text: Due to our highly regulated stature for medical device development and manufacture, we have been practicing cybersecurity for a long time. We are ISO-13485 Certified for medical device manufacturing. Elements of that certification include risk management. And we are knowledgeable about ISO-27001. We have an engineer responsible for the security of our computers, network, etc.


text: We have robust firewalls for all access points. We have top line anti-virus on all computers and networks. We have prioritized the risks to protect our networks. To protect our departments we have implemented an architecture of a separate network for administration and one for engineering. This gives redundancy and protection. There is onsite as well as offsite backup as well as a separation of WiFi for visitors to prevent access to our network.

companyName: ADM TRONICS UNLIMITED, INC.

ticker: ADMT

secItem: Item 1C

stage1Category: Risk Management Process

stage1Method: majority


text: A plan is in place to restore our networks if attacked by both our on-site backup and, if needed the off-site backup. We have very complex software for our engineering. We also have a robust accounting ERP software. These are regularly maintained and updated.

stage1Method: unanimous


text: We have an independent consultant who is a cybersecurity expert who has advised us on the above systems and procedures. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.

stage1Category: Strategy Integration


text: Our committee for the review and implementation of cybersecurity policies and procedures are made up of the CEO, CSO and VP of Regulatory and through the CEO, provides an update to the Board of Directors on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Board of Directors of any material threats or incidents that arise.

stage1Category: Management Role


text: Risk Management and Strategy The Company maintains cybersecurity processes, technologies and controls to help it assess, identify and manage material risks from cybersecurity threats. These processes, technologies and controls are part of the Company's overall enterprise risk management process.

companyName: BUTLER NATIONAL CORP

ticker: BUKS


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from cybersecurity threats have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled " Cyber security attacks, internal system or service failures, and misappropriation of data or other breaches of information security may adversely impact our business and operations " in Item 1A. Risk Factors.


text: Management is responsible for the day-to-day assessment and management of cybersecurity risks. Cybersecurity measures that pertain specifically to Company's Boot Hill subsidiary have been delegated to Boot Hill's Board of Managers, a committee comprised of directors and officers of the Company and officers of Boot Hill. This committee is responsible for ensuring compliance with Kansas Racing and Gaming Commission regulations.

stage1Category: Board Governance


text: The Board of Directors has oversight responsibility for the Company's strategic and operational risks. The Board has delegated oversight responsibility for certain risks to its committees, including delegation to the Board's Nominating and Governance Committee oversight of the Company's major non-financial reporting enterprise risk assessment and management processes not retained by the Board. However, given the broad and important role of cybersecurity oversight, the Board has determined that oversight for cybersecurity should remain with the full Board. The Board routinely receives reports from the Company's Chief Executive Officer, with the assistance of the Company's IT department, concerning the Company's cybersecurity risk management and strategies and related processes, technologies and controls.


text: Cybersecurity risk, management, & strategy Tilray recognizes the importance of cybersecurity in safeguarding our systems, data, and operations and we are committed to addressing the significant risks posed by cyber threats. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management framework to other legal, compliance, operational, and financial risk areas. The Company is committed to maintaining robust processes to assess, identify and mitigate material risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents.

companyName: Tilray Brands, Inc.

ticker: TLRY


text: Our business is subject to various cybersecurity risks, including but not limited to, unauthorized access to sensitive data, including customer information and medical information, disruption of operations or supply chain due to cyberattacks, theft or manipulation of intellectual property, such as proprietary strains or cultivation techniques, regulatory non-compliance resulting from cybersecurity breaches, including violations of data privacy laws. To address these risks, we have implemented a comprehensive cybersecurity program, which includes, regular risk assessments and vulnerability testing to identify and address potential weaknesses in our systems, deployment of robust access controls and encryption technologies to protect sensitive data, mandatory annual employee training and awareness programs to promote cybersecurity best practices and prevent social engineering attacks, and continual monitoring and incident response procedures to detect and respond to cybersecurity incidents in a timely manner. We also have information security and data privacy policies and procedures in place applicable to our directors, officers, employees, contractors and suppliers. Third parties service providers also contribute to our overall cybersecurity. We engage third parties to support in the design, implementation and ongoing efforts to help identify and mitigate cybersecurity risks.


text: Based on the information we have as of the date of this Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" for further information about these risks.


text: Cybersecurity governance Cybersecurity is an important part of our risk management processes and is an area of focus for our Board, Chief Information Officer ("CIO") whom reports to the Chief Executive Officer, and management team. Our CIO plays a pivotal role in assessing and managing material risks stemming from cybersecurity threats and is primarily responsible for the oversight of our overall cybersecurity risk management program, and coordinates with our external cybersecurity consultants. Additionally, given that cybersecurity risks can impact various areas of responsibility of the Committees of the Board, our Board of Directors oversees cybersecurity risk management and regularly reviews our cybersecurity strategy and initiatives. The Board receives quarterly and as needed updates on cybersecurity matters from the CIO and management.


text: Tilray is dedicated to maintaining a robust cybersecurity program to safeguard our assets, data, and stakeholders' interests. We remain vigilant in our efforts to identify, assess, and mitigate cybersecurity risks and are committed to transparency and accountability in our cybersecurity disclosures.

stage1Category: None/Other


text: Despite the Company's security measures and programs, our information technology and infrastructure are susceptible to cybersecurity incidents, intrusions and attacks, any of which could have a materially adverse effect on our business, operating margins, revenues and competitive position. See "Part I—Item 1A. Risk Factors" for further discussion of these risks.

companyName: LSI INDUSTRIES INC

ticker: LYTS


text: Cybersecurity Risk Management and Strategy Like other global companies, we face various cybersecurity threats that could have a material adverse effect on our business strategy, results of operations or financial condition. Cybersecurity, therefore, is an important element of our business and our overall enterprise risk management program, and while we have experienced a small number of cyber incidents over the last few years, none to date have been material or had a material adverse effect on our business or financial condition. To mitigate the risk, we have established a multilayered approach to assessing, identifying and managing material risks from cybersecurity threats, which includes the following:

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: An annual cybersecurity risk assessment as part of our Enterprise Risk Management (ERM) program, which reviews and evaluates the potential impact and likelihood of various cyber risks and defines a framework for mitigating measures and residual risk.


text: A cybersecurity roadmap that is built from the risk assessment and feeds into our annual IT expenditure plan and which outlines the actions and investments we intend to take to enhance our cybersecurity posture and capabilities.


text: A continuous cybersecurity risk monitoring and response process, which involves daily review and real-time alerts of security incidents, a multi-disciplinary escalation and review process, and a reporting and filing protocol for material incidents within four business days of materiality determination.


text: A periodic cyber risk assessment conducted by independent experts, which provides an external validation and benchmarking of our cybersecurity practices and performance.


text: As part of our cybersecurity program, we have and will continue to engage third parties, such as consultants, network security firms, auditors, and forensics providers, to assist us in assessing, managing, or investigating cyber risks or incidents. For example, we have engaged industry recognized third parties to monitor and conduct penetration and vulnerability testing on our networks and to assist us in the conduct of tabletop exercises.


text: In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we perform third-party risk assessments designed to help protect against the misuse of IT by third parties and business partners and generally request that third-party service providers provide us information about their security policies and procedures.

stage1Category: Third-Party Risk


text: Cybersecurity Governance and Oversight We have a cybersecurity governance structure that involves the oversight and involvement of our board of directors and senior management.


