text: Currently, we rely on our third party for much of our cybersecurity efforts. Internally, we are working towards formally employing and documenting a risk-based approach to cybersecurity which aligns with corporate strategy, risk management and governance, and adaptable information technology ("IT")


text: infrastructure. Our cybersecurity program will consist of policies, procedures, systems, controls and technology designed to help prevent, identify, detect and mitigate cybersecurity risk and will be based on a cybersecurity framework, such as the National Institute of Standards and Technology ("NIST") Cybersecurity framework.

companyName: EMPIRE PETROLEUM CORP

ticker: EP

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: unanimous


text: To protect our IT systems and information from cybersecurity risks, we, through our third-party provider, use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified cybersecurity vulnerabilities and incidents in a timely manner. These include the utilization of a third-party security operations center connected to a network operation center to identify, investigate, and resolve any cybersecurity threats and incidents.

stage1Method: majority


text: We assess, at least annually, the technological risks to our key IT systems and information. We have implemented controls to identify and manage cybersecurity risks associated with all third-party service providers. These include, but are not limited to, an understanding of access controls, a records and information management policy, change control procedures, risk and control registry, attestation report reviews, and configuration standards.


text: Employee awareness of cybersecurity risks and threats is also an important part of an effective control environment. We periodically communicate to employees about this cybersecurity awareness. In 2024, we plan to require each of our employees to complete annual information security training, in addition to other training requirements. This should lead to an educated, informed, and prepared workforce, with an awareness of potential cybersecurity threats, how they may occur, and how to report and escalate such matters.


text: Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks to our IT systems and information. As a part of this process, we have engaged an independent third-party specialist to review our cybersecurity environment, including formal reviews and assessments, and we have requested specific, actionable recommendations for improvement and implementation.


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that has materially impacted our business or operations, there can be no guarantee that we will not experience such a threat or incident in the future. A material cybersecurity threat or incident could adversely impact our operations, our sales or financial and administrative functions, or result in the compromise of personal or other confidential information of our employees, customers, or suppliers. For this reason, we maintain cybersecurity liability insurance to provide additional support, expertise, and resources to help ensure the integrity of our cybersecurity processes and to provide a level of financial protection in the event of cybersecurity incident related costs and losses.

stage1Category: Strategy Integration


text: Our Audit Committee has oversight of our cybersecurity risk processes, as part of its overall oversight of our risk management program. Our CFO is informed about and facilitates prevention, detection, mitigation, and remediation efforts through regular communication and reporting from the third party provider.

stage1Category: Board Governance


text: In addition, we have an escalation process in place to inform our Chief Executive Officer and other members of our senior management and, if necessary, the Audit Committee and Board of Directors, of important issues or events.


text: on our small size (two employees and two consultants), we rely extensively on information technology systems managed by third party major service providers to securely process, store and transmit our data to conduct business. Our employees and consultants utilize end point security tools, such as firewalls and anti-virus protection, to protect our data. We have recently implemented overall risk procedures which incorporate certain uniform processes. To date, we have not engaged any consultants, auditors or other third parties in connection with our risk management system or processes.

companyName: NETWORK-1 TECHNOLOGIES, INC.

ticker: NTIP


text: Although we take cybersecurity risks seriously, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

companyName: HEALTHY EXTRACTS INC.

ticker: HYEX


text: connection with our use of third party service providers, we have certain processes in place to oversee and identify cybersecurity risks from threats and incidents. To date, we have not been materially impacted by risks from cybersecurity threats or incidents and we are not aware of cybersecurity threats or incidents that are reasonably likely to materially affect our business. However, there could be cybersecurity threats or incidents in the future that may adversely affect our business.


text: Executive Vice President oversees risks of cybersecurity threats and reports quarterly, and as necessary, to the Board of Directors, including promptly reporting any cybersecurity incidents that may pose a significant risk to us. Our Executive Vice President has over ten years of experience with developers of access management, network security and data protection solutions.


text: Company continues to implement policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We employ a variety of tools designed to identify, assess and maintain security measures to meet regulatory requirements, and possess technical personnel to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Our risk factors, which can be found in Item 1A. "Risk Factors," include further detail about the material cybersecurity risks we face. There can be no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Management and Strategy Overview continue the process of designing and implementing a formal risk-based approach to cybersecurity which aligns with corporate strategy, risk management and governance, and adaptable information technology ("IT") infrastructure. Our cybersecurity program consists of policies, procedures, systems, controls and technology designed to help prevent, identify, detect and mitigate cybersecurity risk and will be based on a cybersecurity framework, such as the National Institute of Standards and Technology ("NIST") Cybersecurity protect our IT systems and information from cybersecurity risks, we use and continue to implement various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified cybersecurity vulnerabilities and incidents in a timely manner.


text: These include monitoring and detection programs, network security measures, firewall monitoring devices and multi-factor authentication which are all overseen by our IT Director, who possesses the necessary expertise to implement the appropriate tools and processes to effectively manage cybersecurity risks. With over 30 years of experience in the oil and natural gas industry, our IT Director has 12 years of cybersecurity experience where he has led several teams introducing cybersecurity initiatives and implementing robust frameworks are actively assessing the technological risks to our key IT systems and information and are implementing controls to identify and manage cybersecurity risks associated with all third-party service providers. These include, but are not limited to, an understanding of access controls, a records and information management policy, change control procedures, risk and control registry, and configuration standards.

stage1Category: Management Role


text: awareness of cybersecurity risks and threats is also an important part of an effective control environment. We periodically communicate to employees about this cybersecurity awareness. We are working on an implementation plan to require each of our employees to complete an annual information security training course, in addition to other training requirements. This should lead to an educated, informed, and prepared workforce, with an awareness of potential cybersecurity threats, how they may occur, and how to report and escalate such matters.


text: cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks to our IT systems and information. As a part of this process, we engaged and worked with an independent third-party specialist to review our cybersecurity environment, which included a formal review and assessment, and determined specific, actionable recommendations for improvement and implementation.


text: we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that has materially impacted our business or operations, there can be no guarantee that we will not experience such a threat or incident in the future. A material cybersecurity threat or incident could adversely impact our operations, our sales or financial and administrative functions, or result in the compromise of personal or other confidential information of our employees, customers, or suppliers. For this reason, we maintain cybersecurity liability insurance to provide additional support, expertise, and resources to help ensure the integrity of our cybersecurity processes and to provide a level of financial protection in the event of cybersecurity incident related costs and losses.


