text: Our Vice President of Information Technology supervises our Information Technology Department (the "IT Department") which coordinates with third -party service providers that perform security management roles, including those of a Chief Information Security Officer, to identify, assess and manage our cybersecurity threats and risks. Our IT Department and security management team, including third -party service providers, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, internal audits relating to cybersecurity, conducting threat assessments for internal and external threats, third -party threat assessments, conducting vulnerability assessments to identify vulnerabilities, use of external intelligence feeds, evaluating our and our industry's risk profile, and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a cybersecurity incident response policy; asset management, tracking and disposal; incident detection and response; systems monitoring; vulnerability management policy; risk assessments; encryption of certain of our data; third -party cybersecurity staff; network security controls; segregation of certain of our data; access controls; physical security; employee training; penetration testing; and cybersecurity insurance.

companyName: UroGen Pharma Ltd.

ticker: URGN

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our IT Department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are expected to be more likely to lead to a material impact to our business. In addition, our management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of our board of directors, which, together with our board of directors, evaluates our overall enterprise risk.


text: We use third -party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including, for example: a third -party IT and cybersecurity consultant; professional services firms, including legal counsel; threat intelligence service providers; cybersecurity software providers; managed cybersecurity service providers; penetration testing firms; dark web monitoring services; and forensic investigators.


text: We use third -party service providers to perform a variety of functions throughout our business, such as: conducting nonclinical and clinical trials; supplying certain raw materials, compounds and components; delivering materials to our facilities; and shipping products to our customers. Additionally, we rely on third -party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, and content delivery. Third-party service providers we rely on include: application providers, distributors, hosting companies, supply chain resources, contract research organizations, and contract manufacturing organizations. Our vendor assessment process is generally limited to reputational due diligence of the vendor and, in some cases, examination of the vendor's security reports and certifications.

stage1Category: Third-Party Risk


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risk Factors – If our information technology systems or data, or those of third parties upon whom we rely, are or were compromised, this could result in adverse consequences resulting from such compromise including but not limited to regulatory investigations or actions; litigation; fines and penalties; a material disruption of our drug development program; compromise sensitive information related to our business; harm our reputation; triggering our breach notification obligations; prevent us from accessing critical information; disruptions of our business operations; loss of revenue or profits; loss of customers or sales and expose us to liability or other adverse effects to our business."

stage1Category: None/Other


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee of our board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including, among others, our Executive Vice President of Talent, Advocacy & Communications, Vice President of IT, and Associate Director of IT Operations. Our Vice President of IT is an IT security professional and members of our IT Department have certain credentialling in cybersecurity. We also rely on third-party security analysts who have certain certifications related to cybersecurity.

stage1Category: Management Role


text: Our Executive Vice President of Talent, Advocacy & Communications and Vice President of IT, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Additionally, they are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Financial Officer and General Counsel and Chief Compliance Officer. Our management works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our cybersecurity incident response policy includes reporting to the audit committee of our board of directors for certain cybersecurity incidents.


text: The audit committee periodically reviews and discusses with the appropriate members of our management material risks relating to cybersecurity threats and our processes for assessing, identifying, and managing material risks from cybersecurity threats, as well as our internal controls and disclosure controls and procedures relating to cybersecurity incidents. Our board of directors and audit committee are also provided with reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our strategic priorities is part of our risk management process. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the Center for Internet Security ("CIS") Critical Security Controls.

companyName: NCS Multistage Holdings, Inc.

ticker: NCSM


text: We partner with leading cybersecurity companies and organizations to enhance our cybersecurity infrastructure, leveraging third-party technology and expertise to monitor and optimize the performance of our deployed cybersecurity products and services. We also engage with third party firms to help identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards and best practices. We use a third-party provider to supplement the continuous monitoring of our cybersecurity environment and to help coordinate the investigation and remediation of events. The Company evaluates third-party risk for critical suppliers through ongoing security reviews, provided that for third-party providers that are part of the Company's financial reporting system, security controls are assessed through a more detailed review of events.

stage1Method: majority


text: The Audit Committee receives reports from management regarding the Company's assessment of the cybersecurity risks, and other risks, on an annual basis. In addition, management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents. The Audit Committee reports regularly to the full Board regarding its activities, including those related to cybersecurity.

companyName: ESCALADE INC

ticker: ESCA


text: The information technology group has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes. The group reports to our Chief Financial Officer. Our cybersecurity senior manager, who has held roles in security, infrastructure management, and enterprise information technology management, is responsible for assessing and managing the cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts.


text: The Audit Committee of our Board oversees our cybersecurity risk program and receives periodic presentations from management regarding the Company's efforts to monitor and mitigate cybersecurity risks. The Board is composed of members with diverse expertise including risk management and technology, equipping them to oversee cybersecurity risks effectively. The cybersecurity program is reviewed by our Board, at least annually. In addition to scheduled briefings, ad hoc discussions regarding emerging or potential cybersecurity risks ensure the Board remains informed and engaged in strategic decision-making related to cybersecurity.

stage1Category: Board Governance


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. – See Item 1A. "Risk Factors – We are subject to cybersecurity risks. A cyber incident could occur and result in information theft, data corruption, operational disruption and/or financial loss." for more information about these and other risks related to information security.

stage1Category: Strategy Integration


text: Cybersecurity Risk Management and Strategy As a company committed to safeguarding our operations, assets and stakeholders against cyber threats, we recognize the critical importance of the need for cybersecurity risk management and strategy. In today's digital landscape, where cyber threats continue to evolve and proliferate, it is imperative that we remain vigilant and proactive in our approach to cybersecurity.


text: In this section, we outline our cybersecurity risk management strategies and initiatives aimed at mitigating cyber risks and ensuring the resilience of our organization. From risk assessment and threat detection and continuous improvement, our approach to cybersecurity reflects our resolve to maintain the confidentiality, integrity and availability of our systems and data.


text: Risk Assessment – We regularly conduct risk assessments to identify and evaluate potential cybersecurity threats and vulnerabilities. These assessments consider factors such as our current IT infrastructure, the sensitivity of our data, industry best practices, and emerging cybersecurity trends.


text: Threat Detection and Prevention – Given our limited resources, we prioritize the deployment of cost-effective tools and technologies for threat detection and prevention. This includes the use of firewalls, intrusion detection systems, antivirus software, and security information and event management (SIEM) solutions to monitor and mitigate potential security incidents.


