text: The Company's cybersecurity program fundamentally aligns with the COBIT framework. This is reflected in our related policies, practices and procedures. We have multiple layers of security controls as well as a third-party SOC that helps identify, avoid and mitigate cybersecurity threats. The evaluation of risks includes consideration of cybersecurity and privacy risk, including (1) potential impact on the Company's employees, customers, and other stakeholders, (2) intelligence briefings on notable cyber events impacting the industry and (3) evaluation of external threats. The Company utilizes internal and third-party assessment tools and tests to evaluate its cyber risk policies, practices and procedures as well as to challenge how its defenses are built and deployed. These assessments provide opportunities for critical self-analysis, constructive feedback from third parties, and learnings from industry experts to enhance cyber resilience. Both formal and informal cybersecurity awareness trainings are provided to employees to help identify and avoid cybersecurity threats and to ensure employees understand the Company's cyber risk management policies along with the key role they play to ensure cyber hygiene. The Company has established a cybersecurity incident response team that includes the CEO, CFO, VP of HR, IT Director and other personnel. The Company has also retained counsel to advise on cybersecurity matters.


text: The Company's current security posture and regulatory compliance efforts are intended to address evolving and changing cyber threats. During the past three years, the Company has not experienced a cybersecurity incident resulting in a material impact to its business strategy, results of operations, or financial condition. The Company has identified the risk that a hostile cyber intrusion could severely impair the Company's operations, lead to disclosure of confidential information, damage the Company's reputation or otherwise have an adverse effect on the Companies' business as disclosed within Item 1A. Risk Factors.

companyName: RGC RESOURCES INC

ticker: RGCO

secItem: Item 1C

stage1Category: Strategy Integration

stage1Method: unanimous


text: The Company's Board of Directors, including its Audit Committee, provides oversight of the Company's risks from cybersecurity threats. Management, including the CEO, CFO and IT personnel, presents formal reports to the Audit Committee and to the full board at least annually, as well as whenever cyber events warrant update.

stage1Category: Board Governance


text: We have policies and procedures for identifying, assessing, and managing material risks associated with cybersecurity threats. We seek to address cybersecurity risks through a comprehensive approach focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We implement and maintain technical and physical safeguards and other organizational measures, including, for example, the use of antivirus software, intrusion prevention and detection systems, virtual private networks, firewalls, email security, link protection, the regular deployment of updates and patches as they become available, a general policy against providing access to our network to any third party (with the exception of our third party information technology vendor), the use of a third party service to conduct mandatory online training for all employees regarding identifying and mitigating cybersecurity risks, regular phishing testing, regular penetration testing, regular reviews of access to systems and networks, and routine monitoring of compliance with our written information security plan. We also maintain cybersecurity insurance that provides for certain protection against potential losses arising from a cybersecurity incident.

companyName: HENNESSY ADVISORS INC

ticker: HNNA

stage1Category: Risk Management Process


text: We have an Information Technology committee that meets at least quarterly and includes members of our management team and compliance team. The members of the Information Technology committee have gained cybersecurity experience through years of training, internal and external discussions, and the development, implementation, and periodic evaluation of our cybersecurity policies.

stage1Method: majority


text: We have not experienced a material cybersecurity incident, any expenses we have incurred from cybersecurity breaches have been immaterial, and we are not aware of any cybersecurity incidents that are reasonably likely to materially affect our business. Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents. However, future incidents could have a material and adverse impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see Item 1A, "Risk Factors."


text: Our Board of Directors oversees cybersecurity risk management as part of its general oversight function. The Company's management team provides updates to the Board of Directors regarding cybersecurity as appropriate.


text: Risk Management and Strategy We rely on computer systems and information technology to conduct our business, including to securely transmit data associated with cashless payments. These systems and technology are increasingly complex and vital to our operations, which has resulted in an expansion of our technological presence and corresponding risk exposure. In addition, these systems are inherently vulnerable to disruption or failure, as well as internal and external security breaches, denial of service attacks and other disruptive problems caused by cybersecurity threat actors. We have not experienced any cybersecurity incidents that have materially impacted or are likely to materially impact our business strategy, results of operations or financial condition based on information known to us as of the date of this report. Under the oversight of our Board, our management has developed a cybersecurity risk management program based on the Center for Internet Security Critical Security Controls framework that is integrated with our overall risk management program and is designed to assess, identify, manage and mitigate material cybersecurity risks. Our cybersecurity program includes policies and procedures that govern how security measures and controls are implemented and maintained. We identify and implement security controls to address cybersecurity risks based on an annual risk assessment and our evaluation of relevant factors, including the likelihood of risk, the potential impact and severity of the risk, the feasibility and expense of potential controls, and the impact of controls on our operations. Our cybersecurity program includes regular security assessments and testing, regular employee trainings, third-party security audits, and solutions designed to detect and mitigate cybersecurity threats, including data breaches, malware, ransomware and phishing attacks.

companyName: Natural Grocers by Vitamin Cottage, Inc.

ticker: NGVC


text: Cybersecurity Governance Our Vice President of Information Technology (our VP of IT) has primary responsibility for monitoring, assessing and managing our material risks from cybersecurity threats. He oversees a dedicated information technology team that is responsible for managing enterprise-wide information security strategy, policy, standards, architecture and processes, and is regularly informed of, and monitors, the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. Our VP of IT has over 25 years of information technology experience, has earned a graduate degree in Cybersecurity and Information Assurance, and maintains relevant industry designations including Certified Information Systems Security Professional and Certified Information Security Manager certifications.

stage1Category: Management Role


text: Our Board considers cybersecurity risk as a part of its overall risk oversight function. Our Board receives reports from our VP of IT at least bi-annually, and on an as-needed basis, on cybersecurity risks and actions taken to mitigate those risks. These reports include updates on our cybersecurity risks and the emerging threat environment, and the status of projects designed to enhance our information security systems and programs.