text: Audit Committee has oversight of our cybersecurity risk processes, as part of its overall oversight of our risk management program. Our Chief Executive Officer is informed about and facilitates prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our IT Director. In addition, we have an escalation process in place to inform our Chief Executive Officer and other members of our senior management and, if necessary, the Audit Committee and Board of Directors, of important issues or events.


text: We rely on the information technology and systems maintained by our managers, including RMR, and rely on our managers to identify and manage material risks from cybersecurity threats. RMR and our senior living community managers take various actions, and incur significant costs, to maintain and protect the operation and security of information technology and systems, including the data maintained in those systems. Our Audit Committee oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from RMR's chief information officer regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, RMR has a detailed incident response plan in place for contacting authorities and informing key stakeholders, including our management. We have not been materially affected and do not believe we are reasonably likely to be materially affected by any risks from cybersecurity threats, including as a result of previous incidents.

companyName: DIVERSIFIED HEALTHCARE TRUST

ticker: DHC


text: We are dedicated to upholding our commitment to our customers, partners, and employees to manage cybersecurity, privacy, and data protection and security risk. Our approach involves various tools, processes, technologies, and controls to identify and manage such risks.

companyName: Booking Holdings Inc.

ticker: BKNG


text: Risk Management and Strategy Identifying, assessing, and managing cybersecurity risk is generally integrated into our overall risk management systems and processes. The Company's internal audit function, with primary oversight by the Audit Committee, assesses key risks facing the organization across functions and regions. These risks are reviewed and discussed by the Company's management-level risk committee, which is a multi-disciplinary committee including representation from senior management in the finance, internal audit, and legal functions, among others. The risk committee is tasked with ensuring risks, including those related to cybersecurity, are managed and aligning strategic objectives with an appropriate level of risk tolerance.


text: Our Cyber Risk Management Policy establishes the framework for our cybersecurity risk management and governance. Our security teams operationalize the Policy across the Company and conduct cyber risk identification, assessment, management, monitoring, tracking, and reporting. Our privacy program is built upon the privacy principles of transparency, purpose, control, security, embedded privacy, and accountability. Our privacy teams are responsible for identifying, managing, and reporting on data protection risks. We leverage the National Institute of Standards and Technology (NIST) frameworks for cybersecurity and privacy. The NIST frameworks help us to align our security and privacy functions and provide a risk management approach across the Company. We annually measure our security and privacy program maturity against these frameworks, and engage a third party every other year to assess the current state against these frameworks. The results of these assessments are discussed with the Board and the Cybersecurity Subcommittee of the Audit Committee. In addition, our Global Privacy Advisory Council, consisting of our privacy leaders, leads the development and implementation of strategies to monitor, manage, and remediate privacy risks.


text: As part of the Company's risk management strategy, we require that all employees complete regular data security and privacy trainings, and conduct phishing tests and specialized training such as secure coding training for our developers. We also maintain a Security Ambassadors program, where employees act as an extension of the Security and Fraud Department to foster a security-focused culture.


text: Our security teams engage in threat intelligence, predictive modeling, and penetration testing to understand the Company's threat landscape and reduce the risk and impact of cybersecurity incidents. These teams have established procedures for detecting, managing, and remediating cybersecurity incidents, and processes for personnel to escalate incidents within the organization. A cross-functional working group of security, privacy, and legal personnel review significant incidents to determine if further escalation is appropriate. If an incident could be deemed material, it is escalated, and we consult with outside counsel during this assessment as appropriate.


text: Our internal audit function collaborates with the security teams to participate in an integrated cybersecurity assurance program. The internal audit function also performs its own cybersecurity audits and reviews certain cybersecurity-related practices, such as access controls, as part of their assessment of our internal control over financial reporting. From time to time we have taken steps to improve our practices and remedy deficiencies that have been identified. Our enterprise-wide information security program is also independently assessed every other year by a third party as part of our enterprise risk management, and our Cybersecurity Subcommittee reviews the assessment findings. We seek to advance our program maturity in line with our review and management of cybersecurity risks.


text: We rely on certain third-party computer systems and third-party service providers, including global distribution systems ("GDSs") and computerized central travel reservation systems in connection with providing some of our services. We also depend upon various third parties to process payments for our transactions around the world. These third party business partners, service providers, and consultants need to access our customer and other data, and connect to our computer networks. We define expected security and privacy requirements through our contracting processes with third parties and we perform third-party cyber risk assessments to monitor the cyber risk management efforts of third parties as needed.

stage1Category: Third-Party Risk


text: Although we expend significant resources to protect against security breaches, our existing security measures may not be successful in preventing all attacks on our systems. We have experienced cybersecurity incidents and threats, including malware, phishing, partner and customer account takeover attacks, and denial-of-service attacks on our systems. We do not believe these cybersecurity incidents have had a materially adverse effect on our Company, including our business strategy, results of operations, or financial condition. For further discussion, see Part I, Item 1A, Risk Factors - "Information Security, Cybersecurity, and Data Privacy Risks."


text: The Board and Audit Committee maintain responsibility for enterprise risk oversight related to cybersecurity, privacy, and data protection and security. The Audit Committee has delegated the primary responsibility for oversight of compliance and risk management efforts and processes related to these matters to the Cybersecurity Subcommittee, which was established in 2023 and is comprised of independent directors. The Cybersecurity Subcommittee oversees management's efforts and processes to identify, assess, manage, and monitor significant cybersecurity and privacy risks and regulatory developments in this area. Our cybersecurity and privacy leaders meet with the Cybersecurity Subcommittee to discuss the Company's cybersecurity and data protection risk exposures, including the steps management has taken to monitor and manage such exposures and their potential impact on the Company's business, operations, and reputation. The Cybersecurity Subcommittee reports periodically on these matters to the Audit Committee and Board.


text: The individuals serving in the roles of chief security officer and chief privacy officer have enterprise-wide responsibility for assessing and managing cybersecurity, data protection and security, and privacy risks, respectively. These leaders collectively have over 25 years of relevant work experience in public companies and extensive industry expertise.


text: We are dedicated to managing cybersecurity, privacy, and data protection and security risks. We employ various tools, processes, technologies, and controls to identify and manage such risks.