text: Employee Training and Awareness – We understand that employees play a crucial role in maintaining cybersecurity. Therefore, we provide regular training and awareness programs to educate our staff about cybersecurity best practices, common threats and how to recognize and report suspicious activities.


text: Engagement of Third-Party Consultants and Assessors – In addition to our internal efforts to manage cybersecurity risks, we recognize the value of engaging third-party consultants, firms or assessors to provide specialized expertise and support in enhancing our cybersecurity posture, policies and procedures. While our internal IT staff possess valuable skills and knowledge, leveraging external resources can provide additional insights, validation and assurance in our cybersecurity initiatives.


text: Continuous Improvement – We are committed to continuously improving our cybersecurity posture in line with industry standards and best practices. This includes staying informed about emerging threats and vulnerabilities, conducting regular security audits and assessments and investing in cybersecurity technologies and training as resources allow.


text: Currently, we have not identified any risks stemming from known cybersecurity threats, including those resulting from previous cybersecurity incidents, which have significantly impacted our operations, business strategy, financial condition or results of operations. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company's business. See " Risk Factors – Operational Risks to the Company and Our Business. "


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other threats or risks. The Audit Committee is primarily responsible for overseeing the Company's risk management processes, which include cybersecurity, global operations, product compliance and other regulatory risks.


text: Employee Training and Awareness Programs: We provide training to our management and employees designed to equip employees with the knowledge and skills necessary to identify and respond to cybersecurity risks, tailored based on the persons' roles within our organization.

companyName: Jet.AI Inc.

ticker: JTAI


text: Management of the Company is responsible for the day to day risk management process, specifically the Director of IT, who reports and operates under the direction of the Chief Financial Officer (CFO), who then reports directly to the Audit Committee regarding such risks. The CFO provides updates to the Audit Committee on cybersecurity risks and threats annually, but the Director of IT attends both the Audit Committee meetings and the Board meetings to provide further updates on cybersecurity and other IT related matters. At a minimum, the Audit Committee is given updates on a quarterly basis, but if a situation were to arise, the Audit Committee would be notified once the Company was aware of the issue.


text: Our management team, led by our CFO, is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through updates by our Director of IT. Our CFO and Director of IT are responsible for assessing and managing risks that may arise from cybersecurity threats. Our CFO has over 10 years of experience managing IT operations including strategy, infrastructure and execution. Our Director of IT has over 20 years of experience in information technology including roles managing operations, compliance, development, applications, information security, support and execution.


text: The Company maintains a governance structure to address cybersecurity risk, which involves the Board, the Audit Committee, the Company's Director of Information Technology, and a dedicated Incident Response Team.

companyName: Canterbury Park Holding Corp

ticker: CPHC


text: The Company utilizes a cross-functional, multilayered approach risk management to its cybersecurity to identify, prevent, and mitigate cybersecurity threats to the Company designed to preserve the confidentiality, security, and integrity of the Company's information and data. The Company conducts periodic tests to assess the Company's processes and procedures and the threat landscape. The Board and the Audit Committee receive regular presentations on cybersecurity-related topics ranging from the results of penetration testing, recent developments, evolving standards, the threat environment, technological trends, and information security considerations facing the Company and its peers. At least annually, the Board discusses the Company's approach to cybersecurity risk management with the Company's Director of Information Technology, and at least annually, or more frequently as necessary, the Company's Director of Information Technology meets with the Audit Committee to discuss cybersecurity risk management. The Company's security program and IT-related controls are regularly examined by internal auditors, external auditors, and various regulators.


text: The Company's Incident Response Team is led by our Director of Information Technology and also comprised of various cross-functional members of management. The team is responsible for identifying, assessing, mitigating, and reporting on material cybersecurity risks and will present regular reports to the Audit Committee and the Board. The Board and the Audit Committee are also informed of any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed.


text: The Company maintains an operational Incident Response Plan ("IRP") that defines how the Company handles cyber incidents, including escalation, reporting and remediation procedures. The IRP is reviewed annually both internally and by third parties during regular audits. In addition, the Company retains a third-party consultant with expertise in cyber risks and incidents to advise on cybersecurity related matters. The Company's consultant is also part of the Company's IRP procedures and provides independent analysis and advice during cybersecurity investigations. The Company also provides annual trainings for all employees designed to reinforce the Company's information technology risk and security management policies, standards and practices, as well as the expectation that all employees comply with these policies. These trainings are supplemented by Company-wide assessment initiatives, including periodic testing. The Company provides specialized security training for certain employee roles.


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third -party systems.


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown and changing cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy, or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information.


text: Risk Management and Strategy We have processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into our overall risk management systems and include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. We conduct security assessments of certain third-party providers before engagement and have established monitoring procedures in our effort to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Mobile Infrastructure Corp

ticker: BEEP


text: The Company also utilizes internal and external audits and assessments, vulnerability testing, governance processes over outsourced service providers, active risk management, and benchmarking against peers in the industry to validate the Company's security posture. The Company also engages external firms to measure the Company's NIST CSF maturity level.

companyName: Cohen & Co Inc.

ticker: COHN


text: Board of Directors The Audit Committee of our Board (the "Audit Committee") oversees, among other things, the controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in our disclosure controls and procedures. Further, our Chief Financial Officer and our Head of Information Technology report on cybersecurity matters, including material risks and threats, to the Audit Committee, and the Audit Committee provides updates to our Board, in each case as frequently as is appropriate.


text: Under the oversight of the Audit Committee, and as directed by our Chief Financial Officer, our Head of Information Technology has established policies for and is primarily responsible for overseeing our cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats. As part of this cybersecurity program, we utilize a third-party managed information technology service provider (the "MSP") for cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. The MSP has the requisite experience to oversee our cybersecurity program. Our Chief Financial Officer and our Head of Information Technology are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan. In addition, our Chief Financial Officer and our Head of Information Technology coordinate with our legal counsel to assess and manage material risks from cybersecurity threats. Our Chief Financial Officer and our Head of Information Technology provide updates as frequently as appropriate to the Audit Committee.