text: Our board of directors, through its Audit Committee, maintains oversight of risks, including cybersecurity risks, and receives an update from the Director of IT Security and the Chief Information Officer (CIO) at each quarterly committee meeting. The Audit Committee also reports to the full board on cybersecurity matters as part of its regular report out after each meeting. The Audit Committee Chair is immediately informed of any breach that could be more than de minimis and is kept apprised of any resulting investigation and is briefed on the substance of any Form 8-K filing related to a material cybersecurity incident.


text: At the management level, oversight of our cybersecurity program rests with an internal committee comprised of the CIO, the Chief Legal Officer (CLO), and the Director of IT Security, who have in aggregate over 40 years of experience in assessing and managing cyber risks. The committee is responsible for overseeing the implementation and execution of our cybersecurity program and policies, and for engaging external experts as needed. The committee also reviews the log of security incidents as needed to validate that there are no materiality issues in the aggregate. The committee reports to the Audit Committee on a quarterly basis or more frequently as needed. We have an Incident Response Team comprised of IT, legal, and internal audit personnel that is activated with the help of other disciplines in the event of a perceived breach or security risk. The team is responsible for assessing the impact and materiality of the incident in accordance with a written Incidence Response Plan, determining the appropriate response and remediation actions, and communicating with internal and external stakeholders as needed.


text: In an effort to deter and detect cyber threats, we have a required cybersecurity training program that is provided to all new employees during on-boarding and semi-annually to employees with access to our IT resources, which aims to raise awareness and foster a culture of cybersecurity among our workforce. We also have an ongoing process of sending simulated phishing emails to employees. The results of these simulated attempts are monitored and reported to each employee's manager. Training includes such cybersecurity topics as social engineering, phishing, password protection, confidential data protection, asset use and mobile security. The training also emphasizes the importance of reporting all incidents immediately.


text: Our Vice President of Finance and/or representatives from our management committee on cybersecurity provide periodic briefings to our Board of Directors regarding our Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.

companyName: Cyclo Therapeutics, Inc.


text: Cybersecurity Risk Management and Strategy We have policies, procedures and processes in place to identify, assess and monitor material risks from cybersecurity threats. These plans are part of our overall enterprise risk management strategy and are part of our operating procedures, internal controls, and information systems. Cybersecurity risks include, among other things, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks. We have developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, although this does not imply that we meet all technical standards, specifications or requirements under the NIST.

companyName: ETHAN ALLEN INTERIORS INC

ticker: ETD


text: Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on our networks, including customer and employee information.


text: Cybersecurity incident response plan and testing: We have a cybersecurity incident response plan and dedicated teams to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have cross-functional teams that are responsible for leading the initial assessment of priority and severity, and external experts may also be engaged as appropriate. Our cybersecurity teams assist in responding to incidents depending on severity levels and seek to improve our cybersecurity incident management plan through periodic tabletops or simulations. Our Vice President of Information Technology and other members of his team oversee the implementation of this plan and are made aware of ongoing risks and incidents.


text: Training: We provide security awareness training to our employees so they may better understand their information protection and cybersecurity responsibilities. We also provide additional training to certain employees based on their roles.


text: Supplier risk assessments: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply-chain or who have access to our customer and employee data on our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program. These considerations affect the selection and access to our systems, data, or facilities. We also seek contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect our information that is processed on their systems.


text: Third-party assessments: We have engaged third-party vendors to periodically assess our cybersecurity posture, to assist in identifying and remediating risks from cybersecurity threats. We also regularly engage with consultants, auditors, and other third-parties to help identify areas for continued focus, improvement and compliance.


text: While the Company has experienced cybersecurity incidents, we are not aware of any cybersecurity incidents to date, including as a result of any previous cybersecurity incidents, that has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase and the preventative actions we have taken and continue to take to reduce these risks and protect our systems and information may not successfully protect against all cybersecurity threats and incidents in the future. For more information, see Item 1A. Risk Factors under the heading of "Technology and Data Security Risks", of this Annual Report on Form 10-K.


text: Cybersecurity Governance The Company's Board of Directors (the "Board"), as a whole, has oversight responsibility for our strategic and operational risks. The Board regularly reviews and discusses with management the strategies, processes and controls pertaining to the management of our information technology operations, including updates on the internal and external cybersecurity threat landscape, incident response, assessment and training activities, and relevant legislative, regulatory, and technical developments. Our Vice President of Information Technology presents, at least annually, to the Board, an overview of our cybersecurity threat risk management and strategy as well as provides reports regarding the evolving cybersecurity landscape, including emerging risk. Our Vice President of Information Technology and other members of his team remain informed about cybersecurity threats through the reporting framework as described above under Cybersecurity Risk Management and Security – Cybersecurity incident response plan and testing.


text: The Information Technology team is responsible for the day-to-day assessment and management of cybersecurity risks. Our cybersecurity risk management and strategy are led by our Vice President of Information Technology, and our Manager of Security. Such individuals have over 50 years of work experience, collectively, in various roles managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs.


text: can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Webstar Technology Group Inc.

ticker: WBSR


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader risk management system and processes. The cybersecurity risk management system involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from consultants, cybersecurity assessors, auditors and other third parties to gather certain insights designed to identify and assess material cybersecurity threat risks, their severity and potential mitigations. We depend on and engage various third parties, including suppliers, vendors, and service providers. Our risk management, legal, information technology, and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such entities. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to Mr. Srinivasan, our designated member of our Board of Directors.

companyName: WRAP TECHNOLOGIES, INC.

ticker: WRAP


text: Mr. Srinivasan has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and report any findings and recommendations, as appropriate, to the full Board of Directors for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the designated member of the Board of Directors.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. Further, a cyber incident impacting our systems or a third-party's systems could subject us to business, regulatory, litigation and reputational risk, which could have a negative effect on our business, results of operations and financial condition. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report.


text: Risk Management and Strategy In the ordinary course of our business, we utilize technology systems to collect, use, store, and transmit information. The confidentiality, integrity, and availability of the information in our systems is important to our operations, business strategy, and maintaining the trust of our customers, employees and partners. As part of our enterprise risk management program, we have processes in place to identify, assess, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: Our cybersecurity team engages with applicable personnel across the enterprise and utilizes software tools to identify, categorize, and quantify material cybersecurity threat risks. The team meets regularly to consider new, known, and evolving risks and evaluate the measures in place to mitigate these risks.


text: Our strategy for managing cybersecurity risk is multifaceted and includes, without limitation: (i) robust security policies and procedures, designed in part to comply with Payment Card Industry, or PCI, rules; (ii) an incident response plan, (iii) comprehensive system security elements and vulnerability scanning; (iv) periodic cybersecurity awareness training and testing for employees and certain contractors; (v) risk management of our third-party suppliers, vendors, and other partners, which includes risk-based diligence and contractual provisions that generally allow for periodic auditing, and (vi) security assessments of any businesses that we acquire.


text: As part of our cybersecurity risk management program, we periodically engage third parties to evaluate and test our systems, run tabletop exercises to test our incident response processes, provide incident response support if needed, and review our PCI compliance.


text: We face ongoing risks that, if realized, could materially impact our business, operations and financial results. See our risk factor disclosures in Item 1A of this Annual Report on Form 10-K under the heading "Information Technology and Systems," which are incorporated by reference herein. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the company, including our business strategy, results of operations, or financial condition.