text: Identifying, assessing, and managing cybersecurity risk is generally integrated into our overall risk management processes. The Company's internal audit function, with primary oversight by the Audit Committee, assesses key risks facing the organization, which are reviewed and discussed by the Company's management-level risk committee (a multi-disciplinary committee including representation from senior management in the finance, internal audit, and legal functions, among others). The risk committee is tasked with ensuring risks, including those related to cybersecurity, are managed and aligning strategic objectives with an appropriate level of risk tolerance.


text: The Cyber Risk Management Policy (the "Policy") establishes the framework for our cybersecurity risk management and governance. Our security teams operationalize the Policy across the Company and conduct cyber risk identification, assessment, management, and reporting. Our privacy teams are responsible for identifying, assessing, managing, and reporting on data protection risks. We leverage the National Institute of Standards and Technology (NIST) frameworks for cybersecurity and privacy. We annually measure our security and privacy program maturity against the NIST frameworks, and engage a third-party every other year to assess the current state against these frameworks. The results of these assessments are discussed with the Board and the Cybersecurity Subcommittee of the Audit Committee.


text: As part of the Company's risk management strategy, we require that all employees complete regular data security and privacy trainings, and conduct phishing tests and specialized training such as secure coding training for our developers.


text: Our security teams have established procedures for identifying, assessing, and managing, cybersecurity incidents. A cross-functional working group of security, privacy, and legal personnel review potentially significant incidents. If an incident could be deemed material, it is escalated, and we consult with outside counsel as appropriate.


text: Our internal audit function performs its own cybersecurity and privacy audits and reviews certain related practices as part of their assessment of our internal control over financial reporting. From time to time we have taken steps to improve our practices and remedy deficiencies that have been identified. Our enterprise-wide information security program is also independently assessed every other year by a third party as part of our enterprise risk management, and the Cybersecurity Subcommittee reviews the findings.


text: Our company prioritizes cybersecurity to safeguard our systems, networks, and data. Despite our efforts, we recognize the evolving nature of cyber threats and remain vigilant in addressing potential risks.

companyName: Glidelogic Corp.

ticker: GDLG


text: We rely on certain third-party computer systems and third-party service providers, including global distribution systems ("GDSs") and computerized central travel reservation systems in connection with providing some of our services. We also depend upon various third parties to process payments for certain transactions. These third-party business partners, service providers, and consultants need to access our customer and other data, and connect to our computer networks. We define confidentiality, security, and privacy requirements through our contracting processes and perform third-party cyber risk assessments to monitor such third parties as needed.


text: Although we expend significant resources to protect against security breaches, our existing security measures have not been and may not be successful in preventing all attacks. We have experienced cybersecurity incidents and threats, including malware, phishing, account takeover attacks, denial-of-service attacks, and inadvertent disclosures of data. We do not believe these cybersecurity incidents have had a material adverse effect on our Company, including our business strategy, results of operations, or financial condition. However, the cybersecurity threat environment is increasingly challenging, and we, along with the entire digital ecosystem, face a constant and increasing threat. For further discussion, see Part I, Item 1A, Risk Factors - "Information Security, Cybersecurity, and Data Privacy Risks."


text: The Board and Audit Committee are responsible for oversight related to cybersecurity, privacy, and data protection and security. The Cybersecurity Subcommittee of the Audit Committee oversees management's efforts and processes to identify, assess, and manage significant cybersecurity and privacy risks and regulatory developments in this area. The cybersecurity and privacy leaders meet with the Cybersecurity Subcommittee to discuss the Company's cybersecurity and data protection risk exposures, including steps management has taken to assess and manage such exposures and their potential impact on the Company's business, operations, and reputation. The Cybersecurity Subcommittee reports periodically on these matters to the Audit Committee and the Board.


text: Our information security program is managed by the President of Enterprise Operations, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The President of Enterprise Operations provides periodic reports to the Audit Committee and the full Board of Directors (the "Board"), as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of key initiatives to strengthen the information security profile of our systems, cybersecurity incident response readiness, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: NEOGENOMICS INC

ticker: NEO


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity and information security risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program.


text: To ensure the continued effectiveness of our information security controls, we regularly engage both internal and external experts to evaluate our program. The results of these evaluations are reviewed by senior management and reported to the Board. In addition, we proactively collaborate with key vendors, industry peers, and relevant government and law enforcement entities to remain informed about new threats and best practices. This integrated approach enables us to continuously refine our cybersecurity posture, helping protect the confidentiality, integrity, and availability of our systems and data, as well as evaluate and mitigate the risk of threats from third parties.


text: To date, the Company is not aware of any cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, as discussed under the heading "We depend on information technology systems and maintain protected personal data, and a cyber-attack or other breach affecting these information technology systems or protected data could have a material adverse effect on our results of operations" in Part I, Item 1A, "Risk Factors," the Company remains subject to evolving cybersecurity risks that could have adverse impacts. NEOGENOMICS, INC.


text: Cybersecurity Governance and Oversight Consistent with our overall risk management governance structure, management is responsible for the day-to-day management of cybersecurity risk while our Board and its Audit Committee play an active, ongoing oversight role.


text: Our information security program is overseen by the Chief Information Security Officer ("CISO"), who is responsible for establishing and executing our enterprise-wide cybersecurity strategy, policies, standards, architecture, and associated processes. The CISO has over 20 years of experience in technology and information security, including extensive leadership experience in the biotechnology and laboratory sectors, and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties.


text: The CISO provides periodic updates on our cybersecurity risk profile to management's Technology Risk Management Committee and the Audit Committee of our board of directors. The CISO provides periodic updates to the Audit Committee, the full Board of Directors (the " Board "), our Chief Executive Officer, and other members of senior management, as appropriate. These updates typically address: • Evolving cyber risks and threats; • Progress on strategic initiatives to safeguard our information systems; • Cyber incident response preparedness and capabilities; • Findings from assessments of our information security program; and • Insights into the emerging threat landscape.


text: Cybersecurity Risk Management and Strategy Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions and our information systems, the Company has implemented a comprehensive cybersecurity risk management program, which is a component of its overarching enterprise risk management program. Key components of the cybersecurity risk management program include: • A risk assessment process that identifies and prioritizes material cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors. • A third-party Managed Detection and Response ("MDR") service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting. • A dedicated cybersecurity team covering all critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation and threat intelligence. • A training program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks. • An awareness program that keeps employees informed about cybersecurity threats and how to stay safe online. • An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested on a periodic basis.