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Cybersecurity Risk Management and Strategy We recognize the increasing volume and sophistication of cyber threats and take our responsibility to protect the information and systems under our purview seriously. We consider cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. Our cybersecurity processes aim to provide a comprehensive approach to assess, identify, manage, mitigate, and respond to cybersecurity threats.

companyName: SUPERIOR GROUP OF COMPANIES, INC.

ticker: SGC


text: We maintain a cybersecurity risk program predicated on a risk-based approach. We use cost-effective controls that are commensurate with the risk and sensitivity of our specific information systems, control systems and enterprise data. Our cybersecurity program incorporates best practices and industry standards from multiple sources and is designed to comply with applicable regulations. The cybersecurity program includes, but is not limited to, the following elements: risk assessment, policies and procedures, training and awareness, auditing, log collection and analysis, threat hunting and intelligence surveillance, compliance monitoring and testing, and incident response.


text: Our internal professionals collaborate with external subject matter specialists, as necessary. All third parties engaged for such matters are subjected to scrutiny to ensure they satisfy our security standards. We periodically review our third party engagements to ensure that the providers maintain the necessary levels of protection and competency, as well as to oversee and identify potential cybersecurity risks and/or threats from such engagements.


text: We describe how risks from cybersecurity threats could materially affect us, including our business strategy, results of operations, or financial condition, as part of our risk factor disclosures at Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Board and its Corporate Governance, Nominating and Ethics Committee are responsible for oversight of our cybersecurity risk, including the effectiveness of cybersecurity risk management policies and protocols, while our Chief Information Officer (CIO) is responsible for our cybersecurity strategy and execution.


text: As part of the Board's oversight, its Corporate Governance, Nominating and Ethics Committee, which is comprised entirely of independent directors, receives quarterly reports from executive management about the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Board receives at least an annual report from executive management. Additionally, we have processes by which a cybersecurity incident would be escalated internally and, when appropriate, reported to the Board (or appropriate committee), as well as for updating the Board regarding such incident until it has been resolved.


text: Our CIO has more than 25 years of technology and information systems leadership experience, including as CIO of multiple consumer-focused companies. Our CIO reports to our chief executive officer.


text: No risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our information technology policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. The Company's Chief Information Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our Chief Information Officer has over a decade of experience leading cybersecurity oversight, and others on our IT security team have cybersecurity experience and certifications. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and engage external resources and advisors as needed. All employees are required to complete cybersecurity trainings each month through online trainings and simulations.

companyName: SIGA TECHNOLOGIES INC

ticker: SIGA


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third -party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.


text: To date, risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. For more information about the cybersecurity risks we face, see the risk factor entitled "Our business and operations would suffer in the event of a significant computer system failure, cyber-attack or deficiency in our cyber-security" in Item 1A. Risk Factors.


text: The full Board receives updates periodically or as needed during the year from the Company's Chief Information Officer and actively participates in discussions with management and amongst themselves regarding cybersecurity risks. Updates delivered to the full Board typically include discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. These updates also typically include a review of any recent enhancements to the Company's defenses and management's progress on its cybersecurity, as well as reports on key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats.


text: Risk Management and Strategy The Company has processes in place to identify, assess, and monitor material risks from cybersecurity threats, which are part of the Company's overall enterprise risk management process and have been embedded in the Company's operating procedures, internal controls, and information systems.


text: The Company's comprehensive cybersecurity and information security framework includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. The framework leverages the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF") for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley for assessment of internal controls.


text: The Company contracts with external firms to assess the Company's cybersecurity controls relative to its peers using the NIST CSF. The Company also has a third -party risk management program that assesses risks from vendors and suppliers. In addition, the Company maintains business continuity and disaster recovery plans as well as a cybersecurity insurance policy.


text: The Company has established cybersecurity and information security awareness training programs. Formal training on topics relating to the Company's cybersecurity, data privacy, and information security policies and procedures is mandatory at least annually for all employees. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors, or safety issues. Based on role and location, some employees receive additional in-depth training to provide more comprehensive knowledge on potential risks related to their individual job responsibilities. Training is supplemented through regular Company communications with frequent updates to educate on the latest adversary trends and social engineering techniques. Certain employees also obtain industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.


text: The Company engages in cyber crisis response simulations to assess the Company's ability to adapt to information and operational technology threats. Improper or illegitimate use of the Company's information system resources or violation of the Company's information security policies and procedures is subject to disciplinary action. The Company's security posture is supported by a comprehensive defense-in-depth strategy that relies on layers of technology including multi-factor authentication and principles of zero trust to ensure that access to information and communication is vetted and secure.


text: through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care;

companyName: ALPHA PRO TECH LTD

ticker: APT


text: Role of the Board and Management The Company's board recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The board is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage, and mitigate risk, at least annually. The board has delegated responsibility for oversight of the Company's cybersecurity, information security framework, and risk management to the Company's management cybersecurity committee (the "Cybersecurity Committee"). Pursuant to its charter, the Cybersecurity Committee must consist of at least four members of the Company's executive management team, which shall include the Company's director of technology, chief operating officer, chief compliance officer, and chief financial officer, each of whom is required to have working familiarity, knowledge, and competencies in relevant areas, including data privacy, public policy, information technology ("IT") strategy, IT development and deployment, or IT risk assessment and management, including information security management. In addition, the Company's director of technology has formal education in IT and extensive experience working in and leading the Company's information systems and technology function.


text: Review and provide oversight on the effectiveness of the Company's information security and privacy policies and procedures with respect to its products and services and internal-use information technology systems;


text: Review and provide oversight on the policies and procedures of the Company in preparation for responding to any material information security or privacy incidents;


text: Review and provide oversight on the Company's disaster recovery, business continuity, and business resiliency capabilities, including escalation protocols, relating to its customer-facing products and services and internal-use IT systems; Review annually the appropriateness and adequacy of the Company's cyber-insurance coverage;


text: Review and provide oversight on the policies and procedures of the Company with respect to data privacy, and oversee the Company's compliance with applicable data privacy and cybersecurity laws and regulations; Evaluate the Cybersecurity Committee's composition and performance on an annual basis;


text: Review and reassess the adequacy of the Cybersecurity Committee's written charter annually and recommend to the board any changes the Cybersecurity Committee determines are appropriate; and Perform any other activities required by applicable law, rules, or regulations (including the Securities Exchange Act of 1934 and the NYSE American Stock Exchange regarding reporting and disclosure obligations related to cybersecurity risks, costs, and incidents), and take such other actions and perform and carry out any other responsibilities and duties delegated to it by the board or as the Cybersecurity Committee deems necessary or appropriate consistent with its purpose.


text: The Cybersecurity Committee, including the Company's director of technology, receives regular updates from the Company's management on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, to inform our professionals' risk identification and assessment.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our program to best practices, as well as by engaging experts to attempt to infiltrate our information systems (as such term is defined in Item 106(a) of Regulation S-K). We test and review the result on a semi-annual basis.


