text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: ZEVRA THERAPEUTICS, INC.

ticker: ZVRA

secItem: Item 1C


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.


text: cybersecurity awareness training of our employees and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO

stage1Category: Risk Management Process

stage1Method: unanimous


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Our management team, including R. LaDuane Clifto n, Chief Financial Officer, Secretary and Treasurer, i s responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our r etained external cybersecurity consultants. Our management team includes IT staff with more than 40 years of combined experience in various roles involving managing information security, managing privacy and data protection, evaluating cybersecurity risks, developing cybersecurity strategy, and implementing cybersecurity programs.

stage1Category: Management Role

stage1Method: majority


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: We depend on information technology and systems for various operations (including refinery processes and refined product loading) and for capturing accounting, technical and regulatory data for reporting, analysis, and archiving. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. As of the filing date of this report, our risk assessment process related to cybersecurity includes conducting vulnerability assessments using a combination of internal and third-party capabilities to perform technical assessments, vulnerability scanning, and incident and event monitoring. We are working to establish a thorough, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners, and we anticipate that such a program will follow well-organized cybersecurity frameworks under a central control figure.

companyName: BLUE DOLPHIN ENERGY CO

ticker: BDCO


text: We did not experience a significant cybersecurity breach or associated expenses, penalties, or settlements for the twelve months ended December 31, 2023 and 2022.

stage1Category: Strategy Integration


text: We have made cybersecurity and the protection of our customer's data a top priority. The critical areas that we consider for our evolving cybersecurity program include access control; data encryption; SSDLC/change management; BCP/DRP; endpoint security; patch management; vulnerability assessments; compliance management; data privacy; incident response; monitoring, alerting, and lodging; employee training; and cyber insurance.

companyName: Fluent, Inc.

ticker: FLNT


text: Risk Management & Strategy Our cyber risk management program is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. To help protect our company from a major cybersecurity incident that could have a material impact on operations or our financial results, we have implemented policies, procedures, programs and controls, including investments in technology that focus on cybersecurity incident prevention, identification and mitigation. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST"). We execute an NIST 800 - 53 review annually and use the results of existing cyber risks to prioritize projects designed to address these gaps and create a go-forward strategy. Our internal and external auditors review our IT and cybersecurity controls annually for design and operating effectiveness.


text: Our Cybersecurity Program is governed by the Company's IT and Legal and Compliance teams. Our Chief Technology Officer ("CTO") has over 20 years of experience in marketing technology and analytics. Our Vice President of IT Governance, Risk and Compliance ("VP of IT") has over 20 years of experience in IT internal and external audits, IT consulting, and governance, risk, and compliance. Our General Counsels regularly coordinates with the IT team on data security and compliance issues. The CTO and General Counsels report directly to the Chief Executive Officer ("CEO"), so any material issues are raised to CEO, and a status of key cybersecurity projects and any material breaches is provided quarterly to the Board's Audit Committee, which includes both an internal and external audit.


text: Incident Disclosure and Materiality Our incident management procedures include identification, evaluation, definition, and escalation based on the determination of materiality. This determination involves the Company's IT and Legal and Compliance teams, executive officers, and cyber insurance provider. Breach notifications and escalation to the Audit Committee would also be based on the materiality determination. Each quarter, the VP of IT provides an update on key cybersecurity projects and any material breaches at the quarterly Audit Committee meeting, at which both the internal and external auditors are present.


text: While we did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition. See Item 1A. "Risk Factors" for more information on our cybersecurity-related risks.


text: Management is responsible for the implementation of risk management strategies and for the operational oversight of company-wide cybersecurity strategy, policy, and standards to assess and prepare us to address cybersecurity risks. We have evolving processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from cyber threats, protect employee and corporate information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, and routine review of our policies and procedures to identify risks and refine our practices. We engage independent third parties to assess and implement our cybersecurity procedures and enhance our oversight.

companyName: Progressive Care Inc.


text: The NGC receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We are not aware of any cybersecurity incidents that could have a material impact on our business strategy, results of operations, or financial condition.

stage1Category: Board Governance


text: NextPlat uses, stores, and processes data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems, and our business operations.

companyName: NextPlat Corp

ticker: NXPL


text: Cyber Risk Management and Strategy Our cybersecurity risk management processes are being integrated into our overall risk management processes. We are making efforts to incorporate cybersecurity considerations as a part of our business processes. We engage with external cybersecurity experts, including assessors, consultants, and auditors, to enhance our cybersecurity measures and ensure compliance with industry best practices. We have established processes to oversee and manage cybersecurity risks associated with our use of third-party service providers, ensuring they adhere to our security standards. We review third-party service provider contracts to ensure they contain data privacy and security provisions, aligning with our standards and regulatory requirements. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks.


text: Risk Management Oversight and Governance The Board of Directors has oversight of the Company's cybersecurity program. Our management team, in consultation with the Board of Directors, is responsible for monitoring, preventing, detecting, mitigating and remediating cybersecurity incidents.


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program, and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. In general, the Adviser seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Adviser's information systems or the information that the Adviser collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Firsthand Technology Value Fund, Inc.

ticker: SVVC


text: Identification and Reporting: The Adviser has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Adviser's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner.


text: Technical Safeguards: The Adviser implements technical safeguards that are designed to protect the Adviser's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary.


text: Incident Response and Recovery Planning: The Adviser has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Adviser's response to a cybersecurity incident. The Adviser conducts occasional tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.


text: Third-Party Risk Management: The Adviser maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors and service providers Education and Awareness: The Adviser provides periodic training for all levels of personnel regarding cybersecurity threats as a means to equip the Adviser's personnel with effective tools to address cybersecurity threats, and to communicate the Adviser's evolving information security policies, standards, processes, and practices.


text: Technological safeguards that are designed to protect the Company's information systems from cybersecurity threats, including the prevention and detection of systems, access controls, and firewalls, which the Company assesses the vulnerability and cybersecurity threat and makes necessary improvements. Utilization of third parties as part of the Company's risk-based approach in identifying and overseeing cybersecurity risks.

companyName: Perma-Pipe International Holdings, Inc.

ticker: PPIH


text: The Adviser conducts periodic assessment and testing of its policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events The results of such assessments and reviews are evaluated by management and reported to the Board, and the Adviser adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.


text: The Board, in coordination with the Adviser, oversees the Company's risk management program, including the management of cybersecurity threats. The Board receives regular updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company. The Board also receives prompt and timely information regarding any material cybersecurity risk, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Risk Management and Strategy We recognize the importance of cybersecurity risk management and have a defined strategy to support our business operations, platforms and information systems. We have implemented a comprehensive cybersecurity program to protect information systems and data. We have based our cybersecurity program on defined industry accepted frameworks with the goal of building enterprise resilience against an evolving cybersecurity threat landscape and to respond to cybersecurity threats as they materialize. Our program includes identification, assessment, monitoring, and management components, as well as informational and escalation components designed to inform management and the Board of prospective risks and developments.

companyName: Super League Enterprise, Inc.