companyName: TEXAS CAPITAL BANCSHARES INC/TX

ticker: TCBI


text: The Company engages reputable third-party assessors to conduct various independent risk assessments on a regular basis, including but not limited to maturity assessments and various testing. Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.


text: Our Third-Party Risk Management program is designed to ensure that our vendors meet our cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendor compliance with our cybersecurity requirements.


text: The Company's cybersecurity risk management program and strategy are designed to ensure the company's information and information systems are appropriately protected from a variety of threats, both natural and man-made. Periodic risk assessments are performed to validate control requirements and ensure that the Company's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Company information. These controls include, but are not limited to access control, data encryption, data loss prevention, incident response, security monitoring, third party risk management, and vulnerability management.


text: The Company's cybersecurity risk management program and strategy are regularly reviewed and updated to ensure that they are aligned with the Company's business objectives and are designed to address evolving cybersecurity threats and satisfy regulatory requirements and industry standards.


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A Risk Factors.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Head of IT, internal technology staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Safehold Inc.

ticker: SAFE


text: Board of Directors Oversight The Company's Board of Directors is charged with overseeing the establishment and execution of the Company's risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility the Board has delegated primary oversight responsibility over the Company's risk management framework, including oversight of cybersecurity risk and cybersecurity risk management, to the Risk Committee of the Board of Directors. The Risk Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity program through direct interaction with the Chief Information Security Officer ("CISO") and the Head of Information Risk and provides periodic updates regarding cybersecurity risks and the cybersecurity program to the full Board of Directors. Additionally, awareness and training on cybersecurity topics is provided to the Board on an annual basis.


text: Management's Role The Information Security department is responsible for implementing and maintaining the Company's cybersecurity risk management program. The Information Security department consists of cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Information Security is led by the CISO, who reports directly to the Chief Information Officer and the Board of Directors with dotted-line reporting to the Chief Risk Officer. The Company's CISO has over 20 years of experience in cybersecurity across the financial services industry as well as experience working in a leading managed security services provider. Prior to joining the Company, the Company's CISO served as leader of the Global Threat Management Center for a major global financial institution. The Information Risk department, led by the Head of Information Risk who reports directly to the Chief Risk Officer, is responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities. As a governance and oversight function, the Information Risk department measures and reports on the quality of information and cyber risk management across all functions of the firm. Information security risk is reported by both the Information Security and Information Risk departments through monthly management metric reporting working groups and multiple layers of quarterly risk committees to achieve an appropriate flow of information risk reporting to the Board. The risk committees include the Operational Risk Management Committee, the Executive Risk Management Committee and the Risk Committee of the Board of Directors. These committees establish and oversee policies, programs, and other guidance to provide specific expectations for managing the cybersecurity risk.


text: Cybersecurity Risk Management and Strategy Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions and the Company's information systems, the Company has implemented a comprehensive cybersecurity risk management program, which is a component of its overarching enterprise risk management program. Key components of the cybersecurity risk management program include: • A risk assessment process that identifies and prioritizes material cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors. • A third-party Managed Detection and Response ("MDR") service, which monitors the security of the Company's information systems around-the-clock, including intrusion detection and alerting. • A dedicated cybersecurity team covering all critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation and threat intelligence. • A training program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks. • An awareness program that keeps employees informed about cybersecurity threats and how to stay safe online. • An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested on a periodic basis.


text: The Company's Third-Party Risk Management program is designed to ensure that its vendors meet its cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendor compliance with the Company's cybersecurity requirements.


text: Following these risk assessments, we redesign, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our Vice President of Technology who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. All personnel are made aware of our cybersecurity policies through trainings.


text: Material Effects of Cybersecurity Threats While cybersecurity risks have the potential to materially affect the Company's business, financial condition, and results of operations, the Company does not believe that risks from cybersecurity threats or attacks, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. However, the sophistication of cyber threats continues to increase, and the Company's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it will not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A. Risk Factors.


text: Board of Directors Oversight The Company's board of directors is charged with overseeing the establishment and execution of the Company's risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Consistent with this responsibility, the board of directors has delegated primary oversight responsibility (i) of the Company's general risk management framework to the Risk Committee of the board of directors and (ii) of the Company's information technology, cybersecurity risk and cybersecurity risk management to the Technology Committee of the board of directors, which was formed in the first quarter of 2025. At least one member of the Risk Committee also serves as a member of the Technology Committee. The Risk Committee previously has received, and the Technology Committee will receive on an ongoing basis, regular updates on the Company's cybersecurity risks and incidents and the cybersecurity program through direct interaction with the Chief Information Security Officer ("CISO") and the Chief Security Officer ("CSO"). The Risk Committee previously has provided, and the Technology Committee will provide on an ongoing basis, updates regarding cybersecurity risks and the cybersecurity program to the full board of directors. Additionally, awareness and training on cybersecurity topics is provided to the board of directors on an annual basis.


text: Management's Role The Information Security department is responsible for implementing and maintaining the Company's cybersecurity risk management program. The Information Security department consists of cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Information Security is led by the CISO, who reports directly to the Chief Information Officer and the board of directors with dotted-line reporting to the Chief Risk Officer. The Company's CISO has over 20 years of experience in cybersecurity across the financial services industry as well as experience working in a leading managed security services provider. Prior to joining the Company, the Company's CISO served as leader of the Global Threat Management Center for a major global financial institution. The Information Risk department is led by the CSO, who reports directly to the Chief Risk Officer. The CSO is responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities. As a governance and oversight function, the Information Risk department measures and reports on the quality of information and cyber risk management across all functions of the firm. Information security risk is reported by both the Information Security and Information Risk departments through monthly management metric reporting working groups and multiple layers of quarterly risk committees to achieve an appropriate flow of information risk reporting to the board of directors. The risk committees include the Operational and Information Technology Risk Management Committee, the Executive Risk Management Committee and the Risk Committee and Technology Committee of the board of directors. These committees establish and oversee policies, programs, and other guidance to provide specific expectations for managing cybersecurity risk.