text: Our cybersecurity program includes controls designed to identify, protect against, detect, respond to and recover from cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K), and to provide for the availability of critical data and systems and to maintain regulatory compliance. These controls include the following activities: monitor emerging data protection laws and implement changes to our processes designed to comply; conduct regular cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;


text: conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats;


text: perform annual system access audit with all departments and personnel review access logs on all perimeter, security and sensitive data areas We perform periodic internal assessments to test our cybersecurity controls and regularly evaluate our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity or personal data breaches, and we perform periodic internal assessments to test our controls and to help us identify areas for continued focus, improvement, and/or compliance.


text: We have established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our board when found. In addition, our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " Security breaches and other disruptions to the Company ' s information technology infrastructure could interfere with the Company ' s operations, compromise information belonging to the Company and our customers and suppliers and expose the Company to liability, which could adversely impact the Company ' s business and reputation " included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K which disclosures are incorporated by reference herein.


text: In the last fifteen fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance Cybersecurity is an important part of our enterprise risk management program and an area of increasing focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Management is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management process described above, including the operation of our incident response plan. Annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management process and strategy covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials if necessary, including current and emerging material cybersecurity threat risks and describing the company's ability to mitigate those risks, and discusses such matters with our IT Manager.


text: Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management process. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management process, which is discussed in greater detail above, is led by our IT Manager. Such individual has over twenty five years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs.


text: Our IT manager's skills are further enhanced by MCSA and MCSE certifications and a foundation in Computer Engineering studies at university. Our IT manager has a strong track record of working with major vendors' security, firewall, identity management, and other platforms, ensuring robust and resilient IT infrastructures.


text: Risk Management and Strategy Our information security program includes administrative, technical and physical safeguards and is designed to provide an appropriate level of protection to maintain the confidentiality, integrity and availability of our Company's and our customers' information. This includes protecting against known and evolving threats to the security of customer records and information, and against unauthorized access, compromise, or loss of customer records or information.

companyName: AMES NATIONAL CORP

ticker: ATLO


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: LIQUIDMETAL TECHNOLOGIES INC

ticker: LQMT


text: Our information security program is designed to continuously adapt to an evolving landscape of emerging threats and available technology. Through data gathering and evaluation of emerging threats from internal and external incidents and technology investments, security controls are regularly monitored and adjusted on an as needed basis. We have developed a data security strategy that is integrated within our overall risk management strategy and implemented through layers of controls embedded throughout our technology environment that establish multiple control points between threats and our assets. We test the effectiveness of our controls and data protection processes through internal and independent external audits and assessments, including regular penetration tests, vulnerability scans, disaster recovery tests and cyber exercises to simulate hacker attacks. Our information security program is supported by regular training of information technology employees and awareness training and activities for executives, directors, and employees companywide through which we communicate our information security policies, standards, processes and practices.


text: Further, our information security program is designed to provide oversight of third parties who store, process or have access to sensitive Company or customer data, and we require similar levels of protection from third -party service providers as are required for the Company. We maintain supplier risk assessment processes to identify risks associated with third -party service providers.


text: We employ business continuity, backup and disaster recovery procedures for systems that are used for storing, processing and transferring customer information, and we periodically test and validate our disaster recovery plans to validate our resilience capabilities. Additionally, we maintain insurance coverage that, subject to applicable terms and conditions, may cover certain aspects of cybersecurity and information risks. However, there can be no assurance that liabilities or losses we may incur will be covered under such policies or that the amount of insurance will be adequate.


text: Our information security program is designed and managed to be consistent with the framework and guidelines of the FFIEC Information Security IT Examination Handbook, FFIEC Business Continuity Planning Handbook and FFIEC Cybersecurity Assessment Tool. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur. Along with periodically being examined by our regulators, the Company regularly engages external experts to audit, evaluate and validate our controls against these standard frameworks, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these examinations, audits and evaluations.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company to date. While we are not currently aware of any cybersecurity threats that are reasonably likely to materially affect the Company, there is no assurance that we will not be materially affected by such threats in the future. For additional information on our risks related to cybersecurity, see Item 1A, Risk Factors—Operational Risks.


text: Our Board of Directors and executive officers are responsible for oversight of our information technology framework, including cybersecurity, information security, information technology and business continuity. The Chief Information Officer ("CIO") and other members of senior management report to the Board of Directors and executive officers at least annually and on an as needed basis. In the event of an immediate cyber threat to our business operations, the CIO would promptly initiate the Company's incident response plan including notifying executive officers, Board of Directors and regulators.


text: While our Board of Directors provides oversight of our information technology environment, the ultimate responsibility for our processes for identifying, assessing and managing cybersecurity risks resides with management. The CIO, with assistance from internal and external resources, is responsible for the implementation and providing oversight to our organization and maintaining the appropriate level of expertise to manage and implement cybersecurity policies, programs and strategies. The CIO has served for over 30 years in information technology and various roles within the Company.


text: Risk Management and Strategy As a financial institution, we believe that the risk of cybersecurity incidents is a significant, increasing, and always evolving risk for our business. Federal law and regulations require us to maintain a comprehensive written information security program, and federal banking regulators regularly issue guidance regarding cybersecurity threats intended to enhance our cybersecurity risk management. Accordingly, we have developed and implemented processes for assessing, identifying and managing material risks from cybersecurity threats designed to comply with federal law and regulations and protect against cybersecurity threats to our business. Our program is supported by management and the Board. The Company maintains an active cyber insurance policy to enhance protections against material data intrusions or loss of privacy. For an overview of the federal banking laws and regulations that govern our management and oversight of cybersecurity risks, refer to Item 1. Business – Supervision and Regulation – "Financial Privacy and Cybersecurity Requirements," incorporated by reference into this Item 1C.

companyName: Investar Holding Corp

ticker: ISTR


text: The Company's IS Program is comprised of five pillars: the Information Security Policy, the Enterprise Information Security Risk Assessment, the Incident Response Plan, a formalized Security Awareness Campaign, and an enterprise monitoring and reporting program.


text: The Enterprise Information Security Risk Assessment quantifies risk criteria utilizing the same impact measures, including financial, strategic, operational, and reputational, set forth by the Enterprise Risk Committee. The risk assessment is reviewed and approved by the B oard annually. The Enterprise Risk Committee includes members of management from various departments and members of the Board and oversees the overall risk management of the Company. The Enterprise Risk Committee meets as often as appropriate to perform its responsibilities, but no less than once per calendar quarter and reports findings and provides recommendations to the Board on a routine basis.