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to materially protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes policies and processes for assessing, identifying, and managing risk from cybersecurity threats as well as a cybersecurity incident response plan. Our cybersecurity risk management program is integrated into our overall risk management system and processes, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other strategic, operational, legal, compliance, and financial risk areas.

companyName: VERU INC.

ticker: VERU


text: Our cybersecurity policies and procedures are designed to ensure that appropriate cybersecurity measures and controls are developed, implemented, and maintained, with assistance from a third-party service provider. These policies and procedures and the resulting safeguards are designed and evaluated in light of our risk assessments. We have implemented access controls, firewalls, and intrusion detection and prevention systems, vulnerability and patch management processes, and we also use a variety of other automated tools and manual processes to safeguard our information systems. We maintain a business continuity and disaster recovery plan designed to enhance our incident response preparedness. We also require employees to undergo security awareness training when hired and based on periodic phishing tests.


text: As of the date of this Annual Report on Form 10-K, we have not identified risks from known cybersecurity threats, including or as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information regarding risks to us from cybersecurity threats, see "Risk Factors" in Item 1A. of this report.


text: One of the key functions of our board of directors is risk oversight, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly and through the audit committee.


text: Our Chief Financial Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from a third-party service provider. Our Chief Financial Officer supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include quarterly briefings from our third-party service provider and alerts and reports produced by security tools deployed in the IT environment. Our Chief Financial Officer has over 10 years of experience in overseeing our cybersecurity and information technology programs. We also rely on our third-party service provider for advice and expertise on monitoring evolving industry standards and best practices.


text: Our Chief Financial Officer provides periodic briefings to the board of directors regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cyber security systems testing, and activities of third parties.


text: We have developed and continue to invest in a variety of solutions and controls for real-time threat prevention, detection and instantaneous, automated reaction to such cyberattacks. Our overall strategy in combatting known cybersecurity risks includes:

companyName: OPTICAL CABLE CORP

ticker: OCC


text: The use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect intrusions such as identity attacks. Engagement of a provider for real-time threat detection, alerting and immediate, automated remediation service for the entire organization.


text: The use of multi-factor authentication for all remote users when they connect to the corporate network and the corporate email platform.


text: The deployment of updates and patches as they are available for all installed versions of enterprise software to reduce the exposure to vulnerabilities.


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our IT department and our management actively oversee our risk management program, including the management of cybersecurity risks. We have contracted with cybersecurity and risk assessment experts to help test our systems and guide the ongoing development of best practices policies. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that our company's sustained investment in these efforts and technologies have put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition. Risk management and strategy.

companyName: cbdMD, Inc.

ticker: YCBD


text: Network and endpoint protection: Utilizing firewalls, intrusion detection systems, antivirus software, and advanced encryption protocols to safeguard sensitive data and systems. Multi-factor authentication, security and principle of least privileged (PoLP)


text: Employee training and awareness programs: Educating employees on cybersecurity best practices and conducting phishing simulations to promote vigilance against social engineering attacks.


text: Incident detection and response plans: Maintaining real-time monitoring and implementing a structured incident response plan that allows us to quickly detect, respond to, and recover from cyber incidents.


text: Third-party risk management: Vetting the cybersecurity controls of vendors and partners to ensure that their practices align with our standards for protecting sensitive information.

stage1Category: Third-Party Risk


text: While we have not experienced a cybersecurity incident that has had a material impact to date, the threat of potential incidents remains high. We continually evaluate our exposure to risks such as: Operational disruption from ransomware or other cyberattacks. Data breaches that could compromise customer or proprietary information. Regulatory and legal exposure arising from cybersecurity failures.

stage1Category: None/Other


text: As part of our risk management framework, we regularly assess whether any cybersecurity incidents, or the likelihood of such incidents, could materially affect our business. We are also committed to continuous improvements to address emerging threats. Governance.


text: Our board of directors plays an active role in overseeing the company's approach to managing cybersecurity risks. The board receives regular updates from senior management regarding the company's cybersecurity strategy, potential risks, and any incidents that may arise. These updates ensure that the board remains informed and able to provide guidance on cybersecurity matters.


text: The board is also regularly briefed by management on the Company's cybersecurity policies, risk assessments, and mitigation strategies. This reporting structure allows the board to remain engaged with the company's efforts to address and manage evolving cyber threats, ensuring that cybersecurity is aligned with our overall risk management framework.


text: Management, led by the IT department, plays a critical role in assessing and managing material risks related to cybersecurity. This includes implementing day-to-day cybersecurity measures, conducting regular risk assessments, and ensuring the timely response to any cyber threats or incidents. The IT department is responsible for ensuring that cybersecurity is integrated into our company's broader risk management strategy, with direct reporting lines to both senior executives and the board of directors.


text: The Company is subject to attempted cyberattacks and other cybersecurity risks. Our business relies on various information technology and application systems that may be impacted by a malicious cyberattack. Such cyber incidents may cause lost revenues or increased expenses stemming from inability to use certain systems for a period of time, loss of financial assets, fines related to breach of personally identifiable information or other protected information, reputational damage and remediation and litigation costs as well as increased cybersecurity protection costs.


text: We regularly evaluate cybersecurity risks from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors. Such risks are monitored and reviewed by management on a periodic basis as deemed appropriate.


text: The review of the security procedures and controls used by third parties that may host or otherwise have access to the Company's data. If necessary, the use of third-party security experts if and when an incident is detected.


text: Regardless of the controls we have in place, cybersecurity risks continue to become more complex and pervasive, and our internal controls cannot provide absolute assurance that we will be able to protect ourselves from significant cyberattack incidents. Additionally, by outsourcing certain administrative functions to third parties, we may be exposed to risk of data security breaches against those third parties.


text: We are not aware of any existing cybersecurity threats that would materially affect, or that are reasonably likely to materially affect, our business strategy, results of operations, liquidity or financial conditions. Furthermore, we are not aware of having experienced any significant cybersecurity incidents during fiscal year 2024. Management periodically updates the Board of Directors regarding efforts to minimize cybersecurity risks.


text: At Track Group, Inc., we recognize the critical importance of maintaining the trust and confidence of our customers, partners, and employees. We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader risk management system and processes. The cybersecurity risk management system involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from consultants, cybersecurity assessors, auditors and other third parties to gather certain insights designed to identify and assess material cybersecurity threat risks, their severity and potential mitigations. To protect the information that we gather and the availability of our information systems from cybersecurity threats, we have an ongoing cybersecurity risk mitigation program, which includes maintaining up-to-date detection, prevention and monitoring systems. We define a cybersecurity threat as any potential unauthorized occurrence on or conducted through our information systems or information systems of a third party that we utilize in our business that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.

companyName: Track Group, Inc.

ticker: TRCK


text: We depend on and engage various third parties, including suppliers, vendors, and service providers. Our risk management, legal, information technology, and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such entities. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and then reported to the Board of Directors.


text: We comply with the AICPA Trust Services Criteria for Security and have based our Information Security Management System on the ISO 27001 standard.