text: Following the completion of the Asset Sale, the Company has been in the process of winding down, liquidating and dissolving all of its business and operations, including transferring the Acquired Assets to Johnson Health Tech, reconciling claims in the Chapter 11 Cases, preparing financial reports, winding down foreign affiliated entities, and preparing for emergence from bankruptcy as contemplated in a liquidation plan filed in the Chapter 11 Cases.

companyName: BOWFLEX INC.

stage1Category: None/Other


text: Due to limited resources and personnel, we do not anticipate having in place on a going forward basis formal cybersecurity risk management programs or processes for assessing risk, which may make us susceptible to heightened cybersecurity risks. We also depend on third parties to provide certain software and related services, and any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure that we utilize, including those of third parties, could lead to the corruption or misappropriation of our information. Because we expect to further rely on third parties, we will also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we will have no personnel or processes of our own for this purpose. Prior to the Chapter 11 Cases, the Audit Committee of our Board was responsible for the oversight of risks from cybersecurity threats. With few remaining Board members since the completion of the Asset Sale, the Board has assumed responsibility for overseeing risks from cybersecurity threats.


text: Cybersecurity risk management is an essential part of our overall risk management strategy. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: We engage third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks Governance


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Our Chief Executive Officer and Chief Financial Officer are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from the Vice President of Technology and third-party service providers.


text: Our Chief Executive Officer and Chief Financial Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Our Chief Executive Officer and Vice President of Technology provide periodic briefings to the Board of Directors regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third parties.


text: We have processes to assess, identify and manage risks from cybersecurity threats as a part of our overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. We engage certain external advisors to enhance our cybersecurity oversight.

companyName: NOCOPI TECHNOLOGIES INC/MD/

ticker: NNUP


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: Monitor emerging data protection laws in conjunction with our advisors and implement changes to our processes to comply; Maintain firewall and virus protection software; and Maintain a cybersecurity insurance policy.


text: As part of the above processes, we engage with third party providers to review our cybersecurity program and help identify areas for continued focus, improvement, and compliance.


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use. Third-party risks are included within our cybersecurity risk management processes discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.


text: The Audit Committee of our Board of Directors is responsible for oversight of our risk assessment, risk management and cybersecurity risks, and periodically updates our Board of Directors on such matters. Members of the Audit Committee engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position.


text: The Company is not aware of any cybersecurity threats or incidents to date that have materially affected its strategy, results of operations, or financial condition.

companyName: Dolphin Entertainment, Inc.

ticker: DLPN


text: However, the scope and impact of any future cybersecurity incident cannot be predicted with certainty. More information on how material cybersecurity attacks may impact the Company's business is provided in "Item 1A. Risk Factors".


text: The Director of Information Technology is tasked with, among other things, assessing, identifying and managing material cybersecurity risks and overseeing the implementation of the Company's cybersecurity strategy. Furthermore, the Director of Information Technology provides cybersecurity awareness training to the Company's employees and regularly communicates updates on best cybersecurity practices and improvements in the cybersecurity program.


text: The Company may use third-party programs and software and engage assessors, consultants, cybersecurity auditors, or other third parties to review, test, and advise on improvements to the Company's cybersecurity infrastructure.


text: The Audit Committee oversees the Company's risk management and assessment, including its mitigation strategies, and updates the entire Board on the Company's risk profile and exposures on an as needed basis. With respect to cybersecurity, the Company's Director of Information Technology updates the Audit Committee on at least an annual basis on matters such as external cybersecurity threats and attack trends, updates to threat monitoring processes, the composition of the Company's information security team, cybersecurity awareness training and testing, cybersecurity strategy, and cybersecurity metrics, and assesses the progress of cybersecurity programs, and the potential scope and impact of cybersecurity risks and incidents on the Company's operations and financial condition. The Audit Committee may also meet with management on an ad hoc basis to discuss and review any material cybersecurity incidents or threats.


text: Senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks and the creation of appropriate risk management programs and policies to address such risks. Our Director of Information Technology has primary responsibility for managing our cybersecurity program and efforts.


text: We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when an unexpected cybersecurity incident occurs. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. Our internal procedures dictate that we evaluate and evolve our security measures as appropriate. Identifying, assessing, and managing cybersecurity risk is integrated into our overall internal controls approach. Additionally, we have in place cybersecurity and data privacy policies designed to (a) respond to new requirements in global privacy laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K for additional information about cybersecurity-related risks.

companyName: DUOS TECHNOLOGIES GROUP, INC.

ticker: DUOT


text: During the first quarter of 2024, information security matters reporting, including managing and assessing risks from cybersecurity threats, have been established under the oversight of the Audit Committee of the Board or the "Audit Committee." The Audit Committee also reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks. Our security efforts are managed by a team of IT professionals who oversee the daily responsibilities of managing cybersecurity identification and threats. Going forward, the Audit Committee receives regular information security updates from management, including our Chief Technology Officer, who the board designated as the Chief Information Security Officer. The management team has established a quarterly rhythm to keep the Board and Audit Committee apprised of identified risks, ongoing risk management and changes in procedure to ensure transparency in the Company's governance over cybersecurity.


text: Risk Management and Strategy have not yet developed a cybersecurity risk management program, though we are in the process of assessing the potential risks. As of this time, we have determined that risks from cybersecurity threats have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Lifeloc Technologies, Inc

ticker: LCTC


text: Audit Committee of the Board of Directors has oversight responsibility for risks to our company, including incidents related to cybersecurity threats.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and we have integrated these processes into our overall risk management program. We assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Cardio Diagnostics Holdings, Inc.

ticker: CDIO


text: We have adopted as the governance framework for our cybersecurity program the Service Organization Control Type 2 (SOC2) and the Health Insurance Portability and Accountability Act (HIPAA). We use this framework as a guide to help us identify, assess, respond to, and manage cybersecurity risks relevant to our business.


text: The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff, or external experts as part of the Board of Directors' continuing education on topics that impact public companies.

companyName: ZIFF DAVIS, INC.