text: The IRP includes procedures for responding to actual or potential cybersecurity incidents, including providing timely notice to customers and our bank regulatory agencies when appropriate. The IRP is based on the NIST Cybersecurity Framework. The plan is tested annually through tabletop exercises.


text: The Security Awareness Campaign is designed with the goal that employees are educated on policy, threats, and best practices from onboarding and throughout their tenure at the Company. This effort includes an onboarding training program, annual attestation and training, and weekly communication designed to help instill in employees a security mindset through repetition.


text: The Company maintains an enterprise monitoring and reporting program, which identifies key risk indicators for tracking and identifying trends. The key risk indicators are presented to the Company's IT Committee and th e Board on a monthly basis.


text: The IS Program is monitored each year through various internal and external audits, as well as OCC regulatory exams. Vulnerability and penetration testing are also conducted at least annually by an independent third party to supplement the vulnerability and patching program routinely performed by internal staff. Third-party vendors supplement the Company's internal patching program as necessary. The Company also utilizes a third -party "SOC as a Service" to monitor extended detection and response logs and network traffic.


text: Third-party service provider risk is evaluated prior to and throughout the relationship. Third-party service providers must meet a minimum set of baseline security standards prior to being onboarded. During onboarding, the third party and the services they provide are added to the Information Security Risk Assessment, including consideration of inherent risk factors and mitigating controls. Alternative vendors and the effort to transition between vendors are identified during onboarding as well as in the event that the selected provider may fail in providing contracted services at any time. After a third party is onboarded, they are subject to the annual third -party risk management program, specific to their assigned risk criticality. This effort includes the review of service organization controls reports, business continuity and disaster recovery efforts, insurance certificates, and other compliance related concerns when applicable.


text: We have not experienced any cybersecurity incidents that have materially affected our Company, including our business, strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats may be reasonably likely to materially affect us, refer to Item 1A. Risk Factors – Risks Related to our Business – "We rely on information technology and telecommunications systems, many of which are provided by third-party vendors" and – "Cyberattacks or other security breaches could adversely affect our operations, net income or reputation," incorporated by reference into this Item 1C.


text: The Board is responsible for oversight of risks from cybersecurity threats. Oversight of cybersecurity risk management is performed primarily by the Board and the IT Committee. The IT Committee's primary purpose is to assist the Board in its oversight of technology and innovation strategies, plans and operations related to cybersecurity, data privacy, and third-party technology risk management. Of the IT Committee members who are not Board members, only our CIO and CISO are responsible for assessing and managing cybersecurity risks, and the other committee members are responsible for oversight. The CISO provides monthly information security reports to the Board and IT Committee on cybersecurity programs, policies and controls, key risk indicators and trends including responses to any cybersecurity events, and efforts to improve security. Annually, the CISO provides security training to the Board. The CISO also provides the Board with an annual Information Security Program Summary Report in compliance with federal banking guidelines.


text: The IS Program is managed by the CISO who reports to the Chief Operations Officer and is reviewed by regulators as well as internal auditors. An information security analyst reports to the CISO and performs security and assurance functions daily. The CIO and information technology staff support the CISO in cybersecurity operations as necessary to mitigate risks to the Company's technology infrastructure. The CISO holds two cybersecurity industry leading certifications (Certified Information Systems Security Professional and Certified Cloud Security Professional) and has more than 20 years of technology experience. The CIO has been in the information technology field for over 30 years and at various points held the following certifications: Cisco Certified Internetwork Expert, Cisco Certified Network Professional, Cisco Certified Voice Professional, Cisco Certified Design Professional, and Microsoft Certified Systems Engineer. The information security analyst has over five years of experience and holds ISC2's "Certified in Cybersecurity" certification. Information technology staff are generally subject to professional education, experience, and certification requirements, and receive education and mentoring from the CISO and CIO.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including but not limited to the following risks: operational, regulatory compliance, reputational, strategic, information technology, data security and privacy, and market risks such as interest rate, credit, liquidity and price risks. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Board of Directors is responsible for risk oversight over all significant risks facing the Corporation and fulfills this responsibility mainly through its committees. While our Board of Directors takes an oversight role in cybersecurity risk tolerance, we rely to a large degree on management and outside consultants in overseeing cybersecurity risk management. Our Director of Technology Solutions, who reports directly to our Chief Information Officer, is primarily responsible for this cybersecurity component and is a member of management's Operational Risk and IT Steering Committees, and regularly attends and presents to the Risk Committee of our Board of Directors ("Risk Committee").

companyName: FIRST OF LONG ISLAND CORP


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, audits, and threat intelligence feeds to facilitate and promote program effectiveness.


text: We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to provide alerts and monitor and block suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal and third -party specialists. We also maintain a third -party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the ability to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including notification of and escalation to the appropriate team members as well as executive management and the Board of Directors. The Incident Response Plan is coordinated through the Director of Technology Solutions and key members of management. The Incident Response Plan facilitates coordination across multiple departments and is evaluated at least annually.


text: Notwithstanding our defensive measures and processes, the threat posed by cyberattacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks. To date, the Corporation has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Corporation.


text: The Director of Technology Solutions provides information security updates to the IT Steering Committee and the Risk Committee. Cybersecurity metrics are reported to the IT Steering Committee monthly and to the Risk Committee on a quarterly basis. Security training is provided to all staff through targeted training overseen by the Director of Technology Solutions. All Board members receive cybersecurity training annually.


text: The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program. At least annually, the Director of Technology Solutions and the Chief Risk Officer report to the Risk Committee the overall status of the Information Security Program. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Safeguarding the security and integrity of our systems, networks and data is an important element of our business activities. We invest in resources that help us develop and implement various cybersecurity programs and processes that are designed to assess, identify and manage material risks from cybersecurity threats and to address the ever-evolving cybersecurity landscape.

companyName: PAMT CORP

ticker: PAMT


text: For the fiscal year ending December 31, 2024, no cybersecurity threats were identified that significantly impacted or are expected to significantly impact our business strategy, financial performance, or financial position. However, despite the robust capabilities, processes, and security measures in place, there exists the possibility of undetected vulnerabilities or misjudged risks. While our preventive measures aim to mitigate cybersecurity incidents, absolute security cannot be guaranteed, necessitating ongoing vigilance and adaptability in addressing potential risks.