ticker: SLE


text: Our cybersecurity program encompasses functions dedicated to both proactive and reactive management of cybersecurity threats. We implement our cybersecurity program internally through maintaining cybersecurity policies; deploying updated security technologies; and using third-party services and consultants to support and improve our cybersecurity program. Our proactive management of cybersecurity risks entails many actions, including actively monitoring our information technology systems; engaging service providers to monitor and, as appropriate, respond to cybersecurity threats; developing and updating incident response plans to address potential cybersecurity threats; and training our personnel on cybersecurity. We engage third-party auditors and consultants and leverage our internal information security, audit, and compliance functions to assess various facets of our cybersecurity program. We also maintain enterprise-wide processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.


text: We assess cybersecurity contingencies within our overall business continuity risk management planning process. Our information technology and information security teams utilize various technology tools to prevent, monitor, detect, and respond to cybersecurity threats. Our incident response policy outlines processes, roles, responsibilities, notifications, and other communications applicable to the assessment, mitigation, and remediation of realized cybersecurity events. The nature and scope of assessed risk of a realized cybersecurity event dictates the pace and extent of relevant processes, and communications, including an evaluation of any necessary or required disclosure. Depending on its nature and scope, a cybersecurity threat may be managed within our IT Department, responsible for day-to-day management of cybersecurity risks, and escalated to our executive management team, the Board, and the Audit Committee, as appropriate.


text: We have not historically been materially impacted by risks from cybersecurity threats and, as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, the breadth and scope of cybersecurity threats have grown over time and our systems and networks may be the target of increasingly sophisticated cyberattacks. For more information on our cybersecurity risks and their potential impact to our business, see Item 1A, " Risk Factors-Risks related to Our Business and Industry - We may experience security breaches and cyber threats " and Item 1A, " Risk Factors-Risks related to Our Business and Industry - Our business could be adversely affected if our data privacy and security practices are not adequate, or perceived as being inadequate, to prevent data breaches, or by the application of data privacy and security laws generally."

stage1Category: None/Other


text: Our board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the " Committee ") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: Our IT Department updates management on cybersecurity matters, including risk assessments, security controls, incident response procedures, employee training and Third-Party Risk Management.


text: The Committee oversees the Company's cybersecurity risk management and strategy, while management is responsible for implementing the Company's cybersecurity program. This approach ensures that cybersecurity risks are appropriately prioritized and managed throughout the organization.


text: Our Chief Platform Officer has 25 years of experience in information technology, including cybersecurity, and is supplemented by our VP of Devops, who also has over 15 years of experience in audit, compliance, and cybersecurity, and maintains IT and Ops professional certifications. In addition to the IT Department, the VP of Devops may call upon other business and legal stakeholders across our company to help manage cybersecurity threats and incidents. Our Audit Committee is responsible for oversight of our programs, policies, procedures, and risk management activities related to information security and data protection. The Audit Committee meets periodically with the Chief Platform Officer to discuss threats, risks, and ongoing efforts to enhance cyber resiliency, as well as changes to the broader cybersecurity landscape. Our Board also periodically participates in presentations on cybersecurity and information technology from internal leadership. In addition to periodic presentations, management promptly updates our Board and Audit Committee regarding significant threats and incidents as they arise.


text: We have implemented an enterprise-wide information security program designed to identify, protect, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our program utilizes various security tools to safeguard our information systems, aiding in prevention, identification, escalation, investigation, resolution, and recovery from vulnerabilities and security incidents. Examples of such security tools include internal reporting systems, monitoring and detection tools, third -party penetration testing and security assessments and a bug bounty program engaging security researchers. In addition, we have adopted a comprehensive incident response plan and process for detecting, mitigating, and investigating cybersecurity incidents, which employees, under the leadership of the Company's Chief Information Security Officer ("CISO"), regularly test through table-top exercises, testing of our security protocols through additional techniques such as penetration testing, debriefing after security incidents to improve our security and responses, and regular briefing to our directors and officers on our cybersecurity risks and preparedness.

companyName: Skillsoft Corp.

ticker: SKIL


text: Our global information security program is led by our CISO, who brings over 20 years of industry experience. Regular reports on cybersecurity threats, assessments, and findings are provided by the CISO to senior management and relevant teams. In addition, the CISO provides quarterly updates to the Board Audit Committee. The Board oversees annual enterprise risk assessments, with the Audit Committee specifically tasked with overseeing cybersecurity risks.


text: Additionally, we maintain a third -party security program to assess, prioritize, and mitigate risks associated with our vendors and partners. We also rely on third parties to implement appropriate security measures.

stage1Category: Third-Party Risk


text: Regular risk assessments evaluate cybersecurity and technology threats, employing a widely adopted risk management model to prioritize risks and develop corresponding security controls. Our information security program undergoes regular reviews, audits, tests, and exercises to ensure effectiveness and enhance security measures.


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, we have not experienced any cybersecurity incidents that resulted in a material effect on our business, results of operations, or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third -party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our Company, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "We are regularly subject to cybersecurity and other similar attacks. If our security measures are breached or unauthorized access to customer data is otherwise obtained, our platforms may be perceived as insecure, we may lose existing customers or fail to attract new customers, our reputation may be harmed, and we may incur significant liabilities."


text: The Company's Board of Directors (the " Board ") recognizes the importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is responsible for overseeing the Company's risk management process, and cybersecurity represents a component of the Company's overall approach to enterprise risk management (" ERM "). In general, the Company seeks to address cybersecurity risks through an approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Charlie's Holdings, Inc.

ticker: CHUC


text: Collaborative Approach: The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: The Company engages in the occasional assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. The results of such assessments, audits and reviews are reported to management and the Board when necessary, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Board, in coordination with management, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. Key members of the management team monitor and assess a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and key executives discuss the Company's approach to cybersecurity risk management.


text: The Company's Chief Operating Officer ("COO"), Chief Financial Officer ("CFO") and retained third party cybersecurity providers work collaboratively across the Company to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communications, this group monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Board when appropriate.


text: Cybersecurity threats, including any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. See the Risk Factor titled " We are subject to cyber-security risks, including those related to customer, employee, vendor or other company data and including in connection with integration of acquired businesses and operations " for a discussion of risk associated with cybersecurity.


text: The Company has established protocols for evaluating, identifying, and mitigating significant risks stemming from cybersecurity threats. These protocols are integrated into the Company's overarching risk management framework, including potential risks arising from the utilization of third-party service providers. Furthermore, the Company has instituted monitoring procedures to proactively address and minimize risks associated with data breaches or security breaches originating from external sources. Periodically, the Company may enlist the expertise of third-party consultants, legal advisors, and audit firms to assess and fortify its risk management systems, as well as to manage and resolve specific cybersecurity incidents, as deemed necessary.

companyName: BLUM HOLDINGS, INC.

ticker: BLMH


text: Under our enterprise risk management initiative, the Board of Directors ("Board") and the Audit Committee engage in regular discussions with our senior management team, including the Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, to manage cybersecurity threats. The Board and Audit Committee are promptly briefed on any cybersecurity incident surpassing predetermined reporting thresholds, receiving continuous updates until resolution.