text: Track Group's Chief Information Security Officer, Tim Hardy, has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and report any findings and recommendations, as appropriate, to the full Board of Directors for consideration.


text: Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Board of Directors.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. Further, a cyber incident impacting our systems or a third-party's systems could subject us to business, regulatory, litigation and reputational risk, which could have a negative effect on our business, results of operations and financial condition. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report.


text: Risk Management and Strategy Our cybersecurity and risk management program is intended to protect the confidentiality, integrity, and availability of our critical information systems and the data resident on them. We have designed our IT systems and processes with the intention that our solutions should defend against the ever-evolving threat landscape while remaining agile to keep up with such threats. We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to safeguard our information assets and operations from internal and external cyber threats, including protecting employee information from unauthorized access to or attacks on our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: Bridgeline Digital, Inc.

ticker: BLIN


text: Employee Training and Awareness: The Company provides regular cybersecurity training for employees to enhance awareness of common threats, such as phishing and ransomware. All Journal Technologies employees undergo annual CJIS training and certification.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Avidity Biosciences, Inc.

ticker: RNAM


text: In an effort to deter and detect cyber threats, we periodically provide training programs to our employees on issues related to privacy and data protection, cybersecurity risks, and the importance of reporting all incidents immediately. Topics include identifying phishing, password protection, securing confidential data, and mobile security. In addition, we use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We also perform annual vulnerability assessments, conducted by independent, third-party cybersecurity firms. Additionally, as part of our overall risk mitigation strategy, the Company obtains certain insurance policies. However, such insurance may not be sufficient in type or amount to cover us fully against claims related to security breaches, cyber-attacks and other related breaches.


text: An incident response plan has been established which provides detailed information on actions to take in the event of an incident. The incident response plan includes the scope of the plan, establishes the incident response team, details the incident response lifecycle, and provides templates to make the process easier to document and follow. Timelines, communication methods, and notification information are included in the plan to ensure the process can be followed in high pressure situations which can occur during incidents.


text: The Audit Committee of our Board of Directors provides direct cybersecurity risk oversight. Our management provides timely disclosure and related updates to the Audit Committee regarding potential cybersecurity threats, incidents and general risks.


text: Our management periodically evaluates information on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we have not had any cybersecurity incidents in 2024, and through the date of filing of this Form 10-K.


text: While prior incidents have not had a material impact on us, future incidents could have a material adverse effect on our business, results of operations and cash flows. For additional information about our cybersecurity risks, see Item 1A — Risk Factors on this Annual Report on Form 10-K.


text: The Company is committed to safeguarding its information systems and data against evolving cybersecurity threats. With operations spanning traditional publishing and the technology-driven Journal Technologies segment, the Company prioritizes robust cybersecurity measures to protect its operations, customers, and stakeholders. The Company employs a comprehensive cybersecurity risk management framework to identify, assess, and address risks that could impact business operations, sensitive client data, and the Company's portfolio of marketable securities. This framework incorporates: Technology Solutions: Prioritizing the security of Journal Technologies' court and justice software systems, which manage critical data and workflows. Traditional Business: Protecting the systems and data supporting the Company's publishing and printing operations. Financial Portfolio: Securing systems and processes related to the management of the Company's substantial marketable securities portfolio.


text: Governance and Oversight The Company's Board of Directors as a whole supervises the Company's cybersecurity strategy and regularly reviews cybersecurity risks, incident reports, and risk mitigation initiatives.


text: Journal Technologies has a Chief Information Security Office (CISO) made up of internal cybersecurity practitioners who evaluate, identify, and mitigate significant risks posed by cybersecurity threats, with a focus on safeguarding the Company's technology, data, and intellectual property.


text: In August 2024, Journal Technologies hired a Director of Security Operations to lead the CISO team. With extensive IT leadership experience and a Certified Information Systems Security Professional (CISSP) credential, the Director oversees security strategies, incident response plans, and risk assessments. Reporting directly to senior management, the Director works closely with internal teams and external experts to align Journal Technologies' practices with industry standards.


text: The Company has also established a dedicated Cybersecurity Working Group, with members from both the Traditional Business and Journal Technologies, to collaborate on threat intelligence, incident response strategies, policy alignment, and security technology advancements. This partnership ensures both entities remain proactive in addressing evolving threats and benefit from shared expertise to implement coordinated security measures. The Company's senior management works closely with the CISO and the Cybersecurity Working Group to identify matters requiring the attention of the Board of Directors.


text: Threat Detection and Response: The Company employs enterprise security systems as the backbone of a defense in depth (DiD) strategy, such as patch management, intrusion detection, and network segmentation. A managed detection and response (MDR) solution from a world-class security company unifies our antivirus/malware (NGAV), endpoint detection and response (EDR), cyber threat intelligence, managed threat hunting capabilities, and security hygiene.


text: Third-Party Risk Management: The Company evaluates third-party vendors prior to onboarding to ensure they have industry standard best practices in place and, when applicable, verified by an external audit firm. The Company monitors third-party providers for breaches or other cybersecurity events and annually review each vendor's SOC 2 audit reports.


text: Incident Response Planning: The Company maintains a formalized incident response (IR) plan to address and remediate cybersecurity incidents. The plan defines roles and responsibilities and includes runbooks for likely scenarios. The Company performs testing of the IR plan at least annually with the results reported to senior management.


text: Certifications: Several of the Company's security personnel on the CISO team have and maintain CISSP, GCIH (GIAC Certified Incident Handler) and OSCP (Offensive Security Certified Professional) certifications.


text: Business Continuity: The Traditional Business and Journal Technologies have each implemented a Business Continuity Plan and Disaster Recovery (BCP/DR) with procedures aimed at minimizing downtime and facilitating recovery of both internal and customer assets in the event of a service disruption. The plan includes clearly defined roles, step-by-step recovery processes, and prioritized action plans to address various scenarios, such as natural disasters, cyber incidents, and hardware failures. We regularly test and update our BCP/DRs.


text: Enforcing multi-factor authentication (MFA) for all systems Deploying anti-phishing solutions to detect and block suspicious emails Using single sign-on (SSO) solutions integrated with secure identity providers Simulating phishing attacks to measure awareness and improve training programs Implementing Security Information and Event Management (SIEM) systems for continuous monitoring and logging.


text: Incident Reporting and Disclosure The Company adheres to strict protocols for evaluating and reporting cybersecurity incidents. Any incidents determined to have a material impact—assessed based on financial, operational, or reputational factors—are raised with the Board of Directors and, if necessary, disclosed in accordance with regulatory requirements.