ticker: ZD


text: Our cybersecurity risk management program includes: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology environment; • skilled information security and data privacy personnel, who support our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • external service providers, where appropriate, to monitor, assess, test, or otherwise assist with aspects of our security controls, and to support risk mitigation efforts; • training for our employees on cybersecurity awareness and the importance of protecting information assets. • periodic reviews of key cybersecurity policies, and updating as needed; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents. • a third-party risk management platform is being used to govern and mitigate the potential risks, including a comprehensive process for service providers, suppliers, and vendors.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and management expects to keep the Board informed of any material cybersecurity threats and expects to provide a report to the Board on a periodic basis and the Board will consider and oversee.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Technology Officer leads a team of information security professionals who have primary responsibility for our overall cybersecurity risk management program and supervises both our internal personnel and our external cybersecurity consultants.


text: Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat briefings from internal personnel and external service providers, as well as alerts and reports produced by security tools deployed in the information technology environment.


text: their new cybersecurity section in Form 10-Ks, companies should confirm compliance with the new line item requirements in Item 106 of Regulation S-K, as summarized below.

companyName: Energy & Water Development Corp

ticker: EAWD


text: the registrant's processes, if any, for assessing, identifying and managing material risks from cybersecurity threats in sufficient detail for a reasonable investor to understand those processes. In providing such disclosure, a registrant should address, as applicable, the following non-exclusive list of disclosure items: Whether and how any such processes have been integrated into the registrant's overall risk management system or processes. Whether the registrant engages assessors, consultants, auditors, or other third parties in connection with any such processes.


text: (iii) Whether the registrant has processes to oversee and" identify such risks from cybersecurity threats associated with its use of any third-party service provider.


text: SEC's purpose in adopting new disclosure items in Item 106(b)(1) was to "allow investors to ascertain a registrant's cybersecurity practices, such as whether they have a risk assessment program in place, with sufficient detail for investors to understand the registrant's cybersecurity risk profile," while at the same time avoiding details that "could increase a company's vulnerability to cyberattack." 15 Cybersecurity Threat Disclosure. Under new Item 106(b)(2), companies must:


text: Describe whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the registrant, including its business strategy, results of operations, or financial condition and if so, how.


text: new requirement in Item 601(b)(2) was proposed in 2022 by the SEC to "equip investors to better comprehend the level of cybersecurity risk the company faces" and "assess the company's preparedness regarding such risk," but also aligns with the SEC's 2018 guidance, which encourages companies to address the impact of any prior cybersecurity incidents in their risk factors. We expect many companies to provide a cross reference to existing risk factor disclosure on this point and to consider, as appropriate, any additional disclosure to address and clarify whether or not any cybersecurity incidents experienced to date have constituted a material cybersecurity incident. As the SEC noted, companies should likewise consider whether they need to revisit or refresh any previous disclosure made about cybersecurity incidents as they prepare this disclosure, including during the process of investigating a cybersecurity incident. 17 Governance Board Disclosure. Under new Item 106(c)(1), companies must: Describe the board of directors' oversight of risks from cybersecurity threats.


text: applicable, identify any board committee or subcommittee responsible for the oversight of risks from cybersecurity threats and describe the processes by which the board or such committee is informed about such risks.


text: this requirement in Item 601(c)(1), although the SEC opted not to adopt a proposal to require disclosure of the frequency of board and committee discussions, the SEC specifically noted in the adopting release that the disclosure may include discussion of frequency, including the board or board committee's reliance on "periodic (e.g., quarterly) presentations by the registrant's chief information security officer to inform its consideration of risks from cybersecurity threats." 18 Notably, the SEC also removed its proposed requirement that companies disclose whether any directors have cybersecurity expertise, noting that "effective cybersecurity processes are designed and administered largely at the management level and that directors with broad-based skills in risk management and strategy often effectively oversee management's efforts without specific subject matter expertise as they do with other sophisticated technical matters." 19 Governance Management Disclosure. Under new Item 106(c)(2), companies must: Describe


text: management's role in assessing and managing the registrant's material risks from cybersecurity threats. In providing such disclosure, a registrant should address, as applicable, the following non-exclusive list of disclosure items: Whether and which management positions or committees are responsible for assessing and managing such risks, and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of the expertise. Relevant expertise may include, for example, prior work experience in cybersecurity; any relevant degrees or certifications; any knowledge, skills or other background in cybersecurity.


text: The processes by which such persons or committees are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: (iii) Whether such persons or committees report information about such risks to the board of directors or a committee or subcommittee of the board of directors.


text: this requirement in Item 106(c)(2), the SEC noted that this list is a "non-exclusive list" that companies should consider when describing management's role in cybersecurity oversight, and that this disclosure would "typically encompass identification of whether a registrant has a chief information security officer [(CISO)] or someone in a comparable position." The detailed information required about the CISO's background (including the CISO's prior work experience, knowledge, skills and degrees or certifications held) is notable in that it goes beyond current disclosure requirements regarding other members of company management.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: VICTORY CLEAN ENERGY, INC.

ticker: VYEY


text: Our cybersecurity risk management program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to the other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology a security team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security procedures;


text: training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors. In the last three fiscal years, the Company has not experienced any material cybersecurity incidents.


text: Cybersecurity Governance The Board regularly receives reports from our executive officers and third parties on cybersecurity matters. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.


text: Management is responsible for developing cybersecurity programs, including as may be required by applicable law or regulation. These individuals' expertise in IT and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience. They are informed by their respective cybersecurity teams and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.


text: Our management team, including the Head of Risk Management and Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: ANVI GLOBAL HOLDINGS, INC.

ticker: ANVI


text: Our Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risk.


text: Risk Management and Strategy have not yet developed a cybersecurity risk management program, though we are in the process of assessing the potential risks. As of this time, we have determined that risks from cybersecurity threats have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: ENCISION INC

ticker: ECIA


text: Board of Directors is responsible for overseeing our enterprise risk management activities. The Board of Directors receives an update on our risk management process and the risk trends related to cybersecurity at least annually. Additionally, on a quarterly basis, the Audit Committee will receive updates from Management on cybersecurity.