text: Cybersecurity threats represent a paramount concern for the Company. Our information systems department collaborates closely with senior management to implement a comprehensive program aimed at safeguarding our information systems and promptly responding to cybersecurity incidents, adhering to established incident response and recovery protocols. Cross-functional teams are deployed across the organization to address and mitigate cybersecurity threats, with senior management overseeing prevention, detection, and remediation efforts in real-time, reporting significant developments to the Board and Audit Committee as necessary.


text: For the fiscal year ending December 31, 2023, no cybersecurity threats were identified that significantly impacted or are expected to significantly impact our business strategy, financial performance, or financial position. However, despite the robust capabilities, processes, and security measures in place, there exists the possibility of undetected vulnerabilities or misjudged risks. While our preventive measures aim to mitigate cybersecurity incidents, absolute security cannot be guaranteed, necessitating ongoing vigilance and adaptability in addressing potential risks.


text: Cybersecurity risk management is part of the Company's overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. We engage with third party service providers to perform penetration tests and to inform us of possible vulnerabilities. In addition, cybersecurity training is provided to all employees on a regular basis but at least annually.

companyName: ThermoGenesis Holdings, Inc.

ticker: THMO


text: The Company maintains an incident plan that addresses the Company's response to a cybersecurity event, which is periodically reviewed and updated.


text: Our board of directors has overall oversight responsibility for our risk management, including the cybersecurity risk management program. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Vice President of Operations who monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Any significant Cyber incidents are reported to the audit committee and ultimately to the board of directors.


text: Presidio Property Trust has a cross-departmental approach to addressing cybersecurity risk, including input from senior management, employees, external consultants, and our Board of Directors (the "Board"). Senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner, including providing periodic training to staff and periodic review of the Company's current posture to protect against threats. The Audit Committee of the Board of Directors oversees the steps taken by Presidio Property Trust's management to monitor and mitigate cybersecurity risks. Senior management briefs the Audit Committee and the Board of Directors on cybersecurity matters as necessary.

companyName: Presidio Property Trust, Inc.

ticker: SQFT


text: The Company operates almost exclusively in a Software-as-a-Service (SaaS) IT environment. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. The internal business owners of the hosted applications are required to document quarterly user access reviews and obtain a System and Organization Controls (SOC) 1 or SOC 2 report from our SaaS vendors. With assistance from an external consultant, management conducts an annual review of third-party SOC reports with a specific focus on their data protection procedures. If a third-party vendor is not able to provide a SOC 1 report, management takes additional steps to assess their cybersecurity preparedness and assess our relationship with them on that basis. Our assessment of risks associated with the use of third-party providers is a significant part of the Company's overall cybersecurity risk management framework.


text: The Company has also engaged a third-party managed service provider to manage server, network, and email security, including continuous monitoring and industry-leading antivirus software. Presidio Property Trust has robust business continuity and disaster recovery procedures in place, and an insurance policy that provides for network security liability, event response and recovery, direct business interruption, contingent business interruption, cyber extortion, social engineering, and computer fraud should an incident occur.


text: In addition, we have Company-wide policies and procedures concerning cybersecurity matters, including access security, system change management, development lifecycle, incident management and business continuity/disaster recovery policies. These policies go through an annual internal review process and are approved by appropriate members of management. Presidio Property Trust uses a third-party consultant to assess the Company's compliance with Sarbanes Oxley.


text: Presidio Property Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Company has not, to date, experienced cyber incidents in the normal course of its business, nor have prior cybersecurity incidents had a material adverse effect on the Company's business, financial condition, results of operations, or cash flows. For more information about the cybersecurity risks we face, see the risk factor entitled "Risks related to cyber-attacks, cyber intrusions and other security breaches" in Item 1A- Risk Factors.


text: We aim to foster and preserve the confidence of customers, employees, shareholders, and other stakeholders regarding our technology and data practices. Our commitments to digital trust, aligned with our core values of service, excellence, integrity, and individual respect, form the basis of our cybersecurity approach.

companyName: BUILD-A-BEAR WORKSHOP INC

ticker: BBW


text: Cybersecurity Risk, Management and Strategy We acknowledge the critical nature of evaluating, pinpointing, and addressing the significant risks posed by cybersecurity threats. Our organization has established a comprehensive set of processes, technologies, and mechanisms to support the identification, evaluation, and management of these risks. Central to our cybersecurity strategy is the mitigation of threats, ensuring the robustness and reliability of our system infrastructures. We utilize the guidelines provided by the National Institute of Standards and Technology (NIST) Cybersecurity Framework to shape our cybersecurity initiatives and comply with the Payment Card Industry Data Security Standards where necessary.


text: Our cybersecurity risk management is intricately integrated into our broader enterprise risk management strategy. Our aim is to effectively identify, prioritize, and manage risks under robust governance, ensuring a secure and resilient organizational environment.


text: The daily operational responsibility for our cybersecurity initiatives falls to our dedicated cybersecurity team, headed by the Chief Technology Officer (CTO). This team collaborates with external partners to forge and execute our data security and cybersecurity plans, including risk assessments, monitoring activities, and training for our employees. We are committed to continually investing in the enhancement of our capabilities to identify, protect against, and detect security threats.


text: We employ a suite of tools and services that support the continuous surveillance and reduction of cyber risks. Our internal teams undertake regular audits and penetration testing throughout the year. External third-party experts are enlisted annually to assess our cybersecurity maturity and conduct risk evaluations, besides offering specialized knowledge on various cybersecurity matters. Our security operations center operates 24/7 to identify, lessen, and react to cyber threats promptly. Defined protocols are in place to manage and mitigate any detected cybersecurity incidents swiftly, with regular reviews of our policies and procedures to ensure compliance with evolving regulatory standards and the dynamic threat landscape.


text: The Incident Response Team (IRT) at our company is a specialized, multidisciplinary group empowered to act swiftly and effectively in managing and communicating cybersecurity incidents. The IRT operates under a comprehensive incident response plan, detailing the procedures for preparing, detecting, responding to, and recovering from cyber incidents. This includes triage, severity assessment, escalation, containment, investigation, and remediation processes, in addition to meeting legal requirements and minimizing damage to the brand and reputation. Regular tabletop exercises are conducted to simulate cyber incidents, enhancing our response strategies, plans, and technology.


text: Our company ensures that all new hires and existing employees undergo data security and privacy training annually, with additional specialized training for certain roles. Periodic campaigns and simulated phishing tests are also conducted to maintain awareness and vigilance against potential risks.


text: Vendor security is maintained using programs that evaluate the risk associated with service providers and business partners, focusing on the nature of data accessed or retained. This risk-based approach guides our due diligence and security assessments for selected vendors, ensuring that our contracts reflect the necessary security commitments.


text: Through the date of filing this Annual Report, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affect our Company, including our business strategy, results of operations, or financial condition. We have not encountered any significant incidents in the past fiscal year. However, we are aware of the ongoing threats that could, if materialized, have a significant impact on our business operations, strategies, or financial condition. Despite our rigorous cybersecurity efforts, we recognize that no system is infallible, and thus we cannot guarantee complete efficacy in preempting or mitigating all potential cyber threats. We continuously evaluate and disclose how identified cybersecurity risks, including those from past incidents, could materially influence our operational, strategic, or financial landscapes.