companyName: BLUM HOLDINGS, INC.

ticker: BLMH


text: parties also play a role in our cybersecurity. We engage third-party service providers to conduct evaluations of our security controls, independent audits or consulting on best practices to address new challenges.

companyName: Nakamoto Inc.

ticker: NAKA


text: Our cybersecurity program utilizes various risk mitigation techniques to manage cybersecurity risk by deploying enhanced detection tools. We conduct cybersecurity penetration tests, purple team exercises, and risk assessments through both internal subject matter experts and with the support of third parties to identify threats and vulnerabilities that could adversely impact our business operations. We also attempt to assess the cybersecurity risk profile of, and threats related to, our business partners, vendors and service providers through various assertions of their security practices. In the normal course, we engage assessors, consultants and other third parties to assist in various cyber-related matters. The underlying controls of our cybersecurity program utilize recognized practices and standards for cybersecurity and information technology security. Our risk-based approach enables us to design and implement cybersecurity programs that are specific to our corporate resources, customer profiles and business network.


text: Our senior management team oversees our cybersecurity strategy and has the overall responsibility for assessing and managing our exposure to cybersecurity risk, with the audit committee of the board of directors providing board level oversight of the activities conducted by management to monitor and mitigate cybersecurity risks. Our corporate strategy for information security is led by the Chief Technology Officer ("CTO") of our primary operating company, P.A.M. Transport, Inc., who develops and directs our information security strategy and policy. He also oversees the engineering and operations related to cybersecurity and issues the proper response when a cyber threat is detected. Our CTO has 23 years of experience in technology and 17 years in compliance and cybersecurity management. Cybersecurity strategy and updates are reviewed by our senior management team on a periodic basis. The audit committee periodically receives a report on cybersecurity matters and related risk exposure from our CTO or senior management and discusses this exposure and our risk management strategies and related controls with management and the internal and external auditors. When covered during an audit committee meeting, the chair of the audit committee reports on its discussion to the full board.


text: We have experienced, and will continue to experience, cyber incidents in the normal course of our business. While our approach to cybersecurity risk management is intended to mitigate the threat of a cyber attack or other data compromising incident, it may not be successful in preventing all attacks which could have a significant adverse impact to our business and reputation. See "Risk Factors" above for additional information on risks related our business, including from risks related to cyber-attacks, compromised information security, and technology disruptions and failures. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: ZEVRA THERAPEUTICS, INC.

ticker: ZVRA


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: risk assessments designed to help identify material risks from cybersecurity threats to our critical systems, and information;


text: a security team principally responsible for managing ( 1) our cybersecurity risk assessment processes, ( 2) our security controls, and ( 3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; cybersecurity awareness training of our employees, including incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process for key service providers, based on our assessment of their criticality to our operations and respective risk profile. For more information, see " If our security measures are compromised now, or in the future, or the security, confidentiality, integrity or availability of, our information technology systems, software, services, communications or data is compromised, limited or fails, this could result in a material adverse impact, including without limitation, a material interruption to our operations, harm to our reputation, significant fines, penalties and liability, breach or a triggering of data protection laws, privacy policies and data protection obligations, loss of customers or sales, or material disruption of our clinical trials or other business activity. " in the " Risk Factors " section above.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Our management team, including R. LaDuane Clifton, Chief Financial Officer and Treasurer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team includes IT staff such as a Director of IT with more than 21 years of IT-related experience in various roles including managing information security, managing privacy and data protection, evaluating cybersecurity risks, developing cybersecurity strategy, and implementing cybersecurity programs.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk Management and Strategy The Company's cybersecurity environment is led by our information technology (IT) group, which, in addition to cybersecurity matters, oversees the Company's IT infrastructure. The IT group is responsible for monitoring and managing the security of the Company's corporate network and enterprise systems, including technical controls, and safety protocols and responding to security threats.

companyName: US ENERGY CORP

ticker: USEG


text: The Company maintains a cybersecurity risk management program that establishes safeguards for protecting the confidentiality, integrity, and availability of our data, technology, and information systems. The program includes general controls for managing changes in and access to the Company's IT environment, cybersecurity awareness and training to help employees identify and mitigate against cybersecurity threats, cybersecurity incident response plans and third-party incident response retainers to help expedite the Company's response in the event of a cybersecurity incident.


text: The Company's Director of IT is primarily responsible for the day-to-day operation of the Company's cybersecurity program and for identifying cybersecurity threats and incidents and managing the material risks associated with the cybersecurity threats. The Company's Director of IT engages third-party vendors and cybersecurity consortiums periodically for cybersecurity-related guidance and certifications. In the event of a cybersecurity incident, the Company's process calls for the Director of IT and Chief Financial Officer, to work to assess and respond to the incident and provide briefings to the Chief Executive Officer and the Audit Committee of the Board of Directors.


text: The Audit Committee is responsible for providing oversight over management's processes to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate any incidents. The Audit Committee also reports material cybersecurity risks to the Board. We believe this risk management process provides visibility and oversight to allow the Board and executive leadership team to make timely, data-driven decisions ensuring that the Company, its employees, investors, and partners are adequately protected.


text: As of and for the year ended December 31, 2024, there have been no cybersecurity incidents that have materially affected the Company's business strategy, results of operations, or financial condition.


text: The Company has established protocols for evaluating, identifying, and mitigating significant risks stemming from cybersecurity threats. These protocols are integrated into the Company's overarching risk management framework, including potential risks arising from the utilization of third-party service providers. Furthermore, the Company has instituted monitoring procedures to proactively address and minimize risks associated with data breaches or security breaches originating from external sources. Periodically, the Company may enlist the expertise of third-party consultants, legal advisors, and audit firms to assess and fortify its risk management systems, as well as to manage and resolve specific cybersecurity incidents, as deemed necessary.


text: Under our enterprise risk management initiative, our Board of Directors and the Audit Committee engage in regular discussions with our senior management team, including the Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, to manage cybersecurity threats. The Board and Audit Committee are promptly briefed on any cybersecurity incident surpassing predetermined reporting thresholds, receiving continuous updates until resolution.


text: Cybersecurity threats represent a paramount concern for the Company. Our information systems department collaborates closely with senior management to implement a comprehensive program aimed at safeguarding our information systems and promptly responding to cybersecurity incidents, adhering to established incident response and recovery protocols. Cross-functional teams are deployed across the organization to address and mitigate cybersecurity threats, with senior management overseeing prevention, detection, and remediation efforts in real-time, reporting significant developments to the Board and Audit Committee as necessary.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, our business strategy, results of operations, or financial condition.

