity threats as part of routine operations, no risks have been identified to date that could materially impact the company's operations, strategy, financial condition, or overall business performance.


text: We have established certain processes for identifying, evaluating, and managing material risks from cybersecurity threats as a part of our overall technology management strategy. These processes are designed and reassessed on a periodic basis to help protect our technology assets and operations from internal and external security threats.

companyName: PALATIN TECHNOLOGIES INC

ticker: PTNT


text: We engage third parties to assess the effectiveness of our cybersecurity and technology management strategy and continue to seek to implement new, and improve existing, processes regularly to adjust for changes in technology, internal or external threats, business strategy, and regulatory requirements. We, and our third parties, have deployed managed detection and response services to monitor our technology infrastructure and information systems for possible threats. Our technology management strategy also includes ongoing security training and education for employees regarding threats, including their role and responsibility in detecting and responding to such threats.