text: The Board of Directors of the Company (the "Board"), as a whole and through its committees, oversees the Company's risk management process, including operational, financial, legal, strategic, marketing and brand reputation risks. The Technology and Cybersecurity Committee of the Board (the "Committee") oversees risk management associated with the Company's information technology use and protection, including data governance, privacy, compliance, and cybersecurity. The Committee comprises Board members with particular expertise in technology and management, equipping them to oversee cybersecurity risks effectively.


text: Our Board of Directors is responsible for the oversight of cybersecurity risks and threats. The Board has delegated certain information security and data privacy oversight to the Audit Committee of the Board. The Audit Committee oversees compliance with information security and data privacy laws and has oversight responsibility for cybersecurity risks related to accounting, audit and financial matters. The Audit Committee and management report to the Board on a periodic basis regarding our information security and data privacy functions, including any cybersecurity threats.


text: The Committee is responsible for the oversight of the Company's policies and procedures intended to provide security, confidentiality, availability, and integrity of the Company's information, including with respect to data privacy and the Company's compliance with applicable data privacy and cybersecurity laws and regulations. The Committee also oversees the quality and effectiveness of the Company's policies and procedures with respect to its information technology systems and provides oversight on the Company's policies and procedures in maintaining preparedness for responding to any material incidents. The Committee also periodically coordinates with the Company's Audit Committee, which reviews risks related to the Company's information technology systems, including privacy, network security and data security.


text: The Company's program to identify, assess, and manage cybersecurity risks is led by our Chief Information Officer, and leverages the expertise of our Chief Financial Officer and General Counsel. Our Chief Information Officer holds a Bachelor of Science in Computer Science and has over 30 years of work experience, with more than 20 years in senior executive roles involving managing information systems, including implementing effective information and cybersecurity programs. Our Chief Information Officer, who reports to our Chief Executive Officer, meets regularly with the executive leadership team regarding topics related to technology operations, including cybersecurity, and also periodically updates the Board and the Committee regarding the Company's cybersecurity and data privacy risk mitigation plans.


text: With respect to the prevention, detection, mitigation, and remediation of cybersecurity incidents, our information security team, under the direction of our Chief Information Officer, monitors our information systems, assesses the severity of any incidents it detects or that are otherwise reported, and follows escalation procedures embedded within our incident response plan to inform the Chief Information Officer, other members of management, the Committee, and the Board, each as needed.


text: The Company's Board of Directors is responsible for exercising oversight of management's identification and management, and planning for, risks from cybersecurity threats.

companyName: TWIN DISC INC

ticker: TWIN


text: The Company has developed and is continuing to develop processes, that seek to assess, identify, and manage material risks from cybersecurity threats to the information technology systems and information it uses or will use, transmit, receive, and maintain. The processes for assessing, identifying, and managing material risks for cybersecurity threats include the Company's efforts to identify the relevant assets that could be affected, determine possible threat sources and threat events, assess threats based on their potential likelihood and impact, and identify controls that are in place or necessary to manage and/or mitigate such risks.


text: The Company has not experienced any material cybersecurity incidents, and the expenses incurred from any security incidents have been immaterial. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to the Company, including potentially to the Company's results of operations and financial condition. The Company relies extensively on information technology systems and could face cybersecurity risk. As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that the Company may expend greater resources to continue to modify and enhance protective measures against such security risks.


text: Risk Management and Strategy We are committed to preserving the trust and confidence of our stakeholders by taking appropriate technical and organizational measures for maintaining information security and data privacy. Our cybersecurity program allows us to assess, identify and manage information security and cybersecurity threats through robust risk assessment and prevention measures to facilitate communication, training, awareness and incident response procedures. We have established policies and procedures to ensure timely and appropriate notifications to relevant parties and regulators as required for cybersecurity threats and data breaches.


text: Our data breach response designates an incident response team comprised of senior leaders within information technology, finance and compliance functions to ensure timely diagnosis and mitigation of cyber events. The incident response team is responsible for determining whether a cybersecurity incident is material and requires current reporting pursuant to SEC Form 8-K Item 1.05 (Material Cybersecurity Incidents). In conducting the assessment, the team considers factors including, but not limited to the probability of an adverse outcome; the potential significance of loss; the nature and extent of harm to individuals, customers, and vendors; the nature and extent of harm to our competitive position or reputation; and the possibility of litigation or regulatory investigations.


text: To ensure our cybersecurity programs adhere to industry best practices, we have adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework as a guide for our cybersecurity program. The NIST Cybersecurity Framework models the best practices for security and the capabilities needed to identify, protect, detect and respond to cybersecurity risks and events. In addition to the framework, we have a Security Action Committee comprised of the senior leaders of information technology, finance, and compliance that meets regularly to guide the evolution of our cybersecurity program, review potential incidents, and respond to trends in the cybersecurity landscape. We evaluate our physical, electronic and administrative safeguards on a continuous basis to ensure they are effectively deployed across the business. We also engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.


text: The Audit Committee is responsible for oversight of our cybersecurity policy, procedures and risk mitigation. Our information technology (IT) leadership briefs the Audit Committee and the Board of Directors on a periodic basis on information security matters, including the current cybersecurity landscape, progress on information security initiatives and accomplishments, and reports on material cybersecurity incidents, as needed.


text: The Audit Committee is responsible for reviewing our disclosures on cybersecurity risk management, strategy and governance in our Annual Report on Form 10-K. The Audit Committee assists in determining materiality for timely reporting of cybersecurity incidents and is notified immediately if the incident response team has assessed that a material event may have occurred that may require filing an SEC Current Report on Form 8-K.


text: The Chief Information Officer with the support from the Chief Executive Officer and Chief Financial Officer, assisted by our broader IT team, is responsible for setting the strategic direction and priorities for information security, coordination of enterprise-wide compliance with information security policies and procedures, as well as day-to-day information security management. Additionally, information security awareness trainings and testing are a compliance requirement for employees.


text: While the Company does not employ a Chief Information Officer or consider cybersecurity threats to be a material risk to the business strategy, results of operations or financial position of the Company, the Board of Directors discusses risks and threats most applicable to the Company and inquires of management regarding design and effectiveness of controls in place to address the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: GREYSTONE LOGISTICS, INC.

ticker: GLGI


text: Risk Management and Strategy Due to the size of the Company, our information technology ("IT") environment does not utilize overly complicated systems or processes. The Company does not sell products or conduct business in an online environment. We utilize a third party managed services provider ("Provider") for security applications, monitoring, and updates to our information technology environment. The Chief Financial Officer serves as the relationship manager for and has regularly scheduled meetings with the Provider to evaluate whether the services provided meet the Company's needs, review hardware and software obsolescence, and identify any new threats that need to be addressed. The Company uses multi-factor authentication for applications wherever possible to provide access security and we maintain a secure physical environment.


text: Through the Provider, automated security tools are used to monitor all Windows-based systems and provide defense against cyberattacks perpetrated on or against these systems and to protect internal systems from known and unknown cybersecurity threats. These security tools include:


text: Advanced, next-generation endpoint security software, detects attempted attacks on internal Windows-based systems and analyzes the attack providing context for said attacks to analysis teams. This data is then used to mitigate the attack and resolve the incident.


text: Privilege management software provides application context to reviewers to aid in the preemptive identification of malicious activities on a system. When administrative permissions are requested, details regarding the requesting process are forwarded to our provider for review and analysis before granting administrative privileges, limiting an attacker's ability to affect and compromise systems in the environment.


text: The Company employs email security tools provided and managed by our Provider to protect against email-based attacks. These tools include an email security gateway and an additional automated email filtering security. These tools provide advanced, AI-powered phishing detection and remediation for all Microsoft 365 email users in the environment.


text: The Company utilizes various third-party service organizations for critical areas of operations, including stockholder transfer agent services, accounting software, financial reporting software and regulatory filings, and mineral management software. The Company obtains System and Organization Controls ("SOC") reports for each vendor and ensures that internal controls are designed and implemented to adequately meet the applicable user controls identified within the SOC report for each vendor.


text: The Company requires all devices used by employees to be protected with the security measures listed above. It is also Company policy that all devices be used by the employee only and any use by non-employees is prohibited.


text: To date, the Company has not experienced a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations or financial condition; however, there can be no guarantee that we will not experience such an incident in the future.


text: Internally to manage potential cybersecurity threats, we have established an Incident Response Plan that is designed to control the workflow of a reported incident. This plan formalizes incidence response stages such that reporting, identification, scope, response, and recovery are executed in a timely manner and identifies the order and coordination of internal and external communication. In addition, the Company addresses crisis management and business continuity with respect to Information Systems to ensure reliable redundancy and recovery of backed-up databases.