text: Cybersecurity Governance Our commitment to establishing a secure digital realm is underpinned by the structured governance and management of our data security and privacy policies and strategies. Our Board of Directors, which has primary responsibility for overseeing risk management, has delegated risk management oversight responsibility for information systems, information security, data privacy and cybersecurity to the Audit Committee, a member of which has extensive technology experience, including in the area of cybersecurity. The Audit Committee engages in regular, at least quarterly, discussions on these topics, informed by reports from our IT Security Team led by the CTO. Specific topics may include updates to the Company's approach to cybersecurity risk management; recent developments; key initiatives; the threat landscape; trends; and the results of certain assessments and testing. Periodically, the Audit Committee also receives presentations on cybersecurity matters from third-party cybersecurity experts. The Board of Directors receives reports from the Audit Committee chair on these and other risk-related matters as deemed necessary.


text: Our cybersecurity initiatives are led by our CTO and our Director of Security, who holds a Bachelor of Science, Management Information Systems and a Master of Science, Computer and Information Systems Security and Information Assurance. In addition, our CTO and our Director of Security have Computer Hacking Forensics Investigator and Certified Ethical Hacker certifications. Both, under the CTO's leadership, have extensive experience in managing information security, crafting cybersecurity strategies, and spearheading initiatives to counter evolving cyber threats.


text: The Security and Technology Risk Leadership Committee, led by our CTO, oversees our cybersecurity initiatives, and comprises technology leaders and members of various departments across the company. Similarly, our Privacy, Data Governance, and Artificial Intelligence Committee, under the guidance of our Chief Privacy Officer, oversees our privacy and data governance strategies.


text: Risk Management and Strategy The Company's policies and practices are based on frameworks and standards that address risks through a comprehensive, cross-functional approach that assess, identify, monitor, and mitigate material risks from cybersecurity threats as part of the overall enterprise risk management ("ERM") process. This includes the collection and storage of data, and being responsive to incidents as they occur. Further, the Company's processes and technology are utilized to develop, implement, and maintain appropriate measures to safeguard information systems in protecting the integrity, availability, and confidentiality of data. Additionally, the Company engages certain third parties to assist in network monitoring and control testing, among other functions of similar capacity.


text: While the Company is working to adopt the National Institute of Standards and Technology ("NIST") cybersecurity framework, the Company's on-going investment in information systems and utilization of external 3rd parties represents the best means for extensively testing both the design and operational effectiveness of cybersecurity controls, and to ensure continuity and functionality of the Company's operating systems.


text: As of the date of this report, the Company has not experienced any material cybersecurity events. However, the presence of new or more advanced forms of cybersecurity threats could have a material and adverse impact on the business, results of operations, and financial position. For further discussion relating to this topic, see Item 1A. Risk Factors "The Company's information technology systems may be negatively affected by cybersecurity threats."


text: The Audit Committee of the Board of Director's has the responsibility of overseeing the Company's cybersecurity risks. The Director of Information Technology provides periodic updates to the Board of Director's regarding actions taken to mitigate the Company's exposure and protection to cybersecurity risks. Management routinely evaluates the Company's security processes, procedures, and systems to determine if enhancements are needed to reduce the possibility of a future cybersecurity event. This includes safeguards implemented by the Company, such as a multi-factor authentication process for remote access to systems; restricted firewall settings; network monitoring, email phishing tests, and enhancing the Company's backup recovery strategy, among others.


text: The Director of Information Technology is responsible for assessing, monitoring, and managing the Company's cybersecurity risks. The Director of Information Technology has extensive experience in leading the Company's information systems and has previously led cybersecurity teams for several large global organizations prior to joining the Company.


text: The Director of Information Technology, along with members of management, inform the Audit Committee on cybersecurity risks by providing periodic updates regarding (i) Status of ongoing cybersecurity initiatives and strategies, (ii) The overall state of the Company's security program and potential exposure to risks, and (iii) Incident reports and learning from any cybersecurity events. Further, the Director of Information Technology maintains an open dialog regarding any significant developments in cybersecurity risks, ensuring the Audit Committee's oversight is proactive and responsive. In addition to periodic updates to the Audit Committee, the Director of Information technology, in his capacity, regularly informs the Chief Executive Officer ("CEO") and the Chief Financial Officer ("CFO") regarding matters related to cybersecurity risks and incidents. This ensures the highest level of management are informed of potential risks associated with cybersecurity that could have a material and adverse effect on the Company.


text: Risk Management and Strategy Our cybersecurity strategy prioritizes detection, analysis, and response to mitigate unknown and unexpected threats and security risks. Our cybersecurity risk management processes include technical security controls, monitoring systems, employee training, and management oversight to assess, identify, and manage risks from cybersecurity threats. To date, we have not experienced any cybersecurity threats or incidents which have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, but we cannot provide assurance that they will not have a material impact in the future. See "Risk Factors" in Item 1A of this Annual Report for additional information about our cybersecurity risks.

companyName: MIND TECHNOLOGY, INC

ticker: MIND


text: Also, as part of our cybersecurity program, we partner with a third-party information technology firm to support and evaluate our cybersecurity and informational security program. This third-party service includes product and software security for data protection and cyber defense, to monitor, detect, prevent, and protect our Company against potential cybersecurity threats.


text: Our executive management has overall responsibility for risk oversight in performing this function. Our executive management assesses cybersecurity and information technology risks and the controls implemented to monitor and mitigate these risks. Our cybersecurity program is overseen by our Global Information Technology Manager, who meets regularly with executive management to share information about potential cybersecurity events and monitor, prevent, and detect potential cybersecurity incidents. Executive management is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks.


text: Cybersecurity Risk Management and Strategy. We have processes for assessing, identifying, and managing cybersecurity threats, and cybersecurity is an integral part of our overall enterprise risk management program which is overseen by our Audit Committee and the Board of Directors. Our strategy includes a comprehensive cybersecurity framework, utilizing advanced technologies and methodologies, such as cloud migrations and deployment of threat detection tools to mitigate potential risks. Continuous risk assessments help us better refine our strategy, guiding the deployment of technical safeguards and shaping our incident response plans. For acquired companies, our integration strategies prioritize establishing comprehensive timelines for harmonizing information security, data privacy, and cybersecurity practices. This includes a strong focus on aligning employee education programs to ensure a seamless transition and uphold security and privacy standards across our entities.

companyName: TRANSCAT INC

ticker: TRNS


text: We routinely review the effectiveness of our cybersecurity program using the applicable CIS Critical Security Controls and take necessary actions.

companyName: International Seaways, Inc.

ticker: INSW


text: Our cybersecurity strategy is based on a multi-layered defense framework, aligned with the U.S. National Institute of Standards and Technology ("NIST") guidelines. We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers, ensuring the service providers adhere to our security standards, thereby safeguarding our integrated operations. The strategic migration of our data centers and infrastructure to secure cloud environments, coupled with the implementation of targeted technical cybersecurity measures, underscores our dedication to establishing foundational security across our users, applications, data, systems, and networks.