text: Risk management and strategy We rely on our technology network infrastructure and information systems to operate our business, interact with vendors and customers, and collect and make payments, among other functions. Our internally developed infrastructure and systems, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats and incidents, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity or availability of such systems or related information.

companyName: Concrete Pumping Holdings, Inc.

ticker: BBCP


text: Such attacks have become more sophisticated over time, especially as threat actors have become increasingly well-funded by or themselves include governmental actors with significant means. We expect that the sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies. The Company experiences cyber threats in the normal course of its business, and computer viruses, hackers, employee misconduct and other external hazards could expose our information systems to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business. Refer to Item 1A. Risk Factors, for additional details on cybersecurity risks that could potentially materially affect the Company.


text: We manage our risks from cybersecurity threats through our overall enterprise risk management process, which is overseen by the Board. Our cybersecurity risks are considered individually as part of our enterprise risk management process alongside other risks, and priorities and discussed with our Board. The Company seeks to prioritize the management of cybersecurity risk and the protection of confidential information and systems, and the Company's program and processes are based on industry standards as guided by the National Institute of Standards and Technology ("NIST") framework. Under the supervision of the Chief Financial Officer ("CFO") and our Director of IT, we regularly work to identify all computing assets including hardware, software, and network infrastructure in order to conduct a risk assessment. We consider threats that may originate from both internal and external sources and maintain technical security controls internally. To identify risks, we complete vulnerability assessments on a recurring basis to help proactively identify potential weaknesses. We additionally engage a third-party vendor to conduct external and internal penetration testing on a periodic basis in order to assist in identifying additional vulnerabilities in our environment. We also perform business continuity planning and disaster recovery exercises throughout the organization annually by our in-house team.


text: We have developed incident response plans by using the information gained through testing and monitoring to manage any identified vulnerabilities and further improve our cybersecurity preparedness and response infrastructure. Such plans set forth the actions to be taken in responding to and recovering from cybersecurity incidents, which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. We also regularly perform phishing tests of our employees and provide annual privacy and security training for all employees. Our security training incorporates awareness of cyber threats including but not limited to malware, ransomware, and social engineering attacks, password hygiene and incident reporting processes.

companyName: R F INDUSTRIES LTD

ticker: RFIL


text: In connection with our overall cybersecurity risk management processes, we receive recurring threat intelligence from our partners that help us recognize the updated tactics, techniques, and procedures being utilized by threat actors. Employees at the Company receive mandatory recurring cybersecurity training and phishing exercises to reduce the likelihood of success by threat actors. We also engage a third-party service provider to provide monitoring and detection of our cybersecurity environment, which allows us to timely respond to cybersecurity events with the goal of reducing its potential impact. The Company performs an IT security assessment of critical third-party vendors prior to establishing a formal relationship and has additional processes in place to continue to oversee and identify risks associated with the use of our third-party service providers once a formal relationship is established. We additionally have a cybersecurity incident response plan ("CIRP") that outlines the appropriate procedures, communication flow and response for potential cybersecurity incidents as well as categorizations of scope, incident and impact of such incidents.


text: The Company's Director of IT reports to our CFO and leads the Information Technology team (collectively "the IT Security Team"). The IT Security Team is responsible for the strategic oversight of cybersecurity risk management and strategy including the identification and assessment of cybersecurity threats and incidents. Periodically, they are also responsible, alongside the CFO and senior management, to keep the Audit Committee of the Board of Directors informed and briefed with respect to cybersecurity risks and incidents. Our Director of IT has extensive experience of over 15 years in various IT roles across a range of cyber technologies, processes and strategies and is supported by the IT Security Team and the wider IT team, including the IT Security Manager, to support the Company's cyber risk management processes, including the prevention, detection and mitigation of cybersecurity threats and incidents, and any required response to and remediation of such cybersecurity threats or incidents.


text: The Audit Committee is responsible for providing governance and oversight over the Company's operational cybersecurity program, risk management and incident response on behalf of the Board. The CFO reports the results of risk assessments, including the evaluation of cybersecurity risks, the actions that the Company has taken to mitigate these risks and an analysis of cybersecurity threats and incidents across the industry to the Audit Committee. This includes assessing the measures and controls in place to mitigate cybersecurity risks and providing oversight of the response of any significant cybersecurity threats and incidents.


text: We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats. Our policies, standards and procedures for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management system. In this regard, we use various tools and processes to help prevent, identify, and resolve any identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting and routine employee awareness updates.

companyName: AmeriCann, Inc.


text: Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including monitoring systems and employee engagement.


text: Our board of directors is responsible for oversight over its risk management system, including review and approval of the risk management system and processes implemented by management to identify, assess, manage and mitigate cybersecurity risks. The Board is responsible for monitoring and assessing material risk exposure to cybersecurity risks, and our management is responsible for the day-to-day supervision of the material risks we may face.


text: Our risks from cybersecurity threats have not affected or are reasonably not likely to materially affect our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy The Company has adopted policies and implemented certain controls and procedures that allow its management to assess, identify and manage material risks from cybersecurity threats and for its Board of Directors, through its Audit Committee, to actively oversee the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework.


text: The Company's processes are integrated into its overall enterprise risk management program and compliments the Company's enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Company's Board of Directors through its Audit Committee. The Company has in the past, and may continue to do so in the future, engage third-party consultants, to review and assess the Company's information technology and security.


text: The Company seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: To identify and assess material risks from cybersecurity threats, we follow best practices in routine network and endpoint auditing, vulnerability assessments, penetration testing, and other forms of security auditing. We continuously monitor endpoint activity and network traffic for unusual or prohibited behavior to prevent, identify, and contain malicious actions.


text: We review our cybersecurity risk framework and related policies annually with senior management to help identify areas for continued focus and improvement. We also engage third party experts to review and assess our processes to ensure they are robust and consistent with the current security landscape. The data center where we host our critical data is SOC II complaint.


text: The Company has also implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of third-party service providers, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data by discussing issues to be addressed and recommending securities measures to be improved where possible.


text: Although in the periods reported we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents, including penalties and settlements, were immaterial, we may experience such incidents in the future and the scope and impact of any such future incidents cannot be predicted. To prepare for any such event, we have a full Disaster Recovery plan in place that is tested annually to ensure resilience against a myriad of threats.