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: Managing technology risks, including cybersecurity risks, is a fundamental part of the Company's risk management framework and processes. We employ a variety of processes, risk assessments, and controls to assess, identify, and manage these risks and have developed and maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. The program is one component of our enterprise risk management system. The technical, administrative and physical controls underlying our program are based on nationally recognized practices and standards for cybersecurity. Trusted partners are an important part of our cyber risk management program. We partner with service providers to conduct periodic risk assessments and to monitor and maintain the performance and effectiveness of security controls used in our environment.

companyName: INTEGRATED BIOPHARMA INC

ticker: INBP


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees our management of enterprise risks, including cybersecurity risks. Members of the management team brief the Board of Directors and Audit Committee on the effectiveness of risk management efforts on an annual basis.


text: Our cyber risk management program helps mitigate risks that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Security breaches and other disruptions could compromise our information and expose us to liability, and could cause our business and reputation to suffer.


text: As of the date of this Annual Report on Form 10-K we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. However, despite our best efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents. See "Risk Factors" in Item 1A in this Annual Report on Form 10-K for further discussion.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. We have a comprehensive cybersecurity policy hosted on our intranet for all employees, established to govern, guide and mitigate in the event of a cyber-attack. As a result, cybersecurity and data protection are key components of our long-term strategy.

companyName: TRIO-TECH INTERNATIONAL

ticker: TRT


text: Risks from Cybersecurity Threats We have not encountered any cybersecurity challenges that have materially impaired our operations or financial standing in Fiscal 2024.


text: Our Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Cybersecurity Risks We rely on internal and third-party information technology systems and networks to process, transmit and store electronic information in our operations, including our proprietary business information and that of our customers, suppliers and employees. We use various internal and third-party information technology systems and networks to manage our operations and maintain effective internal control over financial reporting. We also collect and store sensitive data, including intellectual property, proprietary business information and personal information of our customers, suppliers and employees, in our data centers and on our networks. The secure operation of these information technology systems and networks, and the processing and maintenance of this information, are critical to our business operations and strategy.

companyName: AYTU BIOPHARMA, INC

ticker: AYTU


text: Despite our security measures, our internal and third-party information technology systems and networks may be subject to damage, disruption, or unauthorized access due to a variety of factors, including cyber-attacks by computer hackers, computer viruses, ransomware, phishing, denial-of-service attacks, physical or electronic break-ins, employee error or malfeasance, power outages, natural disasters, or other catastrophic events. Any such damage, disruption, or unauthorized access could compromise our internal and third-party networks and the information stored there could be accessed, publicly disclosed, lost, or stolen. Any such access, disclosure, or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations, damage to our reputation, loss of customers, potential harm to our competitive position and additional costs to remediate the issue.


text: Management is not aware of any material security breaches on its Information Systems and risks from cybersecurity threats have not previously materially affected us. Because certain of our vendors have experienced cyberattacks in the past and the threat and development of cyberattacks is continuous, it is impossible to say with certainty whether the Company's efforts will prevail in a coordinated attack on its Information Systems. We currently do not expect the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: LIQUIDMETAL TECHNOLOGIES INC

ticker: LQMT


text: Cybersecurity Practices We have implemented various measures to manage our risk of information technology systems and networks damage, disruption, or unauthorized access, including regular employee training, monitoring of our systems and networks, maintenance of backup and protective systems and use of modern endpoint detection and response tools, which are integrated into Aytu's risk management systems and processes. We have implemented multi-factor authentication ("MFA") across many of our systems and email accounts to prevent unauthorized access and impersonation. We also utilize a cloud-based environment for a large portion of our operations, which enhances our scalability, flexibility and resilience and utilize third parties to perform early external vulnerability assessment and risk identification. We have established extensive backup and recovery procedures to ensure the continuity of our operations in a cyber incident. We also maintain cyber liability insurance coverage as part of our comprehensive risk management program. However, these measures may not be sufficient to prevent, detect, or mitigate the impact of such damage, disruption, or unauthorized access. Moreover, the regulatory environment related to information security, data protection and privacy is increasingly demanding and complex, and compliance with applicable laws and regulations may result in significant costs or require changes in our business practices that could adversely affect our operations.


text: Cybersecurity Governance Our Board of Directors is actively involved in overseeing our cybersecurity risk management. Our Board of Directors delegates certain oversight functions to our Audit Committee, which reviews our cybersecurity policies, procedures, controls and audit results. Our Audit Committee receives quarterly updates on our cybersecurity posture, threats and incidents from Aytu's management. Our Board of Directors and our Audit Committee regularly assess the adequacy of our cybersecurity risk management framework and the effectiveness of our mitigation strategies.


text: Our cybersecurity operations are led by our Chief Financial Officer. He is responsible for overseeing the development and implementation of our cybersecurity strategy, policies, standards and practices. He also oversees our cybersecurity team, which includes a staff member who has over 20 years of experience in the field. Our cybersecurity team monitors, detects, responds and reports on cybersecurity threats and incidents, and coordinates with our internal and external stakeholders to ensure the security of our information assets.


text: Aytu adheres to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0, which provides a set of standards, guidelines and best practices to manage cybersecurity-related risks. We have developed and documented our systems disaster recovery plan, which outlines the roles, responsibilities and procedures for restoring our critical systems and data in the event of a cyber incident. We have also crafted internal policies to help maintain a secure environment, such as our information security policy, our data classification policy, our incident response policy and our password policy. We regularly conduct phishing simulations, vulnerability scans and audits to test the effectiveness of our controls and backups, and to identify and remediate any gaps or weaknesses in our cybersecurity posture.


text: Cybersecurity Incidents Despite our efforts to prevent and mitigate cybersecurity incidents, we cannot guarantee that we, or third-party providers that we rely on, will not experience any breaches, disruptions, or unauthorized access to our information technology systems and networks. During fiscal 2024, we did not experience any cybersecurity incidents that materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, however, there can be no assurance that the measures we have taken to address IT and cybersecurity risks will prove effective in the future. For additional discussion of the IT and cybersecurity risks facing our business, please refer to Part 1, Item 1A, Risk Factors of this Annual Report.


text: We prioritize investment in cybersecurity risk management and governance. We continually assess the adequacy of our resources and capabilities to address emerging threats, regulatory requirements and changes in technology. As cybersecurity threats evolve, we may need to further enhance our processes and technologies, which could require additional financial resources.