text: We have established a comprehensive incident response plan to swiftly address and recover from cybersecurity incidents, minimizing operational impact. We conduct regular trainings and simulations to enhance our team's awareness and preparedness against cyber threats. Annual penetration testing and regular assessments by external experts validate the effectiveness of our cybersecurity measures. Our proactive approach to addressing identified vulnerabilities affirms the continuous improvement of our security posture.


text: To further strengthen our cybersecurity risk management framework, we have instituted an Information Security Management System ("ISMS") that equips us with advanced risk management capabilities. This system facilitates the development of a detailed risk registry, incorporating impact and likelihood scoring to prioritize risks effectively. Additionally, it guides the creation of comprehensive risk treatment plans and sets targets for residual risk, ensuring a strategic approach to risk mitigation. A key feature of our ISMS is a risk management insights dashboard, which provides real-time visibility into the current state of risk within our environment. This dashboard is an invaluable tool for our management and key stakeholders, enabling them to track risk exposure and trends accurately. Quarterly reviews are scheduled, during which key stakeholders convene to scrutinize and adjust risk treatment plans in response to the latest threat landscape. This process underscores our commitment to a dynamic and responsive cybersecurity risk management strategy, ensuring the ongoing protection of our systems, data, and operations against emerging threats.


text: Use of Consultants and Advisors. We engage various third-party cybersecurity service providers to assess and enhance our cybersecurity practices and assist with the protection and monitoring of our systems and information. This encompasses a range of services, including network monitoring, endpoint protection, vulnerability assessments, and penetration testing. Additionally, we engage cybersecurity consultants, auditors, and other third parties, such as a third-party consulting firm, to rigorously evaluate our cyber processes. This includes a comprehensive assessment of our incident response procedures, ensuring they meet the highest standards of readiness and effectiveness.


text: To ensure the integrity and security of our operations, we have implemented stringent processes to evaluate third-party service providers and vendors that have access to sensitive systems, as well as company and customer data. This evaluation may include due diligence procedures such as assessments of the service provider's cybersecurity posture or recommendations for specific mitigation controls. Following an assessment, we determine and prioritize service provider risk based on potential threat impact and likelihood. These risk determinations are crucial in driving the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Enhancing our third-party vendor risk management, we have introduced two distinct capabilities to further safeguard our operations and sensitive data:


text: 1. We leverage a threat intelligence platform watchlist to curate, monitor, alert, and provide a risk rating to third-party vendors. This platform also offers a dashboard and real-time reporting, enabling us to stay ahead of potential threats by providing continuous oversight and actionable intelligence.


text: 2. Our ISMS platform encompasses vendor risk management capabilities, facilitating initial due diligence through the collection of vendor security-related artifacts. It applies risk ratings and delivers and analyzes annual security questionnaires, scheduling reviews and tasks to ensure compliance and security standards are met consistently.


text: Additionally, our virtual Chief Information Security Officer ("vCISO") compiles a quarterly executive summary of third-party risk, which is presented to both management and the Board. This summary ensures that leadership is informed of the current risk landscape and can make data-driven decisions regarding third-party engagements.


text: Board Oversight and Management ' s Role. The Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee oversees the proper functioning of our cybersecurity risk management program to ensures strategic alignment and governance of our cybersecurity efforts at the highest level. In particular, the Audit Committee assists the Board of Directors in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.


text: Management has implemented robust risk management structures, policies, and procedures, with day-to-day cybersecurity risk management being a core responsibility. Our Chief Financial Officer ("CFO") spearheads the assessment and management of cybersecurity risks on a daily basis, ensuring that our strategies and actions are both proactive and responsive to the evolving cybersecurity landscape. Supporting this effort, we have a cross-departmental approach to cyber security management. This ensures that our executive leadership team receives comprehensive quarterly updates on cybersecurity from various teams within the organization. Such updates are instrumental in promoting stakeholder engagement across all levels and enhancing management's oversight of cybersecurity. The content of these updates includes progress on ongoing cybersecurity initiatives, insights from recent threat assessments or incidents, findings and action plans derived from external vulnerability and penetration tests, and key performance metrics aligned with industry standards.


text: Risks from Material Cybersecurity Threats. Despite ongoing cyber-attacks, such as unauthorized access, phishing, and ransomware, we have not identified any cybersecurity incidents that have materially affected or are reasonably anticipated to have a material effect on our business strategy, results of operations, or financial condition. Our proactive security measures, alongside those of our third-party vendors, aim to protect our information technology systems and the sensitive data they hold. To bolster our cybersecurity posture, Transcat has engaged a third-party Managed Security Services Provider ("MSSP") to enhance our defensive capabilities. This partnership includes comprehensive vulnerability scanning both internally and externally to detect potential security weaknesses before they can be exploited. Our MSSP also provides round-the-clock monitoring through a 24x7x365 Security Operations Center ("SOC"), safeguarding our digital assets ("Endpoint Detection and Response - EDR"), identities ("Identity Detection and Response - IDR"), and integrating supplemental logging sources such as firewalls and Enterprise Resource Planning systems ("Extended Detection and Response - XDR"). Furthermore, we have established Incident Response as a Service ("IRaaS") to ensure rapid and effective action in the event of a security breach.


text: To maintain a strategic overview of our cybersecurity landscape, we conduct quarterly strategic reporting sessions. These sessions are crucial for reviewing security activity and identifying areas for improvement. Based on these reviews, we develop a Plan of Action and Milestones ("POAM") for remediation or re-architecture as necessary. Although these risks have not yet materially impacted our business, we remain vigilant, continuously monitoring and adapting to evolving cybersecurity threats. Our commitment to cybersecurity is integral to our risk management strategy, ensuring the ongoing protection of our systems and the sensitive data they contain.


text: Cybersecurity risk is the business risk associated with a vulnerability to financial or reputational loss due to a cyber attack or a data breach. Our technologies, systems and networks may be subject to cybersecurity threats. Our business, like others within the energy technologies industry, is faced with growing cybersecurity threats as we increasingly rely on digital technologies across our business, some of which are managed by third-party service providers on whom we rely to help us collect, host or process information.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: We recognize the significance of these threats, sometimes referred to as hacking, cybersecurity fraud, and cyberattacks, and maintains processes and procedures to protect its critical systems and sensitive information from unauthorized access. Despite our on-going efforts to improve our cybersecurity infrastructure and processed, there can be no assurance that a sophisticated cyber-attack would timely be detected or thwarted. To date, we are not aware of any material information security breaches and has not incurred significant operating expenses related to information security breaches. For more information on risks related to cybersecurity, please see the section titled "Risk Factors" included under Item 1A of this Annual Report on Form 10-K.


text: Risk Management and Strategy Our cybersecurity risk management program includes operational, technical and physical controls to protect against and respond timely to cybersecurity threats. To address evolving cybersecurity risks and corresponding regulations, our policies and procedures are benchmarked to industry, regulatory and cybersecurity frameworks (e.g., National Institute of Standards and Technology).