companyName: Lightstone Value Plus REIT II, Inc.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: an information technology team principally responsible for managing ( 1) our cybersecurity risk assessment processes, ( 2) our security controls, and ( 3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program.


text: The Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including the Chief Executive Officer and President, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from information technology personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Company's information security program is designed to preserve the accuracy and integrity of all forms of information processed by us and to protect such information, including our employees', customers' and end users' personally identifiable information and information related to our operations, from misuse, loss, or theft. Our information security program is founded on principles and standards of the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity issued by the U.S. government.

companyName: Apyx Medical Corp

ticker: APYX


text: The outsourced Chief Information Security Officer ("CISO") works closely with the Chief Financial Officer to collectively manage our global information security, information technology and data privacy programs. The Company's information security program includes a robust set of controls and safeguards for the systems, applications, and databases of the Company and of its third-party vendors. The CISO manages the information security program and sets annual targets and security objectives. The program includes regular risk assessments and recurring internal and external audits to assess the program's maturity and effectiveness. The results of these assessments and audits help inform decisions to make program adjustments and ensure that the program's security objectives are effective and up to date. Additional features of our cybersecurity program include security controls, such as firewalls and intrusion detection systems; data loss prevention tools; penetration testing of network, cloud, and application platforms; security assessments of our third-party vendors; and security awareness education for our employees and specialized training for our information security specialists.


text: We have implemented security monitoring capabilities, designed to alert us to suspicious activity and have developed an incident response program that includes periodic coordinated response exercises designed to restore business operations as quickly and as orderly as possible in the event of a breach. In the event of cyber incident which may be considered "material" under the SEC's disclosure rules, Apyx Medical has established a separate committee comprised of the CISO, Chief Financial Officer, Outside Counsel, Chief Executive Officer, and Department Heads, if necessary. This committee is responsible for determining whether a cyber incident, or series of incidents, is "material" and requires disclosure under Item 1.05 of Form 8-K as well as informing the Board of Directors about the incident from a risk oversight perspective.


text: W e have not identified risks from cybersecurity threats that have materially affected us, including our financial position, results of operations, cash flows, or reputation, although certain risks, if realized, are reasonably likely to materially affect us. For more information regarding the risks we face from cybersecurity threats and how those risks could affect us, please see Item 1A. "Risk Factors. "

companyName: Holley Inc.

ticker: HLLY


text: The Board of Directors oversees risks relating to cybersecurity. The CISO and Chief Financial Officer present to the Board of Directors on a quarterly basis and the results of the risk assessments and audits on at least an annual basis. These reports also include detailed updates on the Company's performance preparing for, preventing, detecting, responding to, and recovering from cyber incidents. Apyx outsources the majority of our IT services and security to a well-respected company in the industry.


text: Failure of our information security program to prevent or detect a cyber incident could result in the compromise of Company and customer information, reputational damage, and/or financial loss. During the periods covered by this report, we did not experience any material cyber incidents and the expenses we incurred from cyber incidents were immaterial. While prior incidents have not had a material impact on us, future incidents could have a material adverse effect on our business, results of operations and cash flows. For additional information about our cybersecurity risks, see Item 1A — Risk Factors on this Annual Report on Form 10-K.


text: Risk Management and Strategy We have developed a comprehensive Information Security Program ("ISP") that was designed as the guiding policy to establish standards designed to protect the confidentiality of nonpublic, sensitive personal and business information, protect against potential threats to the security or integrity of such information, and protect against unauthorized access to or use of such information. The ISP applies to all Company employees, contractors, consultants, and third-party vendors as well as all technology owned and operated by the Bank. The scope of the ISP covers customer data as well as the Company's strategic and proprietary information. The Board of Directors approves the ISP annually. Additionally, the Information Technology Steering Committee ("ITSC") must approve significant modifications to the ISP prior to review and approval by the Board of Directors. The Chief Information Officer ("CIO") is responsible for the implementation and maintenance of the ISP.

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: Identification of sources and types of technology threats Tools and processes to manage technology security, such as change control approval, employing a Unified Threat Management System, and usage of anti-virus and anti-spam hardware Ongoing security assessments conducted by third -party vendors, such as vulnerability assessments and penetration testing, and mitigation of any findings Continuous firewall monitoring provided by a third -party vendor Information security training for employees provided by a third -party vendor Annual security audits of third -party vendors Our Information Security Governance Plan ("InfoSec") is a component of the ISP and provides for strategic oversight of critical aspects of the Bank's information security. The objective of InfoSec is to provide a framework for decision-making and accountability for information security issues to ensure that the ISP is actively monitored, and information security permeates through all areas and initiatives across the organization. InfoSec is actively managed by an InfoSec Governance Council ("ISGC") that consists of the Chief Risk Officer ("CRO"), virtual Chief Information Security Officer ("CISO"), Chief Strategy and Innovation Officer ("CSIO"), a cybersecurity focused systems engineer, and the CIO. The CRO, CISO, and CIO are part of the ITSC, along with other executives of the Bank.


text: Security assessments are an ongoing activity within the Bank, and the Security Assessment Policy identifies security assessment requirements and those individuals accountable for ensuring the assessments comply with the requirements. All assessment activities must be approved by the CRO. The coverage of assessments includes, but is not limited to, physical security assessment, information technology general controls audit, vulnerability assessment, penetration testing, and social engineering testing. Results are shared with the ITSC, executive management and the Board of Directors.


text: There is an established Incident Response Program ("IRP") that provides a framework for us to respond quickly, decisively, and appropriately to limit the impact of an adverse event, such as a cybersecurity incident, on customers and information resources. Procedures have been developed that outline the necessary steps should an incident occur, such as incident identification, classification, and escalation. We use a Cybersecurity Assessment Tool to assess our cybersecurity preparedness on a periodic basis. A Cybersecurity Incident Response Team, which is part of our general Incident Response Team, will take the appropriate actions as outlined in the IRP in the event a cybersecurity situation occurs.


text: We do not believe that risks from cybersecurity threats, including the previously disclosed cyber-attack that occurred in April 2023, have materially impacted or are reasonably likely to materially impact our overall business strategy, results of operations, or financial condition. We maintain cybersecurity insurance to cover the costs resulting from cyber-attacks; however, the policy may not cover all losses from cybersecurity incidents. Refer to the discussion on the April 2023 incident in Note 15 - Commitments and Contingent Liabilities of our Consolidated Financial Statements and the discussion of cybersecurity risk in Part I, Item 1A, "Risk Factors".