text: Role of the Board of Directors and the Audit Committee As part of the Board of Directors' role in overseeing the Company's enterprise risk management program, which includes our cybersecurity risk management framework, the Board is responsible for exercising oversight of management's identification and management of, and planning for, material cybersecurity risks that may reasonably be expected to impact the Company. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee is responsible for overseeing the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework, taking into account the Company's risk exposures and progress of its risk management processes. The Audit Committee is informed of the Company's cybersecurity risk management and receives an overview of its cybersecurity program from management at least quarterly, which covers topics including, among others, recent cybersecurity risk landscape and trends, data security posture, results from third-party assessments, training and vulnerability testing, our incident response plan, material cybersecurity risks, whether developing or actual, as well as the steps management has taken to respond to such risks, emerging cybersecurity regulations, technologies and best practices. Material cybersecurity risks are also discussed during separate Board meetings as part of the Board's risk oversight generally.


text: Role of Management Our Chief Financial Officer is responsible for management's oversight of cybersecurity governance, decision-making, risk management, awareness, and compliance across the Company. Our Chief Financial Officer works to employ a cybersecurity program designed to protect the Company's information systems from cybersecurity threats and to respond to incidents in accordance with the Company's incident response plan and other policies and procedures.


text: In the event of a material cybersecurity incident or investigation, management will, in compliance with escalation protocols in place, promptly report to the Audit Committee and the Board, as appropriate, in accordance with the Company's incident response plan, and other policies and determine the timing of action, and necessary response.


text: The Company places a high priority on safeguarding its data, systems, and infrastructure from cybersecurity threats. To manage this critical aspect of operations, the Company partners with a third-party IT provider that specializes in cybersecurity services. Established in 1997, this provider brings over two decades of expertise in managing and mitigating cyber risks, including network security, vulnerability assessments, and incident response planning. The provider's comprehensive approach ensures the protection of the Company's sensitive information and critical systems, while also adhering to industry best practices and regulatory requirements. By leveraging the expertise of its third-party IT provider, the Company is able to implement robust cybersecurity measures that support operational continuity and reduce exposure to potential security incidents.


text: Cybersecurity protection and data privacy are important to maintaining our proprietary information and the trust of our customers, suppliers and employees, and we recognize the importance of working to secure our data and information systems from potential cybersecurity and data privacy incidents. We are a large global manufacturer with sites around the world, and we identify and assess our cybersecurity risk through that lens. Securing the execution and control of our manufacturing operations, to the extent implemented through digital technology, is a primary area of focus. We also face risks encountered by substantially all large global companies such as the risks of intellectual property and information being compromised, fraud and violation of privacy or security laws.

companyName: FULLER H B CO

ticker: FUL


text: Our cybersecurity risk is managed as part of our broader enterprise risk management program. Specifically, a risk management workstream focused on our information technology function (including cybersecurity) is designed to assess, identify and manage cybersecurity-related risks and mitigation measures. Our cybersecurity risk program also includes a documented incident response plan to be used in the event of a cybersecurity incident. The incident response plan provides for certain responses based on various factors of a cybersecurity incident.


text: Board considers cybersecurity risks as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.

companyName: Webstar Technology Group Inc.

ticker: WBSR


text: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents, including those from third-party service providers who have access to our systems, data or are critical to our continued business operations. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to senior management and, if warranted, to our audit committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: While some of our third-party service providers have experienced cybersecurity incidents and have experienced threats to their data and systems, as of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected our business strategy, results of operations, or financial condition. This does not guarantee that future incidents or threats will not have a material impact by interrupting operations, causing reputational harm, increasing operating costs, or exposing the Company to litigation. For additional commentary on cybersecurity risks, see Part 1, Item 1A. Risk Factors.


text: Governance and Management's Responsibilities Our Board of Directors views the identification and effective management of cybersecurity threats as a critical component of overall risk management and oversight responsibilities, and has delegated responsibility for oversight of this risk to the audit committee. The audit committee oversees the management of risks arising from cybersecurity threats and regularly reports to the Board of Directors regarding cybersecurity. Our audit committee oversees our enterprise risk management ("ERM") process, and cybersecurity represents an important component of our overall approach to ERM. Our cybersecurity policies, standards, processes and practices are informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework and applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional program that is focused on identifying, assessing, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: To manage our cybersecurity program, management has established a cybersecurity steering committee and cybersecurity incident response team, both led by our chief information officer. Our cybersecurity steering committee and cybersecurity incident response team include multidisciplinary groups of corporate and operational leaders, external cyber-specialist resources and technical experts in cybersecurity risk management, incident response and security operations. Many members of our cybersecurity team have extensive experience in the operations of networks, network security and infrastructure management. Our chief information officer has over 20 years of information technology experience, including leadership roles at large, global, publicly-traded companies, and is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals on the cybersecurity steering committee and cybersecurity incident response team, and through the use of technological tools and software. Our chief information officer is also responsible for updating the audit committee on cybersecurity on a quarterly basis and, where appropriate, escalating certain cybersecurity incidents to the full Board of Directors.


text: Risk Management and Strategy Cybersecurity risk management is an integral part of Mullen's overall enterprise risk management framework. We have implemented comprehensive measures to safeguard our information systems, protect sensitive data, and identify, assess and manage material risks from cybersecurity threats. Our cybersecurity program encompasses threat prevention, detection, mitigation, and remediation strategies tailored to the dynamic risk landscape in the automotive sector.

companyName: BOLLINGER INNOVATIONS, INC.

ticker: BINI


text: Our risk management efforts include threat intelligence gathering, vulnerability assessments, and the integration of advanced cybersecurity technologies. These measures are designed to help protect Mullen's proprietary systems and customer data from both internal and external cybersecurity threats. From time to time, Mullen has engaged third parties, on an as needed basis, to perform various cybersecurity services and risk assessments. Additionally, we maintain third-party tools to monitor for vulnerabilities.


text: We perform diligence, which includes reviewing SOC II reports, on certain third-party service providers who provide critical data and cloud services in order to oversee and identify risks from cybersecurity threats associated with such critical third-party service providers.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident.


text: As a function of its oversight role, the Board is responsible for ensuring that material risks are identified and managed appropriately. While the Board of Directors has the ultimate responsibility for risk oversight, the Board of Directors has delegated responsibility for the oversight of data privacy and cybersecurity to the Audit Committee. Senior management of Mullen regularly report to the full Board regarding risks we face, however, there has been no specific reports of risks related to cybersecurity threats that have been discussed with the Board.