text: Risk Management and Strategy As part of our overall enterprise risk management function, we have implemented and currently maintain various information security processes designed to identify, assess and manage material risks related to information technology, including cybersecurity threats to our critical computer networks, third-party hosted services, and our critical data, ("Information Systems"). Our Information Systems risk management process evaluates and mitigates cybersecurity risks in alignment with our business objectives and operational needs.


text: We periodically engage third-party consultants and service providers to obtain an independent assessment regarding internal efforts to prevent threats on our Information Systems. Continuous vigilance over safeguarding the Company's Information Systems have resulted in our current approach and these assessments are shared with our Audit Committee.


text: To mitigate the occurrence of an incident as defined by the Company's formal documentation, which classifies and defines the properties of potential threats, the Company has in place a host of defenses which include, but are not limited to, the use of gateway consoles in all our global locations, limited access to key Information Systems from in-office networks or VPN with multi-factor authentication by means of a third-party mobile identity management tool to limit access to authorized users.


text: Role of the Board The Audit Committee of our Board of Directors (the "Board") has the responsibility for the oversight of risk management, including those risks related to cybersecurity. The Board holds strategic planning sessions with senior management to discuss strategies, key challenges, risks and opportunities for mitigation. The involvement of our Board in setting our business strategy is a key part of its oversight of risk management, its assessment of management's appetite for risk, and its determination of what constitutes an appropriate level of risk for us. Our senior management attends meetings of our Board and its committees on a quarterly basis, and as otherwise needed, and are available to address any questions or concerns raised by our Board on risk management and any other matters.


text: Role of Management Our senior management, with the oversight of the Board, is responsible for the day-to-day management of the material risks the Company faces, including those related to cybersecurity. We believe it is important to work at all levels of the Company's hierarchy to manage cybersecurity risks and threats. Therefore, all users must use an online IT ticketing system, which is monitored around the clock, to report any incidences. Qualified individuals in IT determine what resources to allocate to each case and escalation of an incident, if deemed necessary. The Systems Administrators and IT Director, who has more than 17 years of experience with the Company, communicates on a day-to-day basis with the Chief Financial Officer and President/Chief Operating Officer who would bring any material cybersecurity issues to the attention of the Company's Chief Executive Officer and the Board.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. To this end, our processes are designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems (including such risks associated with the use of any third-party service providers) that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by third-party experts under supervision of management, and, where necessary or desired, include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. We also consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: ReposiTrak, Inc.

ticker: TRAK


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our processes and resources are also designed to help enable us to actively identify, protect, detect, respond to, and recover from risks and threats. Nevertheless, we face certain ongoing cybersecurity risk threats that, if realized, are reasonably likely to materially affect us. As of the date of this report, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition.


text: Third-party experts assist our senior management team in assessing and managing material risks from cybersecurity threats. All employees and consultants are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly discussions with our senior officers and independent registered accounting firm.


text: We believe that information security is a critical component of our business strategy. Therefore, we maintain and continuously assess and strengthen our cyber security program.

companyName: VALUE LINE INC

ticker: VALU


text: Management is responsible for the day-to-day administration of the Company's risk exposures and has adopted a risk management framework including identification, analysis and response to risks affecting our business. The Company has established a committee of senior leaders which is chaired by the Company's Executive Director of Information Technology.


text: We regularly engage third-party services to conduct evaluations of our security controls, which can include penetration testing, independent audits, or consulting on best practices to address new challenges. These evaluations include testing both the design and effectiveness of security controls.


text: We rely on third-party service providers for a variety of services to run our information systems. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. A cyber-attack at a third-party service provider could have a significant impact on our business, and we continuously monitor the risks associated with our service providers.


text: The Audit Committee has responsibility for the oversight of the Company's risk management program, including technology and cybersecurity risks facing the Company. The audit committee receives briefings from management and the executive director of information technology about cybersecurity risk management and the overall technology and cybersecurity environment.


text: We believe that currently we have not encountered a cybersecurity event that has had a material impact on our business. See Item 1A. "Risk Factors" for a discussion of our cybersecurity risks.


text: Risk Management and Strategy As a component of and integrated into our overall risk management strategy and system, we maintain a cybersecurity risk management program designed to assess, identify, manage and protect our information systems and data from unauthorized access, use, disclosure, disruption, modification or destruction. Our program is based on applicable industry frameworks and standards, including those provided by the National Institute of Standards and Technology, and is comprised of core functions to identify, protect, detect, respond to and recover from cybersecurity threats and events. We constantly monitor cybersecurity threats and test the performance and effectiveness of our cybersecurity program, with the assistance of third-party experts, on an annual and ongoing basis. We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments. As described in "Item 1A. Risk Factors" in this Form 10-K, we are subject to risks from cybersecurity threats that could have a material adverse impact on our business and financial results. As of the date of this report, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business, results of operations, financial condition and cash flows.

companyName: INSTEEL INDUSTRIES INC

ticker: IIIN


text: Our Information Services Department manages our cybersecurity risk management program which is overseen by the Vice President of Information Services. The Vice President of Information Services has a master's degree in business administration with a focus on technology and has decades of professional experience in cybersecurity threat assessments and detection, applicable technologies, incident response and employee training. Our Information Services Department includes a team of experienced professionals who have developed an Incident Response Policy that is regularly reviewed and updated. The Incident Response Policy establishes the required steps to assess, respond to and limit the impact of an incident, details tactical and strategic team membership and points of contact related to the response process and provides for escalating notifications to senior executives, including the Chairman of the Board and Chief Executive Officer depending on the severity of the threat.


text: The Board of Directors, having ultimate oversight of the company's cybersecurity risk, receives annual and periodic updates on the cybersecurity program, including those related to material risks and incidents, from the Vice President of Information Services and participates in discussions regarding cybersecurity risks. Cybersecurity information provided to the Board comprises a broad range of topics including, but not limited to, emerging cybersecurity threats, ongoing cybersecurity initiatives, incident reports and compliance with regulatory requirements, industry standards and relevant benchmarking. In addition to Board oversight, we provide mandatory quarterly employee training on how to identify, assess and manage risks from cybersecurity threats.


text: Cybersecurity threats and cybersecurity incidents could adversely affect our business and disrupt our operations. Cybersecurity incidents include an intentional attack or unintentional event allowing unauthorized access to systems impacting the confidentiality, integrity and/or availability of our information sources. Cybersecurity threats are any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or the information therein.

companyName: PROCYON CORP


text: To date, Cybersecurity threats have not had a material impact nor, are they anticipated to significantly affect the Company, including our business strategy, results of operations or financial condition.


text: We rely extensively on information technology (IT) services to conduct our business. We also rely on networks and services, including internet sites, cloud and software solutions, data hosting and processing facilities and tools and other hardware, software and technical applications and platforms to assist in conducting our business.


text: Procyon Corporation has processes in place for identifying, assessing and managing material risks from potential unauthorized access to electronic information held by the Company for business and/or commercial purposes. We have safeguards in place to protect the confidentiality of information residing on the systems that include controls, mechanisms and technologies designed to prevent, detect and/or mitigate data theft or misuse. The data includes proprietary information that we routinely collect, process, store and transmit while conducting business with our customers. We contract third party consultants to assist providing security hardware and software, as well as providing reporting and recommendations to strengthen our systems.


text: As part of our risk management process, cybersecurity risks and mitigations are evaluated by senior leadership and presented to the Board of Directors.