text: Board of Directors The Board of Directors, in coordination with the Audit Committee, oversees the Company's management of cybersecurity risk. The Board receives monthly reports from the CIO, focusing on cybersecurity and information technology updates. The reports include key insights regarding our security risk score, areas of focus, and metrics from our third-party provider regarding security investigations and incidents as well as the results of training and phishing simulations. The Audit Committee receives periodic updates on information security risk and maturity of our ISP. The Audit Committee also receives reports with the results of security assessments conducted by third-parties.


text: Under the leadership of the CIO, the ITSC serves to improve the effectiveness of information technology at the Bank and ensure alignment with the Bank's strategic business plan and statement of risk appetite. Composition of the ITSC consists of senior management from the business areas. The virtual CISO is a non-voting member of the ITSC. Meetings occur at least bi-annually. The ITSC is tasked with reviewing the Bank's technology, information security, business continuity, digital initiatives, vendor management, and data management strategic direction and providing feedback to management.


text: The ISGC acts on the behalf of and to assist the Board of Directors and executive management in fulfilling its oversight responsibilities regarding the Bank's information security programs and risks. The ISGC is comprised of members from Risk, Information Technology, and other strategic areas within the Bank and meets at least quarterly. The responsibilities of the ISGC include providing strategic oversight and implementation guidance for the ISP, aligning cybersecurity and business objectives, monitoring and reporting on cybersecurity and information security incidents, and promoting a strong culture around information security.


text: As stated above, the CIO is a member of the ISGC, chairs the ITSC, and reports to the CSIO. The CIO has over 40 years of business experience in information technology and cybersecurity and is a Certified Bank Cybersecurity Manager. The virtual CISO is outsourced to a third-party vendor that specializes in partnering with organizations to enhance cybersecurity management and reports to the CRO.


text: Risk Management and Strategy Our business heavily relies on various IT and application systems, which contain proprietary and confidential information about our operations, employees, customers, and our customers' customers, including personally identifiable information. These systems are connected to and/or accessed from the Internet and, as a result, are susceptible to cyber-attacks. We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. Our process is supported by both management and our Board of Directors. Organizationally, our businesses are structured as three operating and reportable segments: Ting, Wavelo and Tucows Domains. These segments are decentralized; management and cybersecurity resources are organized both at the parent company level and within each decentralized segment. Each segment has dedicated liaisons for cybersecurity, compliance, and risk management activities.

companyName: TUCOWS INC /PA/

ticker: TCX


text: We maintain and continue to expand our investment in the development of our information security management system ("ISMS"). Our ISMS leverages a risk-based approach and is informed by industry standard guidance, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization for Standardization ("ISO") 27001 Information Security Management System Requirements. A material cyber-attack on Company systems, distribution partners and their key operating systems, or any other third -party partners or vendors and their key operating systems may interrupt the ability to operate the Company's business, damage the Company's reputation, or result in monetary damages. The development of the ISMS is focused on the protections of the confidentiality, integrity, and availability of the Company's information system infrastructure as well as the data in the Company's care, custody and control. The Company engages third parties to evaluate certain aspects of the ISMS, provide threat intelligence, and perform vulnerability assessments and other services as needed.


text: The Company follows an established process to identify and evaluate risks from cybersecurity threats that may arise internally or through the introduction of third parties to the ISMS. This evaluation is part of the Company's risk management process. The process may include, but is not limited to, evaluating the third party's cybersecurity maturity and/or imposing certain contractual conditions.


text: Operationally, the Company maintains Security and Network Operations Centers, which provide 24/7 coverage and support of on-call cybersecurity and network professionals to triage and respond to immediate cybersecurity threats and outages. The Company also assesses cybersecurity risks on a quarterly basis and ranks them according to their risk profile. These risks are communicated to management and to the Board of Directors as part of the normal course of operations.


text: Cybersecurity incidents are responded to in accordance with the Company's established Cybersecurity Incident Response Plan ("IRP"). In the event of an incident, we follow our IRP, which includes evaluation of the severity of the incident based on factors such as the number of assets affected, the extent of the incident, the likelihood of inappropriate data exposure, operational impact and/or reliability impact. Dependent upon the severity of an incident, the incident is escalated to the senior leadership, including the CEO and senior leadership. Senior leadership then determines whether, based on various factors, the incident requires immediate escalation to the Board of Directors and to third -party incident response organizations and notification to functional areas, such as legal and finance, as well as senior leadership and the Board, and external entities, as appropriate and required. We maintain relationships with third -party Digital Forensics and Incident Response ("DFIR") service providers to strengthen our incident response capabilities in the event that we determine the need to augment our effort during an incident and to provide us additional assurance that our responses to complex incidents or highly sophisticated threat actors have been effective and complete.


text: Although the risks from cyber threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future and we continue to closely monitor cyber risk. For a detailed description of the risks related to cybersecurity, see Item 1A. "Risk Factors." of this Annual Report, which should be read in conjunction with this Item 1C.


text: Board Governance and Management The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership manages our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The corporate information security function is responsible for managing and continually enhancing our information security posture and information security infrastructure with the ultimate goal of preventing cybersecurity incidents and reducing their severity to the extent feasible, while simultaneously increasing our resilience in an effort to minimize the business impact should an incident occur.


text: Senior leadership, including our CEO, who also has relevant experience in cybersecurity matters, regularly brief the Board of Directors on our cybersecurity and information security initiatives, and the Board of Directors is apprised of cybersecurity incidents deemed to have a material business impact.


text: Risk Management Strategy We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: While everyone at our company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by our Board of Directors, the audit committee of the Board of Directors ("Audit Committee") and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.


text: Our cybersecurity risk management program includes: physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and customer, employee, bank partner and other third -party information stored on those systems, such as access controls, encryption, data handling requirements and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices;


text: a defined procedure for timely incident detection, containment, response and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents;


text: cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services and broader enterprise Information Technology ("IT") environment; a security team responsible for managing our cybersecurity risk assessment processes and security controls;


text: the use of external consultants or other third -party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls;


text: annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information, such as consumer information; and a third -party risk management process that includes internal vetting of certain third -party vendors and service providers with whom we may share data and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third -party vendor or service provider or otherwise implicating the third -party technology and systems used.


text: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, results of operations or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, refer to Part I, Item 1A "Risk Factors."