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we aim to take a comprehensive approach to cybersecurity risk management. Our Board and our management actively oversee our risk management program, including the management of cybersecurity risks. intend to establish policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We intend to make investments to maintain the security of our data and cybersecurity infrastructure when feasible. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. We do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: GHST World Inc.

ticker: GHST


text: The Company currently manages its cybersecurity risk through a variety of practices that are applicable to all users of our information technology and information assets, including our officers and directors, contractors, and vendors. The Company uses a combination of technology and monitoring to promote security awareness and prevent security incidents, including network and passwords protocols, third party firewalls, and antivirus protections.

companyName: OKMIN RESOURCES, INC.

ticker: OKMN


text: We have not experienced any material cybersecurity incidents or identified any material cybersecurity threats that have affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.


text: Risk Management and Strategy We currently manage our cybersecurity risk through our IT consultants in a variety of practices that are applicable to all users of our information technology and information assets, including our officers, directors, employees, vendors and contractors. Our cyber risk management programs are designed to identify, assess, manage, mitigate, and respond to cybersecurity threats.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: We utilize a combination of technology and active monitoring that are integrated within our enterprise risk management network system to promote security awareness and prevent security incidents that are consistent with recognized standards and practices for information technology and cyber security. Our process for addressing risk aligns with industry standards as outlined in the NIST Cybersecurity Framework and NIST Risk Management Framework.


text: The performance and effectiveness of our cybersecurity program are also tested on a regular schedule by outside consulting third-party experts.


text: Risk Management and Strategy recognize the increasing significance that cybersecurity has to our operations and the success of our business, as well as the need to continually assess cybersecurity risk and evolve our response in the face of a rapidly and ever-changing environment. We process and maintain sensitive data on our Clients and members, including in the form of PHI and PII. In addition, we maintain intellectual property for our solutions and personal information of our employees. Because of the data we manage, we are subject to various cybersecurity threats that, if they materialized, could adversely affect our business, employees, Clients, and members through impacts to the confidentiality, integrity, and/or availability of our systems. We maintain a cybersecurity program and controls as part of our enterprise risk management program in an effort to reduce the risk of exposure of our information and systems.

companyName: MediXall Group, Inc.

ticker: MDXL


text: identify, and manage the risks of cybersecurity threats to our information system, we maintain a cybersecurity program, including policies and controls, which are regularly reviewed through internal and external assessments.


text: controls in place intended to assess our cybersecurity posture and prevent successful access to our critical systems, including, but not limited to: vulnerability scanning on systems and applications; endpoint detection capabilities to identify malware and other indicators of threat activity; multifactor authentication; and blocking of malicious e-mail. In addition, we also provide annual cybersecurity awareness training for our employees. Further, we engage with an external security firm to perform regular penetration testing. We subject our critical third-party service providers to risk assessment prior to engagement, and periodically thereafter, to identify material risks. Additionally, we have a process to engage with these third parties to understand potential impacts of, and remediation efforts associated with, critical vulnerabilities.


text: abreast of the evolving threat landscape, we actively engage with key vendors, industry information sharing, and intelligence and law enforcement communities. These engagements serve as inputs into understanding techniques and tactics being used by threat actors and in expanding the countermeasures we use to protect Teladoc Health.


text: event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have a documented security incident response plan that provides a consistent approach to identifying and classifying the incident as well as a defined escalation process to management to assess the materiality.


text: the efforts outlined above, we cannot ensure that we will not be subject to any cybersecurity incidents or threats. See "Risk Factors Risks Related to Information Technology" for additional information. To date, management has not determined that any cybersecurity incidents the Company has experienced would have resulted in, or are reasonably likely to result in, a material impact to its financial condition, results of operations, or business strategy.


text: risk oversight continues to remain a top priority for our Board. The audit committee of our Board maintains primary responsibility related to overseeing our cybersecurity risk as part of its program of regular risk management oversight. This includes, but is not limited to, the overall maturity and strategy of our cybersecurity program.


text: a rigorous and comprehensive cybersecurity program managed by a dedicated team of subject matter experts and is led by our Information Security Manager ("ISM"), who has extensive cybersecurity experience. We have implemented telehealth industry standard processes, policies, and tools, including regularly scheduled vulnerability scanning and third-party penetration testing to reduce the risk of vulnerabilities in our system.


text: regularly engages with other members of our executive management team to discuss cyber risk, including the Chief Executive Officer, Board of Directors, Executive Committees, among others, as well as the audit committee of our Board. Our executive management team has the appropriate expertise, background, and depth of experience to manage risk arising from cybersecurity threats. Executive management has also participated in cybersecurity tabletop exercises to test our cyber response playbooks.


text: risk management is an essential part of our overall risk management strategy. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.


text: periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: these risk assessments, we redesign, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our Vice President of Technology who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. All personnel are made aware of our cybersecurity policies through training.


text: third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity Governance One of


text: the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Executive Officer and Chief Financial Officer are primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from the Vice President of Technology and third-party service providers.


text: Executive Officer and Chief Financial Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Executive Officer and Vice President of Technology provide periodic briefings to the Board of Directors regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third parties.


text: Risk Management and Strategy Management has established policies and processes to identify, analyze, mitigate, and manage cybersecurity risks relevant to our platform, and has integrated these processes into the Company's overall risk management processes. Various types of risks are considered, including, but not limited to, fraud, technological, compliance, and vendor risks. Our program for assessing, identifying, and managing material risks from cybersecurity threats includes the following key controls:

companyName: Vynleads, Inc.

ticker: VYND


text: To protect our systems and applications, we maintain endpoint security protection on all employee laptops and desktops, including industry-standard firewalls, monitoring, and intrusion detection practices. We require multi-factor authentication to access our critical systems and applications.


text: We employ strong password standards for our systems and applications. We also employ firewalls across our infrastructure to guard against threats. We provide ongoing security training to our employees and contractors about information security policies and practices, including phishing simulations.


text: Our process for managing third-party risk includes security assessments of key third-party service providers before entering into or renewing business with them or granting them access to our data or information systems. Additionally, we impose contractual restrictions on these providers based on their risk profile.


text: We maintain enterprise-wide policies and procedures for reporting and managing security incidents, including prompt reporting of all incidents. We perform incident response simulations on at least an annual basis.


text: Management is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer. The Board is then briefed upon the occurrence of any cybersecurity incidents and is provided an overview of the information security program on an annual basis, including updates on the IT team, IT training, implementation of IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.

companyName: ProtoKinetix, Inc.

ticker: PKTX


text: As of the date of this report, we have not experienced any cybersecurity incidents that have materially affected us, including our business strategy, results of operations, or financial condition. For certain risks from cybersecurity threats that may materially affect our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors," including the section titled, "If our security measures or information we collect and maintain are compromised or publicly exposed, customers may curtail or stop using our service, and we could be subject to claims, penalties, and fines.


text: Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officer is responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole.


text: We have processes to assess, identify and manage risks from cybersecurity threats as a part of our overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. We engage certain external advisors to enhance our cybersecurity oversight.