text: Management has engaged third-party vendors to assist in monitoring our cybersecurity risk management programs and identifying and responding to any incidents. Additionally, third-party vendors are routinely engaged to evaluate how effectively management as a whole manages cybersecurity risk. We also utilize third-party cybersecurity vendors to assess its protections against identified vulnerabilities.


text: We have developed cybersecurity training for employees concerning cybersecurity risk. This training provides information on security awareness and phishing simulations. All employees are required to attend periodic cybersecurity training. On a regular basis, our IT team shares news and articles related to cybersecurity awareness with all employees.


text: The Director, Global Information Technology and Financial Systems (the "IT Director"), leads an internal team and works directly with our third-party vendors to manage our cybersecurity risk management program and activities. The internal team monitors our information systems for cybersecurity threats, reviews cybersecurity incidents, analyzes emerging threats, and develops and implements risk mitigation strategies. The IT Director periodically reports on the cybersecurity program to the Company's Chief Financial Officer ("CFO").


text: The Audit Committee is updated at least annually by the CFO on the status of cybersecurity matters. Contemporaneous reporting is provided on an as needed basis to the Audit Committee and to the full Board of Directors on significant cyber events including response, legal obligations, and outreach and notification to regulators, and third parties when needed.


text: On an annual basis, the IT Director reviews the results of the current state of cybersecurity risk management, including the results of our cybersecurity risk assessment and any action plan to address any identified vulnerabilities.


text: Risk Management and Strategy There have been an increasing number of cyberattacks on companies around the world, which have caused operational failures, compromised sensitive corporate or customer data, and/or resulted in significant financial damages. These attacks have occurred over the internet, through malware, viruses or attachments to e-mails, or through inside actors with access to systems within the organization.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: We have implemented security measures as part of an evolving cybersecurity posture and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks and mitigate the damage that could result from such an attack. Subsequent to March 31, 2024, all employees will begin receiving cybersecurity training and other education regarding their use of computers, information technology, and sensitive data, including specifically how to recognize common attack strategies. As the Company does not have a physical office location, it does not have a local network or in-house servers and proprietary applications. We therefore utilize third parties applications and resources to support our information technology ("IT") needs. All applications utilized by the Company are Software as a Service ("SaaS") offerings. As our applications are developed and managed by third parties, we are dependent on these providers for many functions including disaster recovery during a disaster or cyber incident. Our goal is to only utilize the most secure and trusted providers for our IT needs. To this end, we are currently reviewing the security credentials and certifications of our key application providers. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers.


text: Our cybersecurity management strategy will consist of utilizing a combination of employee education, preventative controls, detective controls and periodic third-party cybersecurity testing. During fiscal year 2024, we began to deploy and utilize enterprise scale technology to support an appropriate cybersecurity posture including: endpoint detection and response, firewalls, security information and event management, email security, multifactor authentication, and vulnerability management, with deployment of these tools to be completed prior to March 31, 2025. As part of the service offering from our outsourced IT security services provider, cybersecurity related alerts will be issued to us as relevant situations develop. These alerts will be evaluated in concert with our IT provider and in the event an alert requires action within our environment, such actions will be taken promptly. Our process and cybersecurity posture will continue to be refined based on the results of periodic cybersecurity assessments conducted jointly with our IT provider. Upon implementation of this strategy, we will report on cybersecurity in reports to the Audit Committee on a semi-annual basis.


text: To operate our business, we rely upon certain third-party service providers (the "Providers") to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, SaaS platforms, managed services, cloud-based infrastructure, content delivery, encryption and authentication technology, corporate productivity services, and other functions. We are in the process of developing vendor management processes designed to help to manage cybersecurity risks associated with our use of these Providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed and the identity of the Provider, our vendor management process may include i) reviewing the cybersecurity practices of such Provider;ii) requiring their completion of written questionnaires regarding their services and data handling practices; and iii) obtaining a Security Operations Center ("SOC") report for the Provider's internal control structure. For our largest third-party provider, our Contract Research Organization ("CRO") which is helping us manage our clinical trial(s), we will conduct a comprehensive security assessment and review, including their cybersecurity practices, protocols and protections and physical security.


text: The Audit Committee is responsible for oversight of cybersecurity risk. Our Chief Executive Officer and Chief Financial Officer are the members of management responsible for managing and assessing our cybersecurity practices. The plan for the future is that they will report to the Audit Committee on cybersecurity on a semi-annual basis. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Audit Committee and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken.


text: We believe we are appropriately staffed (as supported by our outsourced IT provider) to support a healthy cybersecurity posture given our size and scope. Our Chief Financial Officer, who reports to the Chief Executive Officer, is directly responsible for IT functions.


text: Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information, and other confidential data.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: To date, there have been no risks identified from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the company. However, despite all of the above aforementioned efforts, a cyberattack, if it occurred, could cause system operational problems, disrupt service to clinical trial sites, compromise important data or systems or result in an unintended release of confidential information. See "Item 1A. Risk Factors" for additional discussion of cybersecurity risks impacting our Company.


text: We take a defense-in-depth approach, leveraging multiple, layered security measures, to protect our data, our customers' data, our infrastructure, and our employees. We embed data protection throughout our operations and information technology programs, relying on multiple and various controls to prevent and detect threats, with the goal of safeguarding our assets, data and personnel.

companyName: BIO KEY INTERNATIONAL INC

ticker: BKYI


text: We evaluate cybersecurity risks as part of our overall enterprise risk management. A steering committee of senior executives meets quarterly to evaluate any changes to the Company's exposure to cybersecurity risks, discuss potential mitigation plans and provide updates on mitigation efforts already underway. Our cybersecurity team keeps up to date on the latest threats and risks through multiple channels and is also involved in evaluating risks associated with any new proposed service providers. We employ a Cybersecurity Engineer, reporting directly to our Chief Technology Officer, who manages our cybersecurity team that is comprised entirely of security professionals with industry recognized certifications. The cybersecurity team within BIO-key is responsible for assessing and managing risks and informing/gaining feedback from the cybersecurity steering committee.


text: Additionally, our team of dedicated cybersecurity experts/professionals maintain a comprehensive set of cybersecurity policies and standards, including a security incident response framework. The framework is a set of coordinated procedures and tasks that our incident response team executes to ensure timely and accurate reporting and resolution of computer security incidents. The framework details who, how and when appropriate persons or committees, including the Board of Directors and Audit Committee are kept informed on the status of potential cybersecurity incidents. A summary of recent incidents is also presented by the Chief Law Officer ("CLO") at each regular Audit Committee meeting. Our policies and standards were developed in collaboration with a wide range of disciplines, including information technology, cybersecurity, legal, compliance and business. Our cybersecurity strategy and policies are continually reassessed to ensure they attempt to identify and proactively address the constant changes in the global threats. Decision makers such as the CLO, executive team, and Audit Committee are regularly kept up to date on cybersecurity trends. Ongoing collaboration with stakeholders throughout the business also helps to build continued awareness and visibility of future needs.


text: We engage external vendors to assess the cybersecurity program as needed. An independent third party will perform annual multi-stage penetration testing of our IT environment.