text: As methods of cybersecurity attacks are varied and constantly evolving, we regularly review and update systems, processes and procedures to safeguard against potential threats. However, there is no guarantee that the measures we undertake will be adequate to safeguard against all threats presented; and we may be unable to anticipate these techniques or implement adequate preventative measures. These attacks are also reviewed by our third party consultants.


text: Regulatory requirements related to data privacy and cybersecurity are also changing, presenting new and increasingly rigorous requirements that may be applicable to our business. Implementation of and maintaining compliance with the evolving changes requires significant effort and cost for a company of our size which may limit our ability to comply and our cyber insurance coverage may not be adequate for liabilities or costs actually incurred.


text: The Company has current insurance coverage for Cybersecurity attacks. This coverage however, may not cover be enough to cover substantial attacks, if they occur. We also cannot be certain that insurance will be available to us with reasonable terms or that any insurer will not deny coverage of a future claim. These risks could substantially increase our operating costs, expose us to fraud or theft, subject us to potential liability and disrupt our business.


text: Acceptance of current payment options also subjects us to rules, regulations, contractual obligations and compliance requirements which may change over time or be reinterpreted, making compliance even more difficult, costly or uncertain. We cannot guarantee that our financial results will not be negatively impacted by complying with these requirements.


text: We will continue to mitigate risks by employing physical, administrative and technical measures including employee training, logical access controls, monitoring and testing, and maintenance of protective systems and contingency plans but remain potentially vulnerable to additional known or unknown cybersecurity threats and cannot be assured that the impact from such threats will not be material.


text: Management is in the process of starting an outside third party audit of our systems, to review if there are any improvements needed from either a security aspect or personnel training to safeguard against the internal human factor that can unintentionally cause harm. Management will report on these findings in the future.


text: Managing risk related to cybersecurity is a top priority for Spire, and the Company remains focused on addressing threats that would jeopardize the confidentiality, integrity and availability of stakeholders' information or the ability to continue providing safe and reliable service to customers. To date, Spire has not experienced any material cybersecurity breach that impacts the Company's business strategy, results of operations, or financial condition.

companyName: SPIRE INC

ticker: SR


text: Enterprise risk management (ERM) at Spire oversees significant risks to the Company's ability to successfully execute on strategy and achieve corporate objectives. Spire's ERM is based on a structured, comprehensive process that leverages ISO 31000:2018, adopted and customized to the Company's needs, utilizing an ongoing process of risk identification, evaluation, treatment, integration and monitoring. ERM helps assess priorities and facilitate decision-making for resource allocation as it relates to risk management. Two risks prioritized by our Enterprise Risk Oversight Committee related to cybersecurity are cyber threats and vendor management. Additionally, the ERM process is structured to integrate with operational levels, where risk is managed, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 utilized by the Company's Information Security function for managing cybersecurity.


text: Spire's Board of Directors ("Board") recognizes the significance of cybersecurity risk and has therefore retained oversight of cybersecurity rather than delegating this risk to a committee of the Board. Every regular meeting of the Board includes a cybersecurity report provided by the Company's Chief Information Officer and the Managing Director of Information Security. These reports focus on developments within the Company's cybersecurity program and provide an update on any cybersecurity events or concerns. The Board recently added a new director with expertise in cybersecurity to assist the Board to appropriately oversee the Company's efforts.


text: Spire's cybersecurity program is led by the Chief Information Officer and the Managing Director of Information Security, who together have over 40 years of experience in information technology and cybersecurity, along with a cross-functional team of technology, legal, physical security and risk leaders. Internal Audit provides assurances of risk management activities, including certain third-party cybersecurity activities, such as penetration testing.


text: Strategy/Approach Spire's cybersecurity team developed a five-year strategic roadmap in 2020, which is reviewed and updated annually. A NIST-based maturity assessment is also conducted annually to assess Spire's current maturity level and is used to establish initiatives to drive capabilities in key focus areas. Such initiatives were updated to align with federal security directives issued in 2021, with a key focus on increasing overall visibility into the environment to better correlate potential security related items; completing segregation and dependency from the enterprise and industrial control systems environments; and establishing defined policies and procedures to enhance overall governance and risk management. In addition to these strategic efforts, the Company works closely with federal agencies, including the U.S Department of Homeland Security, TSA and the local FBI chapter, and is actively involved in industry information sharing groups.


text: GLDM also relies on its other service providers, including the Administrator and the Custodians, to implement cybersecurity programs and engage external experts, including cybersecurity assessors, risk management and information technology professionals, attorneys, consultants and auditors to evaluate their cybersecurity measures and risk management processes.

companyName: World Gold Trust

ticker: GLDM


text: The Company's cybersecurity function is staffed with dedicated professionals who continuously monitor risks and evaluate the resiliency and effectiveness of the architecture and defenses within Spire's systems. The Company also maintains policies, procedures and standards to manage conduct within Spire and to be prepared for new cybersecurity threats and events. The cybersecurity program involves a variety of training and education to increase awareness of cybersecurity threats through mandatory annual security awareness training for all employees, quarterly phishing campaigns, and table-top exercises. The Company also engages third parties to evaluate potential risks through external penetration testing to assess the efficacy of systems.


text: Spire maintains business continuity plans to guide the Company's response to a potential cybersecurity event. These plans are regularly reviewed, tested and updated to ensure they meet the evolving needs of the Company in this area. The Company also conducts annual disaster recovery exercises to test the efficacy of core systems in the event of a catastrophic incident.


text: Our Senior Vice President of Information Technology (who is also a certified Chief Information Security Officer) manages our security program. Oversight of the program occurs via IT metrics-based updates provided to an Information Technology Steering team (consisting of the executive officers and other key employees of the Company) on a quarterly basis. Additionally, multiple elements of our cybersecurity security program are tested internally and externally on a bi-yearly basis in alignment with our Sarbanes-Oxley information security controls and we engage independent third parties annually to assess the risks associated with our information technology assets. Our cybersecurity program is part of our enterprise risk management strategy and includes policies and procedures designed to safeguard the confidentiality, integrity, and availability of our information assets. Lastly, a cybersecurity risk assessment is provided to our Board of Directors on an annual basis which includes metrics, security incidents, key risk indicators, and risk mitigation plan as well as on the status of material risks, mitigation measures, and incidents related to such risks. Our Board of Directors has overall responsibility for risk oversight, with the Information Technology Steering team assisting the Board in performing this function based on its respective areas of expertise. As such, the Information Technology Steering team performs materiality determinations of cyber incidents and advises the Board of directors accordingly.

companyName: GEOSPACE TECHNOLOGIES CORP

ticker: GEOS


text: We maintain a comprehensive cybersecurity risk management program that aligns to the National Institute of Standards and Technology (NIST) Cyber Security Framework and adopts a variety of cybersecurity best practices across the enterprise. We leverage industry-leading cybersecurity vendors that provide the following capabilities: Managed Detection and Response (MDR); a Security Operations Center (SOC) that monitors the Company's IT assets on a 24x7x365 basis; tools to interdict emails with phishing links and malware payloads; data leak protection tools that provide real-time interdiction of data transfers outside of normal business usage; vulnerability detection and automated patching tools; firewalls and instruction detection systems; multi-factor authentication mechanisms; mobile device management systems; penetration testing; and various third-party assessments. Our critical IP data is maintained on segmented, access-controlled data stores. We utilize a variety of backup mechanisms for its data including both warm and cold storage solutions. Lastly, we utilize token-based technologies to support Payment Card Industry Data Security Standard (PCI DSS) compliant safe handling and protection of credit card data.


text: We have a defined security policy that is reviewed on an annual basis. We have established response procedures for cyber-security incidents and tests the procedures on a periodic basis. We provide robust computer-based cybersecurity and wire fraud / phishing awareness training to all new employees as well as training to existing employees on an annual basis. We have not experienced material information security incidents in the last three years nor have we incurred any material expenses related to penalties and/or settlements related to a material breach nor have we been materially affected or reasonably likely to have had a material adverse effect on us, our business strategy, results of operations, or financial condition. Nevertheless, we do carry a cybersecurity insurance policy.


text: The Trust does not have any officers, directors or employees. The Sponsor is responsible for the oversight and overall management of the Trust. The Sponsor is an indirect wholly owned subsidiary of the World Gold Council and relies on the World Gold Council's cybersecurity program for its own risk management. The Trust also relies on the cybersecurity programs of its service providers. The Board of Directors of the Sponsor (the "Board of Directors") receives reports from the Sponsor detailing cybersecurity review processes, any potential risks and any incidents which could impact the Trust. The Board of Directors also periodically receives, and reviews reports from the World Gold Council and the Trust's service providers regarding their cybersecurity programs.

companyName: SPDR GOLD TRUST

ticker: GLD


text: As of the date of this report, the Sponsor has not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected, or that the Sponsor believes or are reasonably likely to materially affect, the Trust, including its operations, results of operations, or financial condition.


text: Management ' s Role in Cybersecurity Risk Management The Sponsor conducts annual due diligence on GLDM's service providers, including the Administrator and Custodians, which includes a revise of the relevant service provider's operational and cybersecurity controls. The Sponsor reviews and reports to the Board of Directors, the results of this annual review and any incidents or perceived risks.


text: Cybersecurity Program Overview The World Gold Council has a comprehensive cybersecurity program built around the National Institute of Standards and Technology's Cybersecurity Framework which is overseen by the World Gold Council's Global Head of IT. The program incorporates a variety of strategies and measures aimed at identifying, protecting, detecting, responding to and recovering from cyber incidents. The program's key components include risk assessment and management, where the Operational Risk Committee of the World Gold Council, of which the Principal Financial and Accounting Officer of the Sponsor is a member, identifies potential threats and vulnerabilities and implements appropriate controls to mitigate those vulnerabilities. As part of the program, the World Gold Council (i) develops and enforces security policies and procedures, providing guidelines for safe and secure operations, (ii) prioritizes employee training and awareness, as human error is often a significant factor in security breaches, (iii) conducts regular security audits and assessments to ensure that the program remains effective and up to date with evolving threats, and (iv) incorporates advanced technologies such as identify management, encryption, firewalls, anti-malware and intrusion detection systems to provide multiple layers of defense against cyber-attacks.


text: The World Gold Council has an incident response plan ("IRP") which (i) identifies the incident response team and the roles and responsibilities of the team members, (ii) details the incident response lifecycle, including preparation, detection, response and recovery, and (iii) outlines the internal and external communications plan. The IRP requires any cybersecurity incidents which could impact the Trust to be reported to the Principal Financial and Accounting Officer of the Sponsor.


text: The Trust also relies on its other service providers, including the Trustee and the Custodians, to implement cybersecurity programs and engage external experts, including cybersecurity assessors, risk management and information technology professionals, attorneys, consultants and auditors to evaluate their cybersecurity measures and risk management processes.


text: Management ' s Role in Cybersecurity Risk Management The Sponsor conducts annual due diligence on the Trust's service providers, including the Trustee and Custodians, which includes a review of the relevant service provider's operational and cybersecurity controls. The Sponsor reviews and reports to the Board of Directors, the results of this annual review and any incidents or perceived risks.


text: Board Oversight of Cybersecurity Risks The Board of Directors receives a report from the Sponsor detailing the Sponsor's annual due diligence on the Trust's service providers, including a summary of any potential operational risks and any incidents which could impact the Trust. The Board of Directors also periodically receives reports from the World Gold Council and the Trust's service providers regarding their cybersecurity programs.


text: GLDM does not have any officers, directors or employees. The Sponsor is responsible for the oversight and overall management of GLDM. The Sponsor is an indirect wholly owned subsidiary of the World Gold Council and relies on the World Gold Council's cybersecurity program for its own risk management. GLDM also relies on the cybersecurity programs of its service providers. The Board of Directors of the Sponsor (the "Board of Directors") receives reports from the Sponsor detailing the Sponsor's cybersecurity review processes, any potential risks and any incidents which could impact GLDM. The Board of Directors also periodically receives, and reviews reports from the World Gold Council and GLDM's service providers regarding their cybersecurity programs.


text: As of the date of this report, the Sponsor has not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected, or that the Sponsor believes are reasonably likely to materially affect, GLDM, including its operations, results of operations, or financial condition. See "Risk Factors" in Part I, Item 1A of this Annual Report for a discussion of the risks related to cybersecurity.


text: Cybersecurity Program Overview The World Gold Council has a comprehensive cybersecurity program built around the National Institute of Standards and Technology's Cybersecurity Framework which is overseen by the World Gold Council's Global Head of IT. The program incorporates a variety of strategies and measures aimed at identifying, protecting, detecting, responding to and recovering from cyber incidents. The program's key components include risk assessment and management, where the Operational Risk Committe of the World Gold Council, of which the Principal Financial and Accounting Officer of the Sponsor is a member, identifies potential threats and vulnerabilities and implements appropriate controls to mitigate those vulnerabilities. As part of the program, the World Gold Council (1) develops and enforces security policies and procedures, providing guidelines for safe and secure operations, (2) prioritizes employee training and awareness, as human error is often a significant factor in security breaches, (3) conducts regular security audits and assessments to ensure that the program remains effective and up to date with evolving threats, and (4) incorporates advanced technologies such as identify management, encryption, firewalls, anti-malware and intrusion detection systems to provide multiple layers of defense against cyber-attacks.


text: The World Gold Council has an incident response plan ("IRP") which (1) identifies the incident response team and the roles and responsibilities of the team members, (2) details the incident response lifecycle, including preparation, detection, response and recovery, and (3) outlines the internal and external communications plan. The IRP requires any cybersecurity incidents which could impact GLDM to be reported to the Principal Financial and Accounting Officer of the Sponsor.


text: Board Oversight of Cybersecurity Risks The Board of Directors receives a report from the Sponsor detailing the Sponsor's annual due diligence on GLDM's service providers, including a summary of any potential operational or cybersecurity risks and any incidents which could impact GLDM. The Board of Directors also periodically receives reports from World Gold Council and GLDM's service providers regarding their cybersecurity programs.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Cyclo Therapeutics, Inc.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Vice President of Finance, who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings integrated into new employee onboarding processes and annual employee re-training.


text: We engage consultants, experts, or other third parties in connection with our risk assessment processes. These third parties assist us in designing and implementing our cybersecurity policies and procedures, as well as in monitoring and testing our safeguards.


text: We require each third-party service provider who may have access to our systems and/or our sensitive data to confirm that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: We have not experienced any cybersecurity incidents that have been determined to be material in the past, however, like other life sciences technology companies, we have experienced cybersecurity incidents and may continue to experience them in the future. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including, for example, the risk factor entitled " Our business and operations would suffer in the event of computer system failures or security breaches.."


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole.


text: Our Vice President of Finance and our management committee on cybersecurity, which includes our Chief Financial Officer and outside consultants, who collectively possess significant experience in evaluating, managing and mitigating security and other risks, including cybersecurity risks, are primarily responsible to assess and manage our material risks from cybersecurity threats.


text: Our Vice President of Finance and our management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Vice President of Finance and representatives from our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: monitoring of Company computer and information systems for potential malware, ransomware and other malicious activity, and remediation of identified issues, including mitigation of identified risks and containment and elimination of any malicious software; mandatory cybersecurity training as part of new employee onboarding along with required annual employee cybersecurity re-training; monitoring of systems and network infrastructure by security information and event management application;


text: prompt incident reporting directly to the Company's CFO l; and escalation to the Company's audit committee and board of directors as warranted based upon the nature of the identified issue.


text: Cybersecurity Risk Management and Strategy Our enterprise risk management process includes an evaluation of cybersecurity risk together with other company risks. The Company has established a cybersecurity risk management program (the "program") designed to assess, identify, and manage material cybersecurity risks. Our program is designed based on industry best practices and is aligned with the core components of frameworks established by the National Institute of Standards and Technology (NIST), Center for Internet Security (CIS) and International Organization for Standardization (ISO).

companyName: J&J SNACK FOODS CORP

ticker: JJSF


text: An annual risk assessment is performed to identify internal and external cybersecurity threats and vulnerabilities, assess the likelihood and potential impact of such threats and vulnerabilities, and prioritize the risks from such threats and vulnerabilities. The results of the risk assessment, along with professional judgment, are used to develop and implement cybersecurity risk mitigation strategies and controls.


text: A cybersecurity incident response plan that outlines a structured approach to investigating, containing, documenting, and mitigating cybersecurity incidents, including reporting findings and keeping senior management, the Audit Committee, and other key stakeholders informed and involved as appropriate; Annual external penetration testing to identify vulnerabilities, assess perimeter security, improve incident response, and strengthen security policies and procedures; Regular phishing, social engineering, and cybersecurity awareness training for employees with access to the Company's information technology environment;


text: Annual tabletop exercises to test incident response plans, improve communication and coordination between relevant employees, and identify gaps to inform needed adjustments to plans;


text: Ongoing risk assessments of third-party service providers designed to ensure they meet the Company's standards for reliability, security, compliance, and performance.


text: Third-party service providers are used in various capacities as part of our cybersecurity risk management program, including performing risk mitigation controls and providing cloud-based, cybersecurity services and platforms. For example, third-party service providers are used to conduct our external penetration testing, as well as assist the Company in detecting, responding, and mitigating cybersecurity incidents. The Company uses a variety of processes to oversee and identify material risks from cybersecurity threats associated with the use of third-party service providers. Third-party service providers are required to complete a detailed questionnaire, which is used to identify and assess material cybersecurity risks. In addition, the Company performs an annual review of independent attestation reports of the third-party service providers' control environments designed to ensure that the controls meet Company security requirements and that any identified issues in the independent attestation reports do not present material cybersecurity risks to the Company.


text: To date, we have not identified any cybersecurity threats or incidents which have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition; however, there is no guarantee that we will not be the subject of future successful cybersecurity threats or incidents that may materially and adversely affect the Company, including its business strategy, financial condition, results of operations or prospects. Additional information on cybersecurity-related risks is discussed under the heading "Risks Associated with our Information Technology Systems" under Item 1A, which should be read in conjunction with Item 1C.


text: Cybersecurity Governance Our Board of Directors has delegated oversight responsibilities for enterprise risk, including cybersecurity risk, to the Audit Committee. The Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") provide periodic updates to the Audit Committee regarding the Company's cybersecurity risk management program. The Company has a cybersecurity incident response plan that includes a process to evaluate cybersecurity incidents for materiality. The escalation protocol includes reporting potentially material cybersecurity incidents to senior members of management for further evaluation. Any cybersecurity incident determined to have a material impact on the Company is timely reported to the Audit Committee.


text: The CISO has primary responsibility for the development, operation, and maintenance of our cybersecurity risk management program. Our CISO has 25 years of experience in information technology and cybersecurity generally, which has been gained from a combination of education, including relevant degrees, and prior work experience.


text: We have implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is an element of and is integrated into our overall enterprise risk management program, and is a key component of our annual organizational risk assessment. Our cybersecurity risk management program is based in part on, and incorporates elements of, the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Azenta, Inc.

ticker: AZTA


text: Our cybersecurity risk management program utilizes a variety of technical and process controls that are designed to identify, protect against, detect, respond to, and recover from cybersecurity threats, including: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment;


text: a security team that is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and policies, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; cybersecurity awareness training for our employees, incident response personnel, and senior management; assessment of material cybersecurity risks posed by third-party service providers, including risks to employee, customer and financial information; a cybersecurity incident response protocol that includes procedures for responding to cybersecurity incidents; and business continuity plans.


text: As part of the above processes, we engage, as necessary, consultants and other third parties, to review our cybersecurity incidents if material to help quantify the impact and identify areas for continued focus, improvement, and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to confidential, proprietary, personal, or employee data, or to our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits or audits for System and Organization Controls (SOC) compliance.


text: We have been, and expect to continue to be, subject to cybersecurity risks and incidents related to our business. We have not experienced any material cybersecurity incidents during the last fiscal year. For more information about the cybersecurity risks we face, see Item 1A – Risk Factors of this Annual Report on Form 10-K.


text: Our Board considers cybersecurity risk as part of its enterprise risk management oversight function. The Board delegates oversight of the cybersecurity risk management program to the Audit Committee. This oversight includes periodic reports from management concerning cybersecurity related risks. The management of the program is the responsibility of our Risk Management Committee, comprised of our Chief Financial Officer, Chief Digital & Information Officer, Chief Accounting Officer and General Counsel. Our Chief Digital & Information Officer, who has over 30 years of extensive work experience in the field of technology and cybersecurity, leads our team of cybersecurity professionals and provides the Risk Management Committee with periodic reports on our cybersecurity risks and any material cybersecurity incidents. Our team of cybersecurity professionals monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through the cybersecurity risk management and processes described above, including the operation of our incident response plan. The Risk Management Committee provides updates to the Audit Committee on our cybersecurity risk management program as appropriate, including updates on (1) any critical cybersecurity risks; (2) ongoing cybersecurity initiatives and strategies; (3) applicable regulatory requirements; and (4) industry standards. The Risk Management Committee also notifies the Board of any significant and/or material cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.


text: Risk Management and Strategy In an effort to mitigate cyber intrusions, the Company has implemented a cybersecurity program intended to protect and preserve the integrity, confidentiality and reliability of data and systems. Cybersecurity risks are a key component of the Company's overall risk management, is integrated into other corporate processes and goes beyond the Company to certain vendors or suppliers. The Company has instituted certain cybersecurity requirements, interacted with various external organizations including its state regulator, and participated in proprietary briefings by industry experts to maintain an awareness of current cybersecurity threats and vulnerabilities.

companyName: RGC RESOURCES INC

ticker: RGCO


text: We utilize third party security firms and consultants to test our cybersecurity control environment and to provide certain security measures that we use to protect our information technology environment, including to detect and filter external phishing and malware threats, to provide enhanced endpoint protection and to protect our data through data classification. We have developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.

companyName: Natural Grocers by Vitamin Cottage, Inc.

ticker: NGVC


text: We have prepared a written incident response plan and crisis management plan to enhance our ability to respond to cybersecurity incidents. We periodically conduct internal tabletop exercises to enhance incident response preparedness. Our employees are required to participate in regular cybersecurity awareness trainings upon hiring and on a quarterly basis thereafter.