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: Monitor emerging data protection laws in conjunction with our advisors and implement changes to our processes to comply; Maintain firewall and virus protection software; and Maintain a cybersecurity insurance policy.


text: As part of the above processes, we engage with third party providers to review our cybersecurity program and help identify areas for continued focus, improvement, and compliance.


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in the normal course of business use. Third-party risks are included within our cybersecurity risk management processes discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.


text: The Audit Committee of our Board of Directors is responsible for oversight of our risk assessment, risk management and cybersecurity risks, and periodically updates our Board of Directors on such matters. Members of the Audit Committee engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position.


text: The Company is not aware of any cybersecurity threats or incidents to date that have materially affected its strategy, results of operations, or financial condition.


text: However, the scope and impact of any future cybersecurity incident cannot be predicted with certainty. More information on how material cybersecurity attacks may impact the Company's business is provided in "Item 1A. Risk Factors".


text: We maintain comprehensive policies and procedures designed to prevent and mitigate the risks posed by cybersecurity threats and incidents and to identify, analyze, address, mitigate and remediate those incidents that do occur.


text: The Company has established clear lines of communication with key stakeholders, including executives, IT teams, employees, and customers, to ensure transparency and an effective response to cybersecurity incidents.


text: The Director of Information Technology is tasked with, among other things, assessing, identifying and managing material cybersecurity risks and overseeing the implementation of the Company's cybersecurity strategy. Furthermore, the Director of Information Technology provides cybersecurity awareness training to the Company's employees and regularly communicates updates on best cybersecurity practices and improvements in the cybersecurity program.


text: The Company may use third-party programs and software and engage assessors, consultants, cybersecurity auditors, or other third parties to review, test, and advise on improvements to the Company's cybersecurity infrastructure.


text: In the last fiscal year, we have not identified any risks from known cybersecurity threats that have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."


text: The Audit Committee oversees the Company's risk management and assessment, including its mitigation strategies, and updates the entire Board on the Company's risk profile and exposures on an as needed basis. With respect to cybersecurity, the Company's Director of Information Technology updates the Audit Committee on at least an annual basis on matters such as external cybersecurity threats and attack trends, updates to threat monitoring processes, the composition of the Company's information security team, cybersecurity awareness training and testing, cybersecurity strategy, and cybersecurity metrics, and assesses the progress of cybersecurity programs, and the potential scope and impact of cybersecurity risks and incidents on the Company's operations and financial condition. The Audit Committee may also meet with management on an ad hoc basis to discuss and review any material cybersecurity incidents or threats.


text: Senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks and the creation of appropriate risk management programs and policies to address such risks. Our Director of Information Technology has primary responsibility for managing our cybersecurity program and efforts.


text: We periodically assess risks from cybersecurity threats, and monitor our information systems for potential vulnerabilities. However, to date, given the small size of our company and the nature of our operations, our reliance on information systems has been limited to the use of standard off-the-shelf software (such as Google, QuickBooks and Microsoft Office) and the use by our employees of standard personal computers. Accordingly, management has not implemented any formal process for assessing, identifying, and managing risks from cybersecurity threats.

companyName: WEWARDS, INC.

ticker: WEWA


text: Risks from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition. We discuss how cybersecurity incidents could materially affect us in our risk factor disclosures in Item 1A of this Annual Report on Form 10-K.


text: As discussed above, given the nature of our current operations and our experience to date, we do not currently perceive cybersecurity as a particularly significant risk to our business. Accordingly, we have not tasked our Board of Directors with any additional cybersecurity oversight duties, or designated any committee of the Board of Directors to specifically oversee cybersecurity risks to our business.


text: Cybersecurity Risk Management and Strategy We rely on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software for threat protection and malware. Such third party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate. Based on the results of our risk assessments, if deemed necessary or appropriate, we take steps to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.


text: We intend to work with outside counsel and third party service providers to further develop our expertise, processes and procedures with respect to cybersecurity protection and our response plan.


text: To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially affected our business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Audit Committee of our Board of Directors is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Members of management provide periodic briefings to the Audit Committee of our Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure.


text: Risk Management and Strategy The Company's information security program consists of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, sensitive data management, electronic communication, risk/security reporting, incident response planning and business continuation planning. Our Information Security Team is comprised of our Chief Financial Officer and third-party IT support. It is responsible for (i) administering the Company's policies and procedures in conjunction with our third-party information technology provider, Netranom Communications ("IT Provider"); (ii) distributing our policies to consultants and providing training; (iii) responding to consultant inquiries regarding our policies; (iv) overseeing our cybersecurity program and leading incident response efforts; (v) monitoring for cybersecurity-related legal or regulatory developments; coordinating with management, our IT Provider and /or legal counsel to discuss cybersecurity-related issues or topics; and (vi) reviewing and updating our policies as necessary and on an annual basis.


text: We periodically assess risks from cybersecurity threats and monitor our information systems for potential vulnerabilities. However, to date, due to the small size of our company and the nature of our operations, our reliance on information systems has been limited to standard off-the-shelf software (such as Google, QuickBooks, and Microsoft Office) and standard personal computers used by our employees. As a result, management has not implemented any formal process for assessing, identifying, and managing risks from cybersecurity threats.

companyName: Certiplex Corp


text: Risks from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition. We discuss how cybersecurity Governance


text: Risk Management and Strategy We periodically assess risks from cybersecurity threats, and monitor our information systems for potential vulnerabilities. However, to date, given the small size of our company and the nature of our operations, our reliance on information systems has been limited to the use of standard off-the-shelf software (such as Google, QuickBooks and Microsoft Office) and the use by our employees of standard personal computers. Accordingly, management has not implemented any formal process for assessing, identifying, and managing risks from cybersecurity threats.

companyName: Tradewinds Universal

ticker: TRWD


text: Risks from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition.


text: As discussed above, given the nature of our current operations and our experience to date, we do not currently perceive cybersecurity as a particularly significant risk to our business.


text: Accordingly, we have not tasked our Board of Directors with any additional cybersecurity oversight duties, or designated any committee of the Board of Directors to specifically oversee cybersecurity risks to our business.