text: Our cybersecurity program is governed by the Audit Committee of our Board. The Audit Committee of the Board and the full Board will each receive quarterly updates on cybersecurity risks identified through the enterprise risk management processes described above.


text: Notwithstanding our processes to oversee and identify risk from cybersecurity threats, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. We identify nation state-sponsored threat actors and the rise in sophistication and proliferation of ransomware campaigns as top reasonable material risks to the business. The theft, unauthorized use or publication of our intellectual property and/or confidential business or personal information (whether through a breach of our own systems or the breach of a system of a third party that provides services to us) could harm our competitive or negotiating positions, reduce the value of our investment in research and development and other strategic initiatives, compromise our patent enforcement strategies or outlook, damage our reputation or otherwise adversely affect our business. To date there have not been any risks that have materially affected our operations. See Item 1A. " RISK FACTORS " for a discussion of cybersecurity risks.


text: Cybersecurity Governance The Board of Directors (the "Board") of the Company is responsible for the oversight of the Company's cybersecurity program and recognizes the risks that cybersecurity threats may impose on the Company, its business partners, employees and investors. The Company's IT Director is responsible for overall IT governance, risk and compliance including the Company's cybersecurity program. The Audit Committee of the Board collaborates with the full Board and the IT Director to facilitate alignment of overall IT related controls and processes. We have a formalized IT Security Incident Report process which provides a method to document and communicate details of security incidents to appropriate stakeholders. The Board and the Audit Committee receive periodic briefings on cybersecurity and help set priorities and strategic direction. As part of continuous improvement, our cybersecurity program is being aligned with the NIST Cybersecurity Framework 2.0 to help ensure comprehensive controls and oversight.

companyName: FRIEDMAN INDUSTRIES INC

ticker: FRD


text: In evaluating the risks identified as a part of the annual assessment process, the Company's information technology team considers the likelihood and severity of the respective risk and the potential impact of the risk on the Company, its customers, and its employees. These risks are then prioritized and monitored by the information technology team.

companyName: Seneca Foods Corp

ticker: SENEA


text: Cybersecurity Controls We have implemented a modern, comprehensive set of controls that restrict access to systems using a combination of firewalls, virtual private networks, multi-factor authentication and enforced use of corporate controlled compliant devices. We make extensive use of best-in-class automated intrusion prevention, intrusion detection and response systems which constantly monitor activity, build usage patterns and respond or alert when unusual activity is detected. We have experienced staff who perform root cause analysis, respond to any immediate threat, and implement improved controls for future prevention. Our cybersecurity tools are fully integrated and collect data from various sources to build relationships and detect more complex multi-channel attack strategies. Application controls are role-based and designed to protect data confidentiality and provide overall data integrity. A risk-based approach is taken regarding third-party systems utilized in our business.


text: We have controls specifically focused on E-mail phishing including impersonation attempts. Although our automated controls prevent most phishing attempts, some can be delivered to employees. To mitigate this risk, we provide training to employees using various methods including E-mail phishing campaigns which send phishing-style E-mails, monitors user responses and automatically assigns further training as appropriate. Employees have been trained to send any suspicious activity to a central IT Service Desk for evaluation and appropriate timely action.


text: All critical systems have rigorous data backups and are designed for disaster recovery, ensuring business continuity in the event of a catastrophic incident. As part of continuous improvement, disaster recovery testing is being conducted and documented.


text: We are not aware of any unmitigated risk or any prior incident that may have materially affected the Company's data integrity, confidentiality, operations, business strategy or financial reporting. Given our reliance on modern systems, we are aware a significant incident could impact the Company's overall goals so we strive to provide modern counter measures to manage this risk.


text: Safeguarding the Company's information technology ("IT") systems, intellectual property, and the confidential information and personal data that customers, suppliers, business partners, employees and others share is a critical concern. As such, the Company has processes in place to assess, identify, and manage material cybersecurity threats and incidents. The Company's cybersecurity strategy includes policies, procedures, and technology that proactively safeguard its operations against cybersecurity threats. The Company utilizes IT that enables its team to access both operational and financial performance data in real time, while, at the same time, identifying and preventing cybersecurity threats and risks. The Company aims to incorporate industry best practices throughout its cybersecurity processes and its cybersecurity framework leverages internationally recognized standards, including the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework (Identify, Protect, Detect, Respond and Recover). These processes incorporate preventative, detective and corrective controls to identify relevant cyber risks and include network and endpoint protection technologies that are designed to block and detect security events at the perimeter and within its network as well as evaluation and monitoring of detected security events. The Company continuously monitors activity, frequently scans applications and systems for vulnerabilities to risk from cybersecurity threats. Continuous monitoring of the Company's networks and systems for threats and vulnerabilities is a key component of the Company's strategy, supported by the analysis of threat intelligence from external sources. This multi-layered approach enables early detection and facilitates prompt response to potential cybersecurity threats.

companyName: PARK AEROSPACE CORP

ticker: PKE


text: Management reviews the Company's IT, data security and other systems, processes, policies, procedures and controls at least annually to (a) identify, assess, monitor and mitigate cybersecurity risks; and (b) identify measures to protect and safeguard against cybersecurity threats and breaches of confidential information and data and IT infrastructure and its other assets or assets of its customers or other third parties in the Company's possession or custody.


text: The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected it or are reasonably likely to materially affect it, including its operations, business strategy, results of operations, or financial condition.


text: The Company's management supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by it; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk Management and Strategy The Company's cybersecurity risk management program is integrated with its overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across functions to other legal, compliance, strategic, operational, and financial risk areas.


text: The Company designs and assesses the cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The Company uses the NIST CSF as a guide to help identify, assess, and manage cybersecurity risks relevant to its business; this does not imply that the Company's cybersecurity program meets any particular technical standards, specifications, or requirements.


text: Awareness and training for employees, involving phishing campaigns, informational sessions at management meetings, and annual mandatory training with simulations of common cybersecurity threats; Security tools and technologies, along with control policies and active review procedures which strengthen authentication and access protection;


text: The Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems to assess its cybersecurity readiness and maturity of the cybersecurity program. Tests are conducted by the information technology team and reputable third-party consultants and auditors. In developing and evaluating the testing procedures, the Company considers both its individual risks and industry standards.


text: The cybersecurity risk management program includes an incident response plan with a cross-functional team comprised of designated members of the information technology department, senior management, and other appropriate individuals. The team is responsible for assessing and managing the cybersecurity incident response process, as outlined within the incident response plan, and taking necessary corrective actions to mitigate and eliminate the issue.


text: As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents and potential impact to the Company, see the cybersecurity risk factor within "Item 1A. Risk Factors" in this Form 10-K.


text: The information technology department, led by the Senior Vice President of Technology and Planning, Chief Information Officer ("CIO"), is responsible for the Company's cybersecurity program. The CIO, along with the certified Information Security Officer and VP Information Technology have significant experience spanning over 20 years in information security, infrastructure, and compliance.