text: Our VP of IT and our Director of IT Operations are responsible for assessing and managing risks from cybersecurity threats. Our VP of IT and Director of IT Operations each have over 20 years of experience in information technology, with cybersecurity comprising a significant role in their experience. The VP of IT and the Director of IT Operations are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents as a function of their management of our cybersecurity program.


text: As of the date of this filing, we do not believe that any risks from cybersecurity threats, including as the result of past cybersecurity incidents, have had, or are reasonably likely to have, a material effect on our business strategy, results of operations, or financial condition. While we strive to employ safeguards, no system can guarantee absolute security and we cannot guarantee that any future risk from cybersecurity, including any future cybersecurity incidents, will not be material to our business strategy, results of operations or financial condition.


text: Our business is highly dependent on our information systems, including our ability to operate them effectively and to successfully implement new technologies, methods, and processes, as well as adequate controls and cybersecurity incident recovery plans. We rely on our information systems to manage our business. In addition, we must protect the confidentiality and integrity of the data of our business, employees, customers, and other third parties. Our business involves the collection, processing, storage, and transmission of personally identifiable information and other sensitive and confidential information. This data is wide-ranging and relates to our employees, customers, and third parties.

companyName: Byrna Technologies Inc.

ticker: BYRN


text: Our management, led by our Chief Executive Officer, has the overall responsibility for identifying, assessing and managing any material risks from cybersecurity threats, and our Board of Directors, assists in overseeing and monitoring cybersecurity risks and risk management. Our cybersecurity posture is designed to comply with key global financial regulations and cybersecurity laws in the jurisdictions in which we operate. This posture includes taking several proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material cybersecurity risks, and protect against, detect, and respond to cybersecurity threats and incidents, we undertake the following activities: Closely monitor emerging data protection laws and implement changes to our processes designed to comply; Undertake reviews of our consumer-facing and internal policies and statements related to cybersecurity; Proactively inform our customers of substantive changes related to customer data handling; Conduct annual cybersecurity training for all our employees;


text: Conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats;


text: Through policy, practice, and contract (as applicable), require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care;


text: Update and assess our cybersecurity technologies to address threats and vulnerabilities; and Carry cybersecurity insurance to protect against potential losses from incidents. Cybersecurity Risk Assessment Program We do not have a formal cybersecurity risk assessment program.


text: Policies and Procedures for Third-Party Service Providers We do not have specific policies and procedures to oversee, identify, or mitigate the cybersecurity risks associated with our use of third-party service providers, other than relying on SOC 1 Type 2 reports for materially in-scope applications.


text: Activities to Prevent, Detect, and Minimize Cybersecurity Incidents We undertake various activities to prevent, detect, and minimize the effects of cybersecurity incidents. These activities include: ensuring that company data accessed via a desktop or laptop computer is only accessible from company-owned computers ensuring that company-owned computers are regularly updated and maintained, are running the latest versions of our Endpoint Detection and Response antivirus software ensuring that company-owned computers access the internet through secure connections via our corporate VPN solution updating and assessing our cybersecurity technologies such as our firewall and various cybersecurity software Impact of Previous Cybersecurity Incidents At this time, we have not identified any risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected us. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us.


text: Impact on Results of Operations or Financial Condition Cybersecurity risks and incidents have not materially affected our results of operations or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us.


text: Consideration of Cybersecurity Risks in Business Strategy, Financial Planning, and Capital Allocation Cybersecurity risks are considered as part of our business strategy, financial planning, and capital allocation. We regularly review and update our cybersecurity posture to address emerging threats and ensure the protection of our information systems.


text: Risk Management and Strategy The Company has developed a standards-based information security program to address risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. The maturity and effectiveness of the security program is reviewed biennially by a reputable third party.

companyName: BASSETT FURNITURE INDUSTRIES INC

ticker: BSET


text: A risk assessment is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent by the Company include endpoint threat detection and response (EDR), identity and access management (IAM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management. An internal information security audit program is in place to ensure controls remain operational and effective.


text: Third-party security firms are used by the Company in different capacities to provide or operate some of these controls and technology systems. Third parties are also used to conduct assessments, such as vulnerability scans and penetration testing of the Company and its systems. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services.


text: The Company has a written incident response plan ("IRP") and conducts tabletop exercises to enhance incident response preparedness. Disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. Employees undergo security awareness training, including phishing simulation training, when hired and periodically throughout the year.


text: The Company's executive leadership team meets regularly to address enterprise risks, and cybersecurity is a risk category addressed by that group. In addition to assessing major risks, management identifies and monitors such risks. At least annually, the Company's executive leadership reviews with the Board of Directors the major risks identified in the enterprise risk management process, as well as the steps identified to mitigate such risks. Each of the business and functional leaders responsible for the management of these identified risks also regularly discuss with the Board changes in assessment of these risks and mitigation plans.


text: The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: The Company activated their incident response plan to address a security incident in 2024. The Company is not aware of additional cybersecurity threats or any material cybersecurity incidents to date that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: On July 10, 2024, we detected unauthorized occurrences on a portion of our information technology (IT) systems. Upon detecting the unauthorized occurrences, we immediately began taking steps to contain, assess and remediate the cybersecurity incident, including beginning an investigation with leading external cybersecurity specialists, activating our incident response plan, and shutting down some systems. As a result of these and other measures, we believe the threat actor was ejected from our IT systems on July 10, 2024.

stage1Category: Incident Disclosure


text: After we shut down some of our systems, we experienced disruption to certain of our operations, including interrupted manufacturing at our domestic plants and delayed order fulfillment for our retail network and delay of some wholesale shipments. Within a few days of the incident, we were able to resume retail order fulfillment and caught up on fulfilling wholesale orders that were delayed as a result of the cybersecurity incident. We have fully restored the IT systems and data and our investigation has not found evidence that any of our core operating systems for manufacturing, wholesale and retail order processing and fulfillment, or financial reporting were impacted.


text: While we believe the impacts were not material to our financial condition and results of operations for the fiscal year, we estimate that between $1,000 and $2,000 of sales were lost due to the shutdown during the cybersecurity incident. During the third quarter of 2024, we also incurred legal and remediation costs related to the incident of approximately $98 which are included in selling, general and administrative expenses. In addition, cost of goods sold for year ended November 30, 2024 includes $609 for wages paid to hourly production employees during the work stoppage resulting from the cybersecurity incident. Because no inventory was produced during the temporary shutdown of our manufacturing operations, these wages were charged directly to expense. We are seeking reimbursement of certain costs, expenses and losses stemming from the cybersecurity incident and have submitted a claim to our cybersecurity insurer. We expect final resolution and payment of the claim during the first half of 2025.


text: The Chief Information Officer ("CIO") holds primary oversight responsibility for the team managing the development, operation, and maintenance of our information security program. This team also has responsibility to maintain and enhance the Company's written cyber security incident response plan, which identifies incident severity classifications and serves as a trigger for escalation for the response team.


text: With over 25 years of experience across diverse IT technologies, the CIO brings extensive expertise to the role. The CIO is also a member of the Company's executive leadership team, meeting regularly with the CEO, CFO, and other senior leaders. The CIO directly reports to the Board at least annually, addressing cybersecurity risks and strategy, and attends Board meetings to discuss cybersecurity matters as needed. The Audit Committee provides oversight of the information security program. The CIO reports to the Audit Committee annually on cybersecurity risks and related internal controls and attends quarterly meetings to provide updates and address any questions regarding cybersecurity and information technology systems.


text: Our cybersecurity risk management process is a component of our overall enterprise risk management process, through which our Chief Executive Officer and other members of senior management assess, identify, and manage material risks from cybersecurity threats we face. Our cybersecurity process seeks to protect our information systems by managing and reducing material risks from cybersecurity threats and by responding to and mitigating cybersecurity incidents. The Board of Directors (the "Board"), and the Audit Committee of the Board (the "Audit Committee"), provide oversight of our cybersecurity risk management process. The Audit Committee reviews our cybersecurity program and cybersecurity risk management process quarterly, and our Board reviews our cybersecurity program annually. Our cybersecurity program is directly managed by the Chief Information Officer ("CIO"), who is experienced in information systems and cybersecurity and whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CIO provides periodic updates to our Board and Audit Committee, as well as our Chief Executive Officer and other members of our senior management. These updates cover the Company's material cybersecurity threats, the status of projects to strengthen our cybersecurity posture, and assessments of the cybersecurity program. Our cybersecurity risk management process is evaluated by internal and external cybersecurity experts, and the material results of those reviews are reported to senior management and the Board and Audit Committee as part of their oversight role. We also engage with third-party service providers deemed to have subject matter expertise in cybersecurity matters, industry participants, and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and processes. We require each third-party service provider to certify that they implement and maintain appropriate security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect us. We use various tools and methodologies to manage cybersecurity risk and to prevent, detect, and mitigate cybersecurity incidents. Our tools and methodologies are tested regularly, including vulnerability scans, red-teaming exercises and other penetration testing, and review of cybersecurity threat intelligence feeds. We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We have experienced, and will continue to experience, cybersecurity incidents in the normal course of our business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors – Factors Related to Overall Business & Operations – Our business depends on the use of information technology systems. A failure of these systems, cybersecurity incidents, or cyber-fraud may cause business disruptions, compromise our intellectual property or other sensitive information, or result in losses."

companyName: LATTICE SEMICONDUCTOR CORP

ticker: LSCC


text: We believe cybersecurity is critical to advancing our technological developments. As a biopharmaceutical company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business strategy, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Kiromic Biopharma, Inc.


text: We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. We have established cybersecurity security awareness training and ongoing monitoring.


text: In the event of an incident, we intend to follow our cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, and notification. We contract with external firms that have extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a clinical site, subcontractor, or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the direct impact of the incident.


text: The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee.


text: While we have not experienced any material cybersecurity threats or incidents in recent years, there can be no guarantee that we will not be the subject of future threats or incidents. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.


text: Cybersecurity incidents have the potential to disrupt our business operations, lead to the loss of critical and confidential information, and damage our reputation and financial performance.

companyName: AIS Holdings Group, Inc.

ticker: AIDG


text: We have a multi-layered approach to assess, identify and manage material risks from cybersecurity threats. This approach includes a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other cybersecurity incidents or vulnerabilities affecting the data.

companyName: ARTS WAY MANUFACTURING CO INC

ticker: ARTW


text: The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a cybersecurity incident at a third-party vendor or customer. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.


text: As part of our risk management process, we conduct regular application security assessments to identify vulnerabilities within our IT infrastructure. These assessments include both automated scans and manual reviews by our cybersecurity team. Threat intelligence feeds and security reports are continuously monitored, with the goal of staying ahead of emerging threats. In the event of a cybersecurity incident, we maintain incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually along with random internal phishing campaigns.


text: We are led by our Director of IT, who is responsible for implementing and maintaining centralized cybersecurity and data protection practices in close coordination with our senior leadership team. We also engage assessors, consultants, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. Our cybersecurity risks and associated mitigations are evaluated by senior leadership and routinely by our Board of Directors.


text: Our Director of IT, who has extensive cybersecurity knowledge and skills gained from over 10 years of work experience in various information technology roles, heads the team responsible for implementing and maintaining cybersecurity and data protection practices and reports directly to the Chief Financial Officer.


text: As of the date of this report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Cybersecurity threats are continually evolving, and no assurances can be given that our risk management systems and processes will fully mitigate all cybersecurity threats and risks.


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing and maintaining cybersecurity measures to safeguard our information systems, shield our operational technologies in our manufacturing plants and protect the confidentiality, integrity and availability of our data.

companyName: HUNTSMAN INTERNATIONAL LLC


text: We have a qualitative cybersecurity risk management program within our Enterprise Information Security function to promote a company-wide culture of cybersecurity risk management for our information technology and operational technology. This program supports cybersecurity considerations as part of our decision-making processes. Our Enterprise Information Security team works closely with our global information technology organization ("Global IT"), operational technology teams and business units to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We are aligned with the U.S. National Institute of Standards and Technology Cybersecurity Framework, against which we periodically assess our readiness.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants and auditors, in evaluating and testing our cybersecurity posture. These partnerships enable us to leverage specialized knowledge and insights in the development of our cybersecurity program consistent with industry best practices. Our collaboration with these third parties includes regular audits, threat assessments and consultation on security enhancements.


text: Because we are aware of the risks associated with third parties, we have implemented a third-party security risk management program to oversee and manage these risks. We conduct security assessments of third-party providers contracted by Global IT before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The program includes tools and services, which continuously monitor third parties for potential security concerns, data leaks and cyber posture, as well as periodic renewals of due diligence commensurate with their risk. This approach is designed to mitigate risks related to data breaches or other security incidents originating from these third parties.


text: As of the date hereof, we have not identified any cybersecurity threats or previous cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see "Part I. Item 1A. Risk Factors."


text: Cybersecurity Governance The Board of Directors is aware of the importance of managing risks associated with cybersecurity threats. The Board of Directors has established oversight mechanisms for effective governance in managing risks associated with cybersecurity threats, because they recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: The Audit Committee is responsible for the Board of Directors' oversight of cybersecurity risks. The Audit Committee is composed of board members with diverse expertise including, cyber operations, risk management, technology and finance, equipping them to oversee cybersecurity risks effectively. The Audit Committee reviews our cybersecurity programs and the effectiveness of its risk management strategies. This review helps management identify areas for improvement and align our cybersecurity program with the overall risk management framework.


text: The Chief Information Officer ("CIO") plays a pivotal role in informing the Audit Committee on cybersecurity risks. The CIO provides briefings to the Audit Committee on a quarterly basis. These briefings encompass a broad range of topics, including: current cybersecurity landscape and emerging threats; status of ongoing cybersecurity initiatives and strategies;


text: incident reports and learnings from any cybersecurity events; and compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, select members of the Audit Committee and CIO maintain an ongoing dialogue regarding potential cybersecurity threats and mitigation strategies and updates to our cybersecurity posture. The Audit Committee oversees strategic decisions related to our cybersecurity program, offering guidance and approving investments in major initiatives. This ongoing oversight enables cybersecurity considerations to be integrated into our broader strategic planning objectives.


text: Reporting to our CIO, our cybersecurity function is led by our Chief Information Security Officer ("CISO"). The CISO manages a team of cybersecurity professionals and third-party support functions with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.


text: Our CISO and CIO are regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we have an incident response plan that includes immediate actions to contain and eradicate the threat, mitigate the impact, and long-term strategies for remediation and prevention of future incidents.


text: The CIO regularly informs the Chief Executive Officer and management regarding cybersecurity risks and incidents, so they are kept abreast of the cybersecurity posture and potential risks. Significant cybersecurity matters and strategic risk management decisions are reported to the Audit Committee.


text: Cybersecurity Risk Management and Strategy The Trust does not have any officers, directors or employees. The Sponsor, a subsidiary of BlackRock, is responsible for the oversight and overall management of the Trust. The Sponsor relies on BlackRock's ERM framework for the Trust's cybersecurity risk management and strategy. Key aspects of the ERM framework are summarized below. The board of directors of the Sponsor (the "Board of Directors") periodically receives reports from BlackRock regarding BlackRock's cybersecurity program.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: As of December 31, 2024, cybersecurity risks have not materially affected the Trust's objective, results of operations or financial condition.


text: BlackRock ' s Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas:


text: Risk Management and Strategy To effectively manage the cyber risk posed to our organization and to remain within our risk appetite, we maintain a cybersecurity strategy and risk management program to identify, assess and manage material risks from cybersecurity threats with the aim of protecting the confidentiality, integrity and availability of our critical systems and information.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors ("BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC").


text: Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks.


text: Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention tabletop exercises, ongoing vulnerability and patch management vendor due diligence multi-factor authentication device encryption application security, code testing and penetration testing endpoint security, including anti malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges employee awareness, training, and phishing testing data loss prevention program and monitoring information security incident reporting and monitoring and layered and comprehensive access controls.


text: Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address BlackRock's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis.


text: Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.


text: Education and Awareness: BlackRock's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and to receive communications on BlackRock's evolving information security policies and procedures.


text: BlackRock's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of BlackRock's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. BlackRock regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to BlackRock's Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.


text: As of December 31, 2024, cybersecurity risks have not materially affected BlackRock's business strategy, results of operations or financial condition.


text: BlackRock ' s Cybersecurity Governance BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. BlackRock's Risk Committee assists BlackRock's Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. BlackRock's Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. BlackRock's Board and BlackRock's Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of BlackRock's Board's Risk and Audit Committees.


text: Technology and cybersecurity risks at BlackRock are also overseen by the TRCC, a dedicated management risk governance committee and sub committee of the firmwide ERC. The chair of the TRCC is appointed by the head of Enterprise Risk Management at BlackRock and its members include the CISO as well as a broad range of senior business stakeholders across BlackRock. The TRCC is responsible for oversight of BlackRock's technology and cybersecurity risk management practices and helps ensure that technology and cybersecurity risks remain within firmwide risk tolerances and technology and cybersecurity risk issues are escalated as appropriate to the ERC and other committees. The TRCC also reviews any relevant technology and cybersecurity risk related issues and helps ensure that they are appropriately escalated, reported, and remediated.


text: BlackRock's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by BlackRock's CISO. As of December 31, 2024, the CISO had over 30 years of experience in information technology with a 25-year concentration in information security, including previously serving as the CISO at several global financial institutions, and held the Certified Information Systems Security Professional certification. The CISO works closely with the leadership team and other subject matter experts in the global cybersecurity group, who collectively have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and overseeing cybersecurity controls in technology risk and audit functions, as well as having relevant degrees and industry-leading certifications.


text: The CISO and members of the TRCC monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of BlackRock's incident response plan.


text: Cybersecurity Risk Management and Strategy The Trust does not have any officers, directors or employees. The Sponsor, a subsidiary of BlackRock, is responsible for the oversight and overall management of the Trust. The Sponsor relies on BlackRock's ERM framework for the Trust's cybersecurity risk management and strategy. Key aspects of the ERM framework are summarized below. The board of directors of the Sponsor (the "Board of Directors") periodically receives reports from BlackRock regarding BlackRock's cybersecurity program.

companyName: iShares Gold Trust Micro

ticker: IAUM


text: As of December 31, 2024, cybersecurity risks have not materially affected the Trust's objective, results of operations or financial condition.


text: BlackRock ' s Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas:


text: We use third -party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example threat intelligence service providers, cybersecurity consultants, cybersecurity software providers and penetration testing firm consultants.

companyName: PlayAGS, Inc.


companyName: iShares Silver Trust

ticker: SLV


text: We use third -party service providers to perform a variety of functions throughout our business, such as third party content providers, application providers and contract manufacturing organizations.


text: Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors ("BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC").


text: Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks.


text: Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention tabletop exercises, ongoing vulnerability and patch management vendor due diligence multi-factor authentication device encryption application security, code testing and penetration testing endpoint security, including anti malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges employee awareness, training, and phishing testing data loss prevention program and monitoring information security incident reporting and monitoring and layered and comprehensive access controls.


text: Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address BlackRock's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis.