text: Our board of directors oversees our risk management process, including as it pertains to material risks from cybersecurity threats, directly and through its committees. Board of directors' meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from the CIO on our enterprise risk profile on an annual basis. The board of directors reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents. The board of directors plans, however, to delegate to its Audit Committee in the near future specific responsibility for overseeing our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe, including specific responsibility for overseeing material cybersecurity risk exposures. Specifically, the Audit Committee will be responsible for establishing risk tolerance guidelines around our cybersecurity posture, risk assessment, strategy and mitigation and for making recommendations related to the protection or privacy of our critical systems and data, and will take over the board of directors' functions in this regard as described above. The board of directors will continue to meet, at least annually, with members of our ACT to review and discuss our cybersecurity program, including areas of material risk and how these risks, which may include cybersecurity risk, are being managed and reported to the board of directors and its committees.


text: Management ' s Role. Our ELT team is composed of several support teams that address and respond to cyber risk, including cyber risks related to security architecture and engineering, identity and access management and security operations. The ACT oversees compliance with our cybersecurity framework within the organization and facilitates cybersecurity risk management activities throughout the organization. The ACT also assists with the review and approval of policies, completes benchmarking against applicable standards, maintains a cyber risk registrar and oversees the security awareness program.

companyName: QXO, Inc.

ticker: QXO

secItem: Item 1C


text: Our ACT reports to our CIO. Our CIO reports to our CTO who in turn, reports to our CEO who, in turn, reports to our Board of Directors. Our CIO has 30 years of experience in leading global security functions and strategies. Collectively, the other members of our ACT and SOT relevant education and experience and maintain a wide range of industry certifications. We invest in regular, ongoing cybersecurity training for our ACT and SOT.


text: JAKKS has implemented cybersecurity policies, processes and procedures to aid in the identification, protection, detection of cyber related issues, and the response to and recovery from cybersecurity breaches. A summary of the principal activities JAKKS has undertaken to strengthen its cybersecurity posture and mitigate its cybersecurity risks:

companyName: JAKKS PACIFIC INC

ticker: JAKK


text: A subcommittee of the Board of Directors has been established to oversee and manage the company's risk, response, and recovery policies, processes, and procedures related to, and stemming from, cyber-related issues; Purchased cybersecurity risk insurance to protect against potential losses arising from a cybersecurity incident; Implementation of quarterly vulnerability and penetration tests to identify, and if necessary, remediate, any potential risk to the organization;


text: Engaged two (2) third-party service providers to monitor JAKKS systems for anomalous activity (24 hours a day, 365 days a year); Conduct disaster recovery exercise on a yearly basis;


text: Implemented a revised and updated phishing email training program; and Retained a consultant to act as the Company's Virtual Chief Information Security Officer (VCISO), who has more than 20 years of experience in various cybersecurity roles (e.g., managing information security, developing cybersecurity strategies, implementing cybersecurity and incident response programs, etc.) to oversee the implementation and performance of the Company's cybersecurity program.


text: As part of our cybersecurity program, the Company's VCISO, Senior Vice President of Operations and Vice President of Information Technology, collectively referred to as our "Cybersecurity Team," reviews our cybersecurity posture, identifies areas in need of improvement, and helps foster a culture of compliance (including training of all employees). Our Vice President of Information Technology has over 20 years of experience in various roles involving managing information security, developing cybersecurity strategy, and implementing cybersecurity program. The Company's program also includes activities to respond to and recover from cybersecurity incidents, including processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: Our Cybersecurity Team assesses cybersecurity risks, including those related to our supply chain and third-party service providers that have access to our systems or facilities where JAKKS' data is stored. The team assesses how cybersecurity risks affect or are reasonably likely to materially affect the Company, including our operations or financial position. Our Cybersecurity Team is responsible for the Company's risk assessment, risk management, disaster recovery, and auditing of JAKKS overall cybersecurity program. The Cybersecurity Team meets with the Cybersecurity Subcommittee of the Board of Directors to discuss, identify, and address cybersecurity risks and review updates to our risk management program to ensure cybersecurity risks to the organization are mitigated. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors beginning on page 22 of the section entitled "Item 1A. Risk Factors" in this Form 10-K.


text: In December 2022, the Company learned of a cybersecurity threat to its information technology system ("IT System"), and that certain data, including personal data of employees, had been extracted from the Company's IT System. Upon learning of the cybersecurity threat, the Company launched an investigation and undertook prompt action, including employing containment protocols to mitigate the impact of the threat, engaging third-party information technology cyber security and forensics experts and special legal counsel, and utilizing additional security measures to help safeguard the integrity of its IT System's infrastructure and the data contained therein. The Company has not identified any material damage suffered from the incident.


text: Our cybersecurity risks include theft of business data, fraud or extortion, lack of access to our information systems, harm to employees, harm to business partners, violation of privacy laws, potential reputational damage, and litigation or other legal risk if a cybersecurity incident were to occur. It is difficult to assign a monetary materiality assessment to these risks or to the impact if we were to sustain a breach of our systems. Our approach is based on the premise that any cybersecurity incident could result in material harm to the Company.

companyName: INNOVATIVE FOOD HOLDINGS INC

ticker: IVFH


text: We utilize Information Technology Associates ("ITA"), an outsourced IT provider which has been designated with oversight responsibility for our cybersecurity risks. ITA possesses a deep understanding of our information technology systems, including methods to manage and monitor cybersecurity risks. It also provides active monitoring and risk assessments of cybersecurity threats and communicates such threats to our Company. Low risk threats are communicated to our systems analysts, and high risk threats are first communicated to Bill Bennett (our CEO and director), Brady Smallwood (our COO and director), and Gary Schubert, our CFO, and are then discussed with our board of directors.


text: We conduct annual assessments of risks posed by cybersecurity threats in conjunction with our insurance renewal cycles. This includes a thorough review of our systems and vulnerabilities. As a result of these assessments, we have implemented tools and practices to proactively monitor our systems and user accounts including, but not limited to, deploying solutions to constantly monitor users accessing systems, implementation of two factor authentication for logins, and improved rules for password maintenance. Additionally, we require our associates to complete cybersecurity awareness training provided by NINJIO.


text: Like many companies, we make use of cloud-based solutions provided by several large service providers for critical information technology infrastructure such as email and file storage. We do not maintain stand-alone servers for our emails. However, we do maintain a standalone server for our main enterprise resource planning (ERP) program (Great Plains), and we maintain two servers dedicated to processing orders for Artisan Specialty Foods and Food Innovations, Inc. We also maintain a file server that currently houses approximately one terabyte of data. Each of our servers is protected by firewall and two-factor-authentication. Additionally, we take multiple snapshots of our servers several times throughout the day and store encrypted backups of our data both locally and in a cloud server to mitigate loss in the event of any malicious attacks on these resources. In the normal course of our relationships with the providers of our services not controlled in-house, we regularly monitor their message boards and other formal and informal communications channels for signs of breaches of their systems. We also survey available public information for indications that they have suffered a breach of their systems.


text: We have processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into our overall risk management systems, as overseen by our Board, primarily through its audit committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. We conduct risk assessments of certain third-party providers before engagement and have established monitoring procedures in an effort to assess and mitigate potential data security exposures originating from third parties. We from time to time engages third-party consultants, legal advisors, and audit firms in evaluating and testing our risk management systems and assessing and remediating certain potential cybersecurity incidents as appropriate.

companyName: RYVYL Inc.

ticker: RVYL


text: Board of Directors The audit committee of our Board oversees, among other things, the adequacy and effectiveness of our internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in our disclosure controls and procedures. Further, at least once per quarter, our management team reports on cybersecurity matters, including material risks and threats, to the audit committee, and the audit committee provides updates to the Board at regular Board meetings. Our management team also provides updates annually or more frequently as appropriate to the Board.


text: Under the oversight of the audit committee of the Board, and as directed by our Chief Executive Officer ("CEO") and Chief Operating Officer ("COO"), the Head of IT is primarily responsible for the assessment and management of material cybersecurity risks and the Company's annual security audits to meet the payment industry expectations. Our management team holds a regular cybersecurity and business continuity reviews to evaluate data security exposures, control effectiveness and necessary remediation actions. The Head of IT is also supported by a third-party IT consulting services provider who helps oversee our IT systems and provides cross-functional support for cybersecurity risk management and facilitates the response to any cybersecurity incidents.


text: Our Head of IT oversees our cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats. Our Head of IT also coordinates with our legal counsel and third parties, such as consultants and legal advisors, to assess and manage material risks from cybersecurity threats. Our management team is informed about the effectiveness of the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes.


text: Our audit committee is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. Our Head of IT, or a delegate, informs the COO of certain cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in our incident response plan and related processes. The COO is also primarily responsible for advising our CEO and Chief Financial Officer regarding cybersecurity disclosures in public filings. The COO also notifies the audit committee chair of any material cybersecurity incidents.


text: As of the date of this Report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor included in the section entitled "Item 1A. Risk Factors" in this Report.


text: Cybersecurity Risk Management Cybersecurity is critical to supporting our business and protecting our customers in an increasingly complex environment. We face a variety of cybersecurity threats including attacks that are common to most industries, such as ransomware and denial-of-service, as well as attacks from advanced and highly organized adversaries targeting financial services companies. Our information systems have from time to time experienced such attacks despite our best efforts to prevent them. Our customers, suppliers, and other third parties also face similar cybersecurity threats, and a cybersecurity incident impacting any party could have a material impact on our operations, performance, or operating results. None of these threats or incidents have to date materially affected our business strategy, results of operations, or financial condition. However, we cannot assure that any future security breaches will not occur or that any such events that have occurred or may occur in the future will not result in material harm to our business, operations, reputation or profitability. These threats and related risks highlight the importance of allocating resources to protect the Company and our customers. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors, of this Form 10-K.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: The Company maintains a formal Information Security Program that includes risk assessments regularly conducted by internal resources as well as third-party experts. These assessments are used to evaluate potential security threats that may have a negative impact on the organization, detect potential vulnerabilities and mitigate any identified security risks. Our program leverages industry standards and frameworks and is designed to protect the confidentiality, integrity, and availability of our information assets and systems.


text: The Information Security Program is led by the Chief Information Security Officer ("CISO"), who reports to the Chief Executive Officer. The CISO has oversight of the Company's risk management framework, which includes the Information Security Program. The CISO provides program oversight and direction, including adjustments in response to changes in technology, threats, business processes, and regulatory or statutory requirements. The CISO works collaboratively with information technology staff, operational management, counterparts at third-party vendors and functional stakeholders to implement a program designed to protect our information systems from cybersecurity threats and promptly respond to potential cybersecurity incidents. The CISO has over 20 years of experience in the fields of information technology and cybersecurity and maintains multiple professional cybersecurity certifications.


text: Incident Monitoring and Response. We have 24x7 security cybersecurity monitoring, which utilizes both third-party cybersecurity experts and leading tools to monitor activity in our information systems. We also maintain an incident response plan and playbooks that define our response to a cybersecurity incident, including a cross-functional incident response process that includes key stakeholders such as senior leaders and legal, and leverages our technological resources and third-party service providers. Through ongoing communication with these teams, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and reports such incidents to leadership when appropriate pursuant to internal guidelines governing the reporting of such events.


text: Threat and Vulnerability Management. We maintain a threat and vulnerability management program that leverages multiple data sources to proactively identify, assess, and mitigate changing cybersecurity risks. This program incorporates vulnerability scanning and threat intelligence capabilities, which are in place to help safeguard information assets. We also share and receive threat intelligence with government agencies, the Financial Services Information Sharing and Analysis Center ("FS-ISAC") and cybersecurity vendors and leaders in the cybersecurity industry.


text: Infrastructure and Data Protection. We have technical and organizational safeguards that are designed to protect our networks, systems, and data from cybersecurity threats, including: firewalls, intrusion prevention and detection systems, network and endpoint anti-malware protections, and access controls such as privileged access management. Our information security and information technology teams collaborate regularly to assess the security of current and future infrastructure changes.


text: Third-Party Risk Management. We run a third-party risk management program designed to identify and manage risks, including cybersecurity risks, involving our third-party providers. This includes performing due diligence and assessment of each provider's cybersecurity posture as well as periodic re-assessments.


text: Security Training and Awareness. We provide ongoing education and training to employees regarding cybersecurity threats and the role they play in helping prevent and detect these threats. This includes regular phishing simulations, with training provided for any failures, as well as periodic communications via the internal company portal concerning threats, best practices, and technology changes to improve security. We also work with the Company marketing department to periodically publish articles on our website to raise security awareness with our customers.


text: While we maintain teams that specialize in cybersecurity and information technology, we also leverage third-party experts to provide objective feedback on our program and posture. These are accomplished via penetration tests, security posture assessments, and technology consulting. These independent evaluations help validate existing controls, identify potential focus areas, and aid in securely deploying technology in an increasingly complex environment.


text: Our Information Security Program is evaluated regularly by both the internal audit function as well as third-party audit firms. These audits help ensure our program is appropriate to address the changing threat landscape and aligns to industry standards such as the National Institute of Standards and Technology Cybersecurity Framework, as well as other legal and regulatory guidance including the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool, the Bankers Electronic Crimes Taskforce Ransomware Self-Assessment Tool, and the Gramm-Leach-Bliley Act. Controls are reviewed for adequacy and design at least annually, and both internal and third-party audits aid in identifying areas for continued focus, providing assurance that controls are appropriately designed and operating effectively. Additionally, we meet regularly with examiners from the Office of the Comptroller of the Currency to review our cybersecurity program and discuss the changing threat landscape.


text: Our cybersecurity personnel maintain current knowledge through training, obtaining professional certifications, and participation in industry groups such as FS-ISAC, American Bankers Association, and the Texas Bankers Association. Company cybersecurity personnel expand and test their knowledge of cyber threats and countermeasures through additional on-the-job training and periodic simulated exercises to practice their response to real-life threats. We maintain a training budget, and personnel are encouraged to obtain formal training and industry-approved certifications as appropriate for their roles and responsibilities.


text: The Technology Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Security Officer provides quarterly reports to the Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Technology Committee of our board of directors reviews and approves our information security and technology budgets and strategies at least annually. Additionally, the Technology Committee of our board of directors reviews our cyber security risk profile on at least an annual basis.


text: Cyber Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. Our approach to cybersecurity risk management is aligned with our risk profile and business.

companyName: Pioneer Green Farms, Inc.


text: We intend to leverage the support of third-party information technology and security providers, including to perform a risk assessment designed to identify, assess, and manage cybersecurity risks. Further, we will develop a formal, documented process to assess the data protection practices of certain third-party vendors that may handle sensitive information on our behalf.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Governance Related to Cybersecurity Risks Our Board of Directors is responsible for the strategic leadership and direction of our cybersecurity program. Our Board has oversight over cybersecurity risks. Our management may provide periodic presentations to the Board on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable.


text: Risk Management and Strategy The Company's cybersecurity risk management program is integrated into the overall risk management framework, including risk identification, assessment, and mitigation across all business areas. We have collaborated with external consultants and built a cybersecurity program designed to protect and safeguard the integrity of our information systems, which aligns with industry best practices and regulatory requirements. To continually enhance the effectiveness of the practice, we regularly assess the program's measures, contractual obligations, and compliance with industry standards. Additionally, we maintain cyber insurance coverage, including protection against social engineering fraud, to further mitigate potential financial losses from cybersecurity incidents.

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT


text: We have previously experienced actual or attempted cyber-attacks on our information systems or networks; however, none of these incidents had a material impact on our operations or financial condition. For additional information on the impact of cyber risks, refer to Part I, Item 1A. Risk Factors on page 13.


text: The board of directors oversees the Company's practice for assessing, identifying and managing material risks from cybersecurity threats. The Audit Committee, consisting of all of the board's independent directors with one member holding the CERT Certificate in Cybersecurity Oversight, reviews and discusses with management and the independent auditor on the Company's significant financial risk exposures for matters related to cybersecurity risk, including the steps management has taken to monitor and manage such exposures.


text: The Company's Chief Information Officer leads the overall cybersecurity strategy and risk management program. This includes overseeing risk assessments, developing security policies and procedures, and managing the IT security team. Senior executives, including the Company's CEO and CFO, integrate cybersecurity risks into the overall business strategy and financial planning. The IT department executes daily security tasks such as vulnerability scanning, threat detection, and incident response. The Chief Information Officer and IT security team provide regular reports to senior management on the Company's cybersecurity posture, identified vulnerabilities, and ongoing incident management activities. Management provides the Audit Committee with quarterly updates on the Company's cybersecurity practices.


companyName: Cannaisseur Group Inc.

ticker: TCRG


text: Governance Related to Cybersecurity Risks Our Board of Directors is responsible for the strategic leadership and direction of our cybersecurity program. Our Board has oversight over cybersecurity risks. Our management provides periodic presentations to the Board on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable.


text: Risk Management and Strategy We recognize the importance of maintaining the trust and confidence of our customers, business partners, and employees, and cybersecurity represents an important component of our overall approach to enterprise risk management. Our approach to cybersecurity risk management is aligned with our risk profile and business, and includes efforts towards meeting the standards for an organization of our size and type in conjunction with the National Institute of Standards and Technology. We also utilize a third-party IT vendor to manage the technological security and efficacy of our systems, including a Virtual Chief Information Officer, a Virtual Chief Information Security Officer, and other IT specialists who manage our IT and cybersecurity needs.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: Our cybersecurity risk management is designed to employ technology and security practices across our operations and business functions, including vulnerability assessments, detecting and responding to cyber security incidents, cybersecurity crisis preparedness and incident response resources, vulnerability scans and IT security risk assessments, and progressive investments in cybersecurity infrastructure and technology designed to reduce cybersecurity risks. Notable aspects of our cybersecurity risk management include: efforts towards adoption of the National Institute of Standards and Technology (NIST), Cybersecurity Framework; periodic IT risk assessments conducted by an external cybersecurity consultant; enterprise-wide security and privacy measures; IT security, cybercrime, privacy, and HIPAA security training provided to employees and independent contractors; periodic social engineering and phishing testing for employees; encrypted and air-gapped data backups; periodic dark web monitoring and vulnerability scans; and periodic review of disaster preparedness, incident response, and business continuity plans.


text: We intend to continue to leverage the support of third-party information technology and security providers, including to perform risk assessments designed to identify, assess, and manage cybersecurity risks. We assess on an ad hoc basis the data protection practices of certain of our third-party vendors who handle our data, which assessments include the assessment of vendor data protection policies, disclosure of changes to data protection policies or practices, maintenance of cyber liability insurance, and provision of certifications, assessments, or other documentation as deemed relevant.


text: As of the date of this annual report, we maintain cyber liability insurance that provides cyber incident response coverage. However, costs, damages, and remediation associated with cybersecurity incidents may not be adequately insured under our insurance policy and may be subject to applicable deductibles, to the extent that they are covered. See also " We could lose cyber liability insurance coverage and be subject to uninsured liabilities " in Item 1A, Risk Factors, of this annual report for additional discussion of risks related to our cyber liability insurance.


text: As previously disclosed, in fiscal 2023, Fortra, LLC, the third-party vendor that provides the GoAnywhere managed file transfer as a service system (MFTaaS), experienced a data security incident that affected many of Fortra's customers, including us. We use GoAnywhere as a means by which our customers electronically share certain data regarding their employees and other third parties with us. Our understanding is that this activity was the result of the threat actor's exploit of a zero-day vulnerability in Fortra's systems. Based on the information we have obtained from Fortra and our own diligence, we understand that this activity only affected Fortra's systems, and did not involve unauthorized access to our information systems. However, the threat actor in this incident accessed certain of our customers' employees' and other third parties' data and such data included protected health information, as defined by the Health Insurance Portability and Accountability Act, and personally identifiable information. We have engaged outside experts to assist in investigating and responding to this incident and have provided the required notifications to the data owners, and where appropriate, to the individuals affected by the incident and to various State Attorneys General.


text: As of the date of this annual report, this incident has not had a materially adverse impact on our results of operations. Though our response has not included material changes to our cyber risk management, strategy, or governance, we have taken or plan to take additional cybersecurity measures to continue to advance our cybersecurity policies, practices, and technology. We have incurred expenses, and may incur in the future expenses and losses, related to this incident. See also the risks included below the heading " Cybersecurity, Information Technology and Outsourced Services Related Risks " in Item 1A, Risk Factors, of this annual report for additional discussion of risks related to cybersecurity.


text: Our entire board of directors is responsible for the strategic leadership and direction of our cybersecurity program and has oversight over cybersecurity risks. Our management may provide periodic presentations to the board on our cybersecurity program, including updates on cybersecurity risks, strategy and incident management, as applicable. Our cybersecurity risk management is also administrated at a management level through a multi-disciplinary Technology Business Review Committee comprised of members of our operational and organizational management, as well as our outsourced Virtual Chief Information Officer. The Technology Business Review Committee is tasked with identifying and monitoring what we believe to be the key technology risks currently facing the Company, including cybersecurity risks. The committee meets on at least a quarterly basis and on an as-needed basis to address risks, regulatory requirements, potential threats, vulnerabilities, available mitigation strategies and technologies, operational imperatives and changes, and progress updates on relevant projects related to our IT and cybersecurity.


text: In addition, we undergo an annual IT risk assessment reviewed by a third-party IT vendor, with significant or actionable findings reported to the Technology Business Review Committee. The annual IT risk assessment identifies our risk status on various IT security metrics and prioritizes remediation, external vulnerability scan results, patching reports, dark web status, and personnel IT security training reports. This annual third-party review helps further monitor and inform our Technology Business Review Committee's work and our cybersecurity risk management and strategy.


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our Board and our management actively oversee our risk management program, including the management of cybersecurity risks. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that the Company's sustained investment in people and technologies have contributed to a culture of continuous improvement that has put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Vado Corp.


text: Risk Management and Strategy At a high level, the key objectives for the Company's cybersecurity program are to implement and sustain effective security controls to stop intrusion attempts and to maintain and continuously improve its ability to respond to attacks and incidents. Success in achieving these objectives relies upon using quality technology solutions, cultivating and maintaining a team of skilled professionals, and improving processes continuously. Our cybersecurity program in particular focuses on the following key areas:


text: Risk Assessment: At least annually, we conduct a cybersecurity risk assessment that takes into account information from our employees, known information security vulnerabilities, and information from external sources, including reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants. The results of the assessment, which also includes findings from our automated vulnerability scanning tools, are used to regularly update our security protocols, develop initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader Company-wide risk assessment. These updates and initiatives are then reported to our Board and members of management. While there is no documented process for cataloging all digital assets and data, all information is backed up and saved automatically in our Google Suite.


text: Technical Safeguards: We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: Incident Response and Recovery Planning: We have established comprehensive incident response and recovery plans that guide our response in the event of a cybersecurity incident.


text: Third Party Risk Management: We have implemented a third party risk management program, which is designed to identify and mitigate cybersecurity threats associated with our use of third party collaborators. Such collaborators are subject to security risk assessments at the time of onboarding and contract renewal, based on established cybersecurity standards that both parties review to ensure an industry-standard level of security is achieved. However, there is no periodic review process in place for assessing vendor compliance with our cybersecurity standards. We use a variety of inputs in such risk assessments, including information supplied by collaborators in response to detailed questionnaires and meetings as well as information from third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party collaborators, as appropriate.


text: Education and Awareness: Our policies encourage each of our employees to contribute to our data security efforts. We provide comprehensive training resources, ensuring that each team member is equipped with the knowledge to protect our organization against cyber threats. However, the completion and understanding of this training is not mandatory for all employees. We regularly remind employees of the importance of handling and protecting data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. In this regard, the Company has implemented policies and procedures for all employees including: (i) information security/cybersecurity policies, which are internally available for all employees, (ii) information security/cybersecurity awareness training; (iii) a clear escalation process which employees can follow in the event an employee notices something suspicious; and (iv) ensuring that information security/cybersecurity is part of the employee performance evaluation and/or disciplinary process.


text: Cybersecurity Risk Management and Strategy The Company does not have its own cybersecurity policy but relies on the policies and procedures of its Contract Research Organizations (CROs) and Software as a Service (SaaS) contractors that handle its data and software. We are committed to protecting the confidentiality, integrity, and availability of our information assets and complying with applicable laws and regulations regarding cybersecurity.

companyName: Mitesco, Inc.

ticker: MITI


text: Cybersecurity Risks and Incidents The Company faces various cybersecurity risks and threats that could potentially affect its operations, reputation, financial condition, and competitive position. These risks and threats include, but are not limited to, unauthorized access, use, disclosure, modification, or destruction of our data, systems, or networks; denial of service attacks; malware infections; phishing or social engineering attacks; ransomware attacks; loss or theft of devices or media containing our data; human error or negligence; natural disasters; power outages; or sabotage. Our data and systems may also be subject to cybersecurity breaches or incidents at its CROs, vendors, partners, or other third parties that we interact with or rely on.


text: We have not experienced any material cybersecurity breaches or incidents to date, but we cannot guarantee that we will not suffer any such breaches or incidents in the future. We may not be able to detect, prevent, or respond to all cybersecurity risks and threats in a timely or effective manner. We may also incur significant costs and liabilities as a result of any cybersecurity breaches or incidents, such as legal claims, regulatory fines, remediation expenses, reputational damage, loss of business opportunities, or competitive disadvantage. We may also face litigation, investigations, or enforcement actions by governmental authorities, customers, shareholders, or other parties arising from any cybersecurity breaches or incidents.


text: Cybersecurity Policies and Procedures The Company does not have its own cybersecurity policy, but it contracts with CROs that handle all of its data and software. Our CRO's data systems are 21 CFR 11 (Part 11) compliant, which means that they have implemented controls to ensure the reliability and integrity of electronic records and signatures. Our CRO also runs industry standard antivirus and antimalware software on their networks and have written procedures for cybersecurity management, incident response, backup and recovery, and employee training. We have reviewed the cybersecurity policies and procedures of our CRO and require them to report any cybersecurity breaches or incidents that may affect our data or systems.


text: All of the software that we use is Commercial Off the Shelf Software (COTS) and Microsoft, Dropbox, and Google cloud services. We do not develop, modify, or customize any software for our own use. We rely on the cybersecurity measures and practices of our software and cloud service providers and update our software and systems regularly to address any known vulnerabilities or issues. We also limit the access and use of our software and cloud services to authorized personnel and encourage them to use strong passwords and multifactor authentication. We do not store any sensitive or confidential data on our own devices or media, but use password-protected cloud storage.


text: Cybersecurity Oversight and Governance The Company's management is responsible for overseeing and managing our cybersecurity risks and activities as part of its overall risk assessment portfolio. Our management regularly evaluates and reviews the Company's cybersecurity posture and performance and reports to the board of directors on any material cybersecurity matters or developments. Our management also coordinates with our CROs, vendors, partners, and other third parties to ensure that they comply with our cybersecurity expectations and requirements and to address any cybersecurity issues or concerns that may arise.


text: The Company's board of directors is responsible for overseeing and approving our cybersecurity strategy and policies. Our board of directors receives updates from management on the Company's cybersecurity status and initiatives and provides guidance and feedback on the cybersecurity goals and objectives. Our board of directors also monitors the Company's cybersecurity risks and exposures and ensures that the company has adequate cybersecurity resources and capabilities to protect its data and systems.


text: The Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed and assessed our cybersecurity risk based on the Payment Card Industry Data Security Standard (PCI DSS). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: Risk assessments are designed to help identify material cybersecurity risks to our critical systems and information.


text: A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents.


text: The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls. Cybersecurity awareness training of our employees, including our incident response personnel. A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Company's Chief Executive Officer and Chief Financial Officer, whom oversee management's implementation of our cybersecurity risk management program and incident response plans.


text: Our management team and incident response team have overall responsibility for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants that conduct vulnerability scans on a quarterly basis per PCI DSS standards. While cyber-attacks are common threats to all businesses, the Company did not experience a material cyber security incident in either fiscal year 2024 or 2023.


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk Management and Strategy At IGC, we are committed to maintaining the confidentiality, integrity, and availability of our information systems and data. As part of this commitment, we have implemented a comprehensive cybersecurity program to protect against unauthorized access, use, disclosure, modification, or destruction of our information assets. We are committed to ensuring the security and protection of our company's information assets and the personal information of our employees, customers, and stakeholders.

companyName: IGC Pharma, Inc.

ticker: IGC


text: We recognize that cybersecurity threats are constantly evolving and have the potential to cause significant harm to our company and our stakeholders. In order to address these risks, we have established a cybersecurity risk management framework that is aligned with industry best practices and regulatory requirements.


text: Our program includes regular risk assessments, vulnerability management, access controls, incident response planning, and employee training and awareness programs. We also work closely with third-party service providers to ensure that they are meeting our cybersecurity standards.


text: Although there can be no assurance, that our cybersecurity program will prevent all incidents. In the event of a cybersecurity incident, we have established procedures for prompt investigation, containment, and remediation to minimize the impact on our operations and stakeholders. We believe that our cybersecurity program is robust and effective, and we will continue to invest in and improve our capabilities to address evolving threats. We are committed to transparency and will provide updates on any material cybersecurity incidents that may impact our company or our stakeholders.


text: During Fiscal year ended March 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our IT Lead. Our IT Lead has 11 years of experience in roles that include oversight of cybersecurity risk management programs. In addition, the IT Lead is assisted by an external agency with about 8 years of expertise in cybersecurity.


text: Our IT Lead is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the CEO, who help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee for certain cybersecurity incidents.


text: The audit committee will receive periodic reports from our management concerning cybersecurity issues, including certain threats and risks and the processes the Company has implemented to address them, as applicable. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial.

companyName: TEL INSTRUMENT ELECTRONICS CORP

ticker: TIKK


text: Risk Management and Strategy We believe cybersecurity is critical to our mission achievement to ensure uninterrupted business continuity, and enables us to deliver superior services while safeguarding our customers' sensitive information.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: Our cybersecurity risk management processes are integrated into our overall risk management strategy. As part of our risk management strategy, our cybersecurity framework encompasses the following key processes:


text: Risk-Based Controls for Information Systems: We maintain an Information Technology (IT) infrastructure with physical, administrative, and technical controls tailored to protect the confidentiality, integrity, and availability of our information and systems.


text: Cybersecurity Incident Response Plan and Testing: We have an incident response plan supported by a dedicated team to address cybersecurity incidents. This includes vulnerability identification, initial assessment, and engagement of external experts as needed.


text: Training Initiatives: We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities at FEI. We also provide additional role-based training to employees based on customer requirements, regulatory obligations and industry risks as needed.


text: Third-Party Assessments: We engage cybersecurity firms to regularly evaluate our cybersecurity posture, helping identify and mitigate risks posed by evolving threats.


text: We continually strengthen our cybersecurity defenses through significant investments in resources and maintaining comprehensive cybersecurity insurance coverage. We maintain an insider threat detection program to proactively identify and mitigate both external and internal threats in a timely manner.


text: We rely on certain third party service providers to assist us with the delivery of our products to our customers. A cybersecurity incident at a supplier or subcontractor could materially adversely impact us. Therefore, we evaluate third party providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture through a questionnaire. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.] Our adherence to Defense Federal Acquisition Regulation Supplement (DFARS) and Cybersecurity Maturity Model Certification (CMMC) requirements ensures strict protection of Controlled Unclassified Information (CUI), mandated by the U.S. Department of Defense. These efforts underscore our unwavering commitment to maintaining the highest cybersecurity resilience standards and regulatory compliance.


text: As a U.S. Government defense industry contractor, we have experienced cybersecurity attacks and may be subject to significant cybersecurity attacks in the future. To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. For additional information, see "Our business could be adversely impacted by significant cybersecurity attacks" in Item 1A. Risk Factors above.


text: The full Board of Directors has overall responsibility for overseeing the cybersecurity processes of identifying and mitigating cybersecurity risks. The Board of Directors has not delegated this responsibility to any one Committee, as its structure and size allows for the entire Board of Directors to oversee this responsibility. Periodically, our management provides updates to the Board of Directors regarding our internal control program, including any significant changes to its IT infrastructure and/or cybersecurity program. Management also communicates directly with the Board of Directors to report any material risks from cybersecurity threats.


text: Our Chief Information Officer (CIO) leads our cybersecurity program and reports directly to our Chief Executive Officer. Our CIO is supported by our internal IT team that assists our CIO in the day-to-day management of the cybersecurity program, including the cybersecurity incident response plan, training initiatives and third-party assessments. Our CIO has over two decades of experience in various cybersecurity functions, including implementing stringent cybersecurity measures to protect sensitive information and meet established security standards, extensive work in IT governance and operations, network intrusion and critical systems protection, Enterprise Resource Planning (ERP) systems, and data analytics.


text: The Company has engaged a third-party service provider, Computer Repair Services of Nevada ("CRSN") to assist it in protecting against Cybersecurity risks. CSRN has installed anti-virus and other risk protection software on Company IT systems and keeps these protections updated. The Company also has a written cybersecurity policy that all employees are required to follow that requires employees to maintain strong password control, protect Company devices, avoid suspicious links in emails, and utilize social media only with the consent of their manager, among other things.

companyName: CLS Holdings USA, Inc.


text: The Company has not suffered any cybersecurity incidents that would affect its financial condition or results of operations. If a cyber breach were to occur, the management team is required to report it to the executive team (Joseph Ramalho, Charlene Magee, and Jamie Dickson) who would then inform CRSN and Andrew Glashow. Mr. Glashow would then inform the Board if necessary.


text: As a smaller reporting company with limited business, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. As of the date of this report, we have not adopted an incident response plan as our only access to internet is the use of email account by large websites such as google and yahoo. Our business is managed by only one person, Mr. Umesh Patel, our Chief Executive Office, Chief Financial Officer and director and he is the person oversea our cybersecurity as well. We have a small board with two members including Mr. Patel, who will report and discuss the updates on cybersecurity matters, including material risks and threats to another non-executive director of the board.

companyName: FUSE GROUP HOLDING INC.

ticker: FUST


text: Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of business information, result in litigation costs and negatively impact our reputation among customers and partners.


text: As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors in Item 1A. Risk Factors in this report.


text: As a publicly traded company, the Company recognized the critical importance of effective cybersecurity risk management to safeguard our operations, protect sensitive information and ensure the trust of the Company's customers and stakeholders.

companyName: America Great Health


text: Risk Management & Strategy The Company is in the process of maintaining a robust cybersecurity risk management program designed to assess, identify and manage material risks from cybersecurity threats, which encompasses these areas: risk assessment, incident detection and response, third-party risk, governance, board of directors' oversight, and management's role in managing cybersecurity risk.


text: JAKKS has implemented cybersecurity policies, processes and procedures to aid in the identification, protection, detection of cyber related issues, and the response to and recovery from cybersecurity breaches. A summary of the principal activities JAKKS has undertaken to strengthen its cybersecurity posture and mitigate its cybersecurity risks:

companyName: JAKKS PACIFIC INC


text: A subcommittee of the Board of Directors has been established to oversee and manage the company's risk, response, and recovery policies, processes, and procedures related to, and stemming from, cyber-related issues; Purchased cybersecurity risk insurance to protect against potential losses arising from a cybersecurity incident; Implementation of quarterly vulnerability and penetration tests to identify, and if necessary, remediate, any potential risk to the organization;


text: Engaged two (2) third-party service providers to continuously monitor JAKKS systems for anomalous activity (24 hours a day, 365 days a year); Conduct disaster recovery exercise on a yearly basis;


text: Implemented a revised and updated phishing email training program; and Retained a consultant to act as the Company's Virtual Chief Information Security Officer (VCISO), who has more than 20 years of experience in various cybersecurity roles (e.g., managing information security, developing cybersecurity strategies, implementing cybersecurity and incident response programs, etc.) to oversee the implementation and performance of the Company's cybersecurity program.


text: As part of our cybersecurity program, the Company's VCISO, Senior Vice President of Operations and Vice President of Information Technology, collectively referred to as our "Cybersecurity Team," reviews our cybersecurity posture, identifies areas in need of improvement, and helps foster a culture of compliance (including training of all employees). Our Vice President of Information Technology has over 20 years of experience in various roles involving managing information security, developing cybersecurity strategy, and implementing cybersecurity program. The Company's program also includes activities to respond to and recover from cybersecurity incidents, including processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: Our Cybersecurity Team assesses cybersecurity risks, including those related to our supply chain and third-party service providers that have access to our systems or facilities where JAKKS' data is stored. The team assesses how cybersecurity risks affect or are reasonably likely to materially affect the Company, including our operations or financial position. Our Cybersecurity Team is responsible for the Company's risk assessment, risk management, disaster recovery, and auditing of JAKKS overall cybersecurity program. The Cybersecurity Team meets with the Cybersecurity Subcommittee of the Board of Directors to discuss, identify, and address cybersecurity risks and review updates to our risk management program to ensure cybersecurity risks to the organization are mitigated. For further discussion of the risks associated with cybersecurity incidents, see In December 2022, the Company learned of a cybersecurity threat to its information technology system ("IT System"), and that certain data, including personal data of employees, had been extracted from the Company's IT System. Upon learning of the cybersecurity threat, the Company launched an investigation and undertook prompt action, including employing containment protocols to mitigate the impact of the threat, engaging third-party information technology cyber security and forensics experts and special legal counsel, and utilizing additional security measures to help safeguard the integrity of its IT System's infrastructure and the data contained therein. The Company has not identified any material damage suffered from the incident.


text: recognize the importance of maintaining the trust and confidence of our customers, business partners, and employees, and cybersecurity represents an important component of our overall approach to enterprise risk management. Our approach to cybersecurity risk management is aligned with our risk profile and business, and includes efforts towards meeting the standards for an organization of our size and type in conjunction with the National Institute of Standards and Technology. We also utilize a third-party IT vendor to manage the technological security and efficacy of our systems, including a Virtual Chief Information Officer, a Virtual Chief Information Security Officer, and other IT specialists who manage our IT and cybersecurity needs. In April 2024, the Company engaged the services of a cybersecurity company that works in conjunction with our managed IT vendor to provide additional cybersecurity management.


text: cybersecurity risk management is designed to employ technology and security practices across our operations and business functions, including vulnerability assessments, detecting and responding to cybersecurity incidents, cybersecurity crisis preparedness and incident response resources, vulnerability scans and IT security risk assessments, and progressive investments in cybersecurity infrastructure and technology designed to reduce cybersecurity risks. Notable aspects of our cybersecurity risk management include: efforts towards adoption of the National Institute of Standards and Technology (NIST) Cybersecurity periodic IT risk assessments conducted by an external cybersecurity consultant; management; Information Event Management (SEIM) and Security Operation Center Incident Response; management; security and privacy measures;


text: security, cybercrime, privacy, and HIPAA security training provided to employees and independent review of disaster preparedness, incident response, and business continuity plans with cybersecurity intend to continue to leverage the support of third-party information technology and security providers, including to perform risk assessments designed to identify, assess, and manage cybersecurity risks. We assess on an ad-hoc basis the data protection practices of certain of our third-party vendors who handle our data, which assessments include the assessment of vendor data protection policies, disclosure of changes to data protection policies or practices, maintenance of cyber liability insurance, and provision of certifications, assessments, or other documentation as deemed relevant.


text: date of this annual report, we maintain cyber liability insurance that provides cyber incident response coverage. However, costs, damages, and remediation associated with cybersecurity incidents may not be adequately insured under our insurance policy and may be subject to applicable deductibles, to the extent that they are covered. See also " We cannot assure that we can maintain cyber liability insurance coverage and we could be subject to uninsured liabilities. " in Item 1A, Risk Factors, of this annual report for additional discussion of risks related to our cyber liability insurance.


text: previously disclosed, in fiscal year 2023, Fortra, LLC, the third-party vendor that provides the GoAnywhere managed file transfer as a service system (MFTaaS), experienced a data security incident that affected many of Fortra's customers, including us. We use GoAnywhere as a means by which our customers electronically share certain data regarding their employees and other third parties with us. Our understanding is that this activity was the result of the threat actor's exploit of a zero-day vulnerability in Fortra's systems. Based on the information we have obtained from Fortra and our own diligence, we understand that this activity only affected Fortra's systems, and did not involve unauthorized access to our information systems. However, the threat actor in this incident accessed certain of our customers' employees' and other third parties' data and such data included protected health information, as defined by the Health Insurance Portability and Accountability Act, and personally identifiable information. We engaged outside experts to assist in investigating and responding to this incident and have provided the required notifications to the data owners, and where appropriate, to the individuals affected by the incident and to various State Attorneys General.


text: of the date of this annual report, this incident has not had a materially adverse impact on our results of operations and the matter was closed in 2024. Though our response has not included material changes to our cyber risk management, strategy, or governance, we have taken or plan to take additional cybersecurity measures to continue to advance our cybersecurity policies, practices, and technology.


text: We have incurred expenses, and may incur in the future expenses and losses related to this incident. See also the risks included below the heading " Cybersecurity, Information Technology and Outsourced Services Related Risks " in Item 1A, Risk Factors, of this annual report for additional discussion of risks related to cybersecurity.


text: entire board of directors is responsible for the strategic leadership and direction of our cybersecurity program and has oversight over cybersecurity risks. Our management may provide periodic presentations to the board on our cybersecurity program, including updates on cybersecurity risks, strategy and incident management, as applicable. Our cybersecurity risk management is also administrated at a management level through a multi-disciplinary Technology Business Review Committee comprised of members of our operational and organizational management, as well as our outsourced Virtual Chief Information Officer. The Technology Business Review Committee is tasked with identifying and monitoring what we believe to be the key technology risks currently facing the Company, including cybersecurity risks. The committee meets on at least a quarterly basis and on an as-needed basis to address risks, regulatory requirements, potential threats, vulnerabilities, available mitigation strategies and technologies, operational imperatives and changes, and progress updates on relevant projects related to our IT and cybersecurity.


text: addition, we undergo an annual IT risk assessment reviewed by a third-party IT vendor, with significant or actionable findings reported to the Technology Business Review Committee. The annual IT risk assessment identifies our risk status on various IT security metrics and prioritizes remediation, external vulnerability scan results, patching reports, dark web status, and personnel IT security training reports. This annual third-party review helps further monitor and inform our Technology Business Review Committee's work and our cybersecurity risk management and strategy.


text: cybersecurity risks include theft of business data, fraud or extortion, lack of access to our information systems, harm to employees, harm to business partners, violation of privacy laws, potential reputational damage, and litigation or other legal risk if a cybersecurity incident were to occur. It is difficult to assign a monetary materiality assessment to these risks or to the impact if we were to sustain a breach of our systems. Our approach is based on the premise that any cybersecurity incident could result in material harm to the Company.

companyName: INNOVATIVE FOOD HOLDINGS INC


text: utilize Information Technology Associates ("ITA"), an outsourced IT provider which has been designated with oversight responsibility for our cybersecurity risks. ITA possesses a deep understanding of our information technology systems, including methods to manage and monitor cybersecurity risks. It also provides active monitoring and risk assessments of cybersecurity threats and communicates such threats to our Company. Low risk threats are communicated to our systems analysts, and high risk threats are first communicated to Bill Bennett (our CEO and director), Brady Smallwood (our COO and director), and Gary Schubert, our CFO, and are then discussed with our board of conduct annual assessments of risks posed by cybersecurity threats in conjunction with our insurance renewal cycles. This includes a thorough review of our systems and vulnerabilities. As a result of these assessments, we have implemented tools and practices to proactively monitor our systems and user accounts including, but not limited to, deploying solutions to constantly monitor users accessing systems, implementation of two factor authentication for logins, and improved rules for password maintenance. Additionally, we require our associates to complete cybersecurity awareness training provided by NINJIO.


text: many companies, we make use of cloud-based solutions provided by several large service providers for critical information technology infrastructure such as email and file storage. We do not maintain stand-alone servers for our emails. However, we do maintain a standalone server for our main enterprise resource planning (ERP) program (Great Plains), and we maintain two servers dedicated to processing orders for Artisan Specialty Foods and Food Innovations, Inc. We also maintain a file server that currently houses approximately one terabyte of data. Each of our servers is protected by firewall and two-factor-authentication. Additionally, we take multiple snapshots of our servers several times throughout the day and store encrypted backups of our data both locally and in a cloud server to mitigate loss in the event of any malicious attacks on these resources. In the normal course of our relationships with the providers of our services not controlled in-house, we regularly monitor their message boards and other formal and informal communications channels for signs of breaches of their systems. We also survey available public information for indications that they have suffered a breach of their systems.


text: Risk Management and Strategy recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. Our approach to cybersecurity risk management is aligned with our risk profile and business.


text: intend to leverage the support of third-party information technology and security providers, including to perform a risk assessment designed to identify, assess, and manage cybersecurity risks. Further, we will develop a formal, documented process to assess the data protection practices of certain third-party vendors that may handle sensitive information on our behalf.


text: risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, please see the section Governance Related to Cybersecurity Risks


text: Board of Directors is responsible for the strategic leadership and direction of our cybersecurity program. Our Board has oversight over cybersecurity risks. Our management provides periodic presentations to the Board on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable.


text: Management and Strategy have no employees. Our business is externally managed by the Advisor, an affiliate of the Sponsor. We are dependent on the Advisor and affiliates of our Sponsor (collectively, the "Advisor and its affiliates") for performing a full range of services that are essential to us, including asset management, property management (excluding our hospitality properties, each of which are managed by an unrelated third party property manager) and acquisition, disposition and financing activities, and other general administrative responsibilities; such as tax, accounting, legal, information technology ("IT") and investor relations services. As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Advisor and its affiliates, which determine and implement appropriate risk management processes and strategies as it relates to cybersecurity for both us and the other entities they advise, own and/or manage, and we rely on the them for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Lightstone Value Plus REIT II, Inc.


text: Advisor and its affiliates take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout their operations that are designed to address cybersecurity threats and incidents. The Advisor and its affiliates regularly assess risks from cybersecurity threats, monitor their information systems for potential vulnerabilities, and test those systems according to their cybersecurity policies, standards, processes, and practices, which are integrated into their overall approach to enterprise risk management. To protect their information systems from cybersecurity threats, the Advisor and its affiliates use various security tools that help them identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.


text: Advisor and its affiliates have a technology team, under the leadership of the Director of Information Technology, who has over 20 years of technology management experience, which defines a work plan designed to maintain strong cybersecurity maturity, sets improvement objectives of key controls and systems, including feedback from third-party assessments, and identifies and implements on-going investments to replace or upgrade systems or technologies and proactively maintain strong security. As part of this planning, management conducts regular testing of our incident response plan to increase awareness, establishes key decision-making criteria, ensures effective communication among key stakeholders, and complies with the Company's disclosure obligations.


text: Advisor and its affiliates also partner with independent third-party experts to provide a comprehensive cybersecurity solution that safeguards organizations against a broad spectrum of cyber threats. This comprehensive cybersecurity solution offers advanced threat detection, prevention, and response capabilities, including real-time monitoring, threat intelligence, behavioral analysis, endpoint detection and response, malware prevention, and automated response actions. Additionally, the comprehensive cybersecurity solution also provides access to cybersecurity experts, who provide proactive threat monitoring and incident response support to effectively detect, investigate, and remediate security incidents.


text: Advisor and its affiliates engage vendors to enhance cybersecurity safeguards and improve incident response and update or replace systems and applications as appropriate to improve data processing and storage management and enhance security. These cybersecurity safeguards include multi-tiered backup protocols, which incorporate immutable backups, embody an innovative approach to data security, providing an additional barrier against ransomware and other cyber threats. Immutable backups ensure that data remains unmodifiable and immune to deletion for a predefined duration, thereby shielding it from unauthorized tampering or access. This technology utilizes sophisticated methods, including immutable storage repositories and ransomware-resistant backup architectures, to uphold the integrity and accessibility of vital data. Through the enforcement of stringent access controls and encryption measures, the resilience and availability of backup data is ensured, empowering an organization to swiftly and securely recover from cyber incidents.


text: further protect their information systems, the Advisor and its affiliates structure and monitor relationships with various third-party service providers and periodically conduct due diligence on their cybersecurity architecture and process design.


text: date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, our business strategy, results of operations, or financial condition.


text: Board of Directors oversees our risk management process, including cybersecurity risks. The Audit Committee oversees our enterprise risk assessment. The Audit Committee meetings include discussions of specific risk areas, including, among others, those relating to cybersecurity.


text: Our management team, including our Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Financial Officer has primary responsibility for our overall cybersecurity risk management program.


text: Director of Information Technology is responsible for leading the assessment and management of cybersecurity threats. We have implemented a governance program for our cybersecurity efforts. This includes regularly updating privacy notices, terms of use, and lease documents.


text: The Advisor and its affiliates have developed and implemented policies to identify and mitigate cybersecurity risks and provide training to their employees at onboarding and thereafter as necessary. Such updates are communicated to all their employees, and actionable guidance is provided when new risks arise.


companyName: Lightstone Value Plus REIT III, Inc.


text: Advisor and its affiliates have a technology team, under the leadership of the Director of Information Technology, who has over 20 years of technology management experience, which defines a work plan designed to maintain strong cybersecurity maturity, sets improvement objectives of key controls and systems, including feedback from third-party assessments, and identifies and implements on-going investments to replace or upgrade systems or technologies and proactively maintain strong security.


text: As part of this planning, management conducts regular testing of our incident response plan to increase awareness, establishes key decision-making criteria, ensures effective communication among key stakeholders, and complies with our disclosure obligations.


text: further protect their information systems, the Advisor and its affiliates structure and monitor relationships with various third-party service providers and periodically conduct due diligence on their cybersecurity architecture date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, our business strategy, results of operations, or financial condition.


text: Board of Directors oversees our risk management process, including cybersecurity risks. The Audit Committee oversees our enterprise risk assessment. The Audit Committee's meetings include discussions of specific risk areas, including, among others, those relating to cybersecurity. Our management team, including our Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Financial Officer has primary responsibility for our overall cybersecurity risk management program.


companyName: Lightstone Value Plus REIT IV, Inc.

ticker: LTSV


text: Advisor and its affiliates have a technology team, under the leadership of the Director of Information Technology, who has over 20 years of technology management experience, which defines a work plan designed to maintain strong cybersecurity maturity, sets improvement objectives of key controls and systems, including feedback from third-party assessments, and identifies and implements on-going investments to replace or upgrade systems or technologies and proactively maintain strong security. As part of this planning, management conducts regular testing of our incident response plan to increase awareness, establishes key decision-making criteria, ensures effective communication among key stakeholders, and complies with our disclosure obligations.


text: Management and Strategy have no employees. Our business is externally managed by the Advisor, an affiliate of Lightstone. We are dependent on the Advisor and affiliates of Lightstone (collectively, the "Advisor and its affiliates") for performing a full range of services that are essential to us, including asset management, property management (excluding our hospitality properties, each of which are managed by an unrelated third party property manager) and acquisition, disposition and financing activities, and other general administrative responsibilities; such as tax, accounting, legal, information technology ("IT") and investor relations services. As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Advisor and its affiliates, which determine and implement appropriate risk management processes and strategies as it relates to cybersecurity for both us and the other entities they advise, own and/or manage, and we rely on the them for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Lightstone Value Plus REIT V, Inc.


text: have processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into our overall risk management systems, as overseen by our Board, primarily through its audit committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. We conduct risk assessments of certain third-party providers before engagement and have established monitoring procedures in an effort to assess and mitigate potential data security exposures originating from third parties. We from time to time engages third-party consultants, legal advisors, and audit firms in evaluating and testing our risk management systems and assessing and remediating certain potential cybersecurity incidents as appropriate.

companyName: RYVYL Inc.


text: audit committee of our Board oversees, among other things, the adequacy and effectiveness of our internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria, as set forth in our disclosure controls and procedures. Further, at least once per year, our management team reports on cybersecurity matters, including material risks and threats, to the audit committee, and the audit committee provides updates to the Board at regular Board meetings. Our management team also provides updates annually or more frequently as appropriate to the Board.


text: the oversight of the audit committee of the Board, and as directed by our Chief Executive Officer ("CEO"), the Head of IT is primarily responsible for the assessment and management of material cybersecurity risks and the Company's annual security audits to meet the payment industry expectations. Our management team holds a regular cybersecurity and business continuity reviews to evaluate data security exposures, control effectiveness and necessary remediation actions. The Head of IT is also supported by a third-party IT consulting services provider who helps oversee our IT systems and provides cross-functional support for cybersecurity risk management and facilitates the response to any cybersecurity incidents.


text: Head of IT oversees our cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats. Our Head of IT also coordinates with our legal counsel and third parties, such as consultants and legal advisors, to assess and manage material risks from cybersecurity threats. Our management team is informed about the effectiveness of the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes.


text: audit committee is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. Our Head of IT, or a delegate, informs the CEO of certain cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in our incident response plan and related processes. The CEO is also primarily responsible for advising our Chief Financial Officer regarding cybersecurity disclosures in public filings. The CEO also notifies the audit committee chair of any material cybersecurity incidents.


text: of the date of this Report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor included in the section entitled "Item 1A. Risk Factors" in this Report.


text: Impact of Cybersecurity Threats Our results of operations and financial condition have not been materially affected by cybersecurity threats or incidents to date. However, to assess, identify, and manage material risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we have invested and expect to continue to invest significant resources to sustain and enhance our information security and controls or to investigate and mitigate security vulnerabilities.


text: Although we believe that we maintain a robust program of information security and controls and that none of the cybersecurity incidents that we have encountered to date have materially affected us, we cannot be certain that the security measures and procedures we have in place to detect security incidents and protect sensitive data will be successful or sufficient to counter all current and emerging risks and threats. The impact of a material cybersecurity incident involving our systems and data, or those of our clients, partners or vendors, could have a material adverse effect on our business strategy, results of operations and financial condition.


text: have no employees. Our business is externally managed by the Advisor, an affiliate of the Sponsor. We are dependent on the Advisor and affiliates of our Sponsor (collectively, the "Advisor and its affiliates") for performing a full range of services that are essential to us, including asset management, property management (excluding our hospitality property, which is managed by unrelated third party property managers) and acquisition, disposition and financing activities, and other general administrative responsibilities; such as tax, accounting, legal, information technology ("IT") and investor relations services. As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Advisor and its affiliates, which determine and implement appropriate risk management processes and strategies as it relates to cybersecurity for both us and the other entities they advise, own and/or manage, and we rely on them for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Lightstone Value Plus REIT I, Inc.


text: Advisor and its affiliates take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout their operations that are designed to address cybersecurity threats and incidents. The Advisor and its