text: The Board of Directors considers cybersecurity risk as part of its overall risk oversight function. The Board of Directors receives briefings from the CIO regarding the Company's cybersecurity risk management program at least annually. These briefings include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan and is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. Our cybersecurity risk management program includes the following key elements:

companyName: CYANOTECH CORP

ticker: CYAN


text: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services and our broader enterprise information technology ("IT") environment;


text: A team comprised of IT personnel responsible for directing (1) our cybersecurity risk assessment processes; (2) our security controls; and (3) our response to cybersecurity incidents;


text: The use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our cybersecurity processes; A cybersecurity incident response plan.


text: During the fiscal year ended March 31, 2024, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition, as we have described in the Risk Factors section of this Form 10-K.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as critical to the enterprise and oversees management's design, implementation and enforcement of our cybersecurity risk management program, while our executive officers are responsible for the day-to-day management of the material risks. Our Board of Directors receive annual updates, and/or significant updates as needed, on relevant information regarding cybersecurity.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature, ("Information Systems and Data").

companyName: EMERSON RADIO CORP

ticker: MSN


text: Our information technology ("IT") department helps identify, assess and manage the Company's cybersecurity threats and risks. Our IT department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, using manual tools and conducting threat assessments designed to identity internal and external threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, conducting risk asse ssments and maintaining business continuity and disaster recovery plans.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program. The IT department works with Company management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Board, which evaluates our overall enterprise risk.


text: We use third-party service providers to perform a variety of functions throughout our business, such as internet hosting companies, distributors, and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with any particular provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "An information systems interruption or breach in security, including as a result of cyber-attacks, could adversely affect the Company's business, results of operations and reputation."


text: Our Board addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee of the Board (the "Audit Committee") is responsible for overseeing the Company's risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Operating Officer ("COO"). Our COO, assisted by our Senior Vice President for Operations, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our COO and Senior VP for Operations are responsible for reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our COO.


text: The Board may receive reports from our IT Department and/or Management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity measures are primarily focused on ensuring the security and protection of its information technology systems and data. The Company recognizes the increasing volume and sophistication of cybersecurity threats and takes seriously its responsibility to protect these information technology systems and data. The Company considers risks associated with cybersecurity alongside the Company's other risks as part of its overall risk assessment process. The Company's Vice President of Information Technology and his staff monitor the Company's information systems to provide a comprehensive approach to assess, identify, manage, mitigate, and respond to cybersecurity threats.

companyName: CROWN CRAFTS INC

ticker: CRWS


text: The Company uses cost-effective controls that are commensurate with the risk and sensitivity of its specific information systems, control systems and enterprise data. The Company's cybersecurity program incorporates best practices and industry standards from multiple sources and includes, but is not limited to, risk assessment, policies and procedures, training and awareness, auditing, log collection and analysis, threat hunting and intelligence surveillance, compliance monitoring and testing, and incident response.


text: When necessary, the Company's Vice President of Information Technology and his staff collaborate with external third -party subject matter specialists. The Company has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of these providers. All third parties engaged for such matters are subjected to scrutiny to ensure they satisfy the Company's security standards. The Company periodically reviews its third -party engagements to ensure that the providers maintain the necessary levels of protection and competency, as well as to oversee and identify potential cybersecurity risks and threats from such engagements.


text: Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity Framework and is designed to ensure that our information systems are effective and are prepared for cybersecurity threats, including through regular oversight and mitigation of internal and external threats. As a U.S. defense subcontractor, we are additionally obligated to comply with Department of Defense regulations such as Defense Federal Acquisition Regulation Supplement.

companyName: BUTLER NATIONAL CORP

ticker: BUKS


text: As of May 31, 2024, the Company has not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operation or financial condition. The Company has further disclosed how risks from cybersecurity threats could potentially have a material impact on the Company, including its business strategy, results of operations, or financial condition, in Part I, Item 1A, "Risk Factors" of this Annual Report.


text: Cybersecurity Governance Cybersecurity, as an important part of the Company's risk management processes, is a critical area of focus for the Company's Board of Directors (the "Board"), which is responsible for oversight of the Company's cybersecurity risk, including the effectiveness of cybersecurity risk management policies and protocols. As part of the Board's oversight, the Board receives a report at least annually from the Company's Vice President of Information Technology and other members of the Company's executive management team. These reports include updates on the Company's cybersecurity risks and threats, the status of projects intended to strengthen its information security systems, assessments of the cybersecurity program, and the emerging threat landscape.


text: In the event of a cybersecurity incident, the Company has processes by which the incident would be escalated internally and, when appropriate, reported to the Board or an appropriate committee of the Board, as well as for updating the Board regarding the incident until it has been resolved.


text: The Company's Vice President of Information Technology is responsible for the Company's cybersecurity strategy and execution. He has more than 30 years of experience in technology and information systems leadership and reports directly to the Company's Chief Executive Officer.


text: Risk Management and Strategy We perform a formal risk assessment each year. As part of our risk assessment, we consider the potential for cybersecurity threats, including but not limited to interruptions, outages and breaches to its operational and financial systems. We have policies, processes, internal controls and tools to assess, identify, and manage material risks from potential cybersecurity threats. We utilize a combination of cybersecurity awareness training, manual processes, specialized software and automated tools, and third-party assessments to build our cybersecurity program. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program. We are also currently developing a cybersecurity incident response plan that establishes a formal framework for responding to cybersecurity incidents, including defining what constitutes a reportable cybersecurity incident; establishing specific escalation and communication channels; identifying parties responsible for managing and responding to each incident; and other preparedness and response activities.

companyName: LiveOne, Inc.

ticker: LVO


text: The Audit Committee of our board of directors provides oversight over our internal control program, including the adequacy and effectiveness of our information technology infrastructure and cybersecurity program. Each quarter, our management provides updates to the Audit Committee regarding our internal control program, including any significant changes to its information technology infrastructure or cybersecurity program. Our management also reports any material risks from cybersecurity threats to the Audit Committee. Our management periodically provides the Audit Committee with updates on cybersecurity risks and/or trends.


text: Our management team, specifically our Chief Executive Officer and Chief Financial Officer, are responsible for the day-to-day administration of our business operations, including our risk management of cybersecurity risks. Our management is responsible for the design and implementation of policies, processes and internal controls to manage our cybersecurity risks. Our management team regularly meets with their information technology resources, including our third-party service providers, to ensure that we are appropriately positioned to manage our cybersecurity risks. Our management team also sponsors periodic cybersecurity awareness training for employees.


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For further discussion of the cybersecurity risks, see "Part I—Item 1A. Risk Factors," specifically the risk titled "We are subject to cybersecurity risks to our systems, infrastructure, and technology, and data processed by us or third-party vendors." No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.


text: The Company utilizes existing employees and contracts with third party firms to evaluate our information security program, for continuous system monitoring and threat detection, to gather insights for identifying and assessing material cybersecurity threats, and for potential mitigation assistance. We conduct cybersecurity assessments using third-party service providers, and we require them to promptly notify the Company of any cybersecurity risks, threats or incidents that might impact us.


companyName: PodcastOne, Inc.

ticker: PODC


text: Risk management and strategy We rely on our information technology to operate our business. We have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: ADM TRONICS UNLIMITED, INC.

ticker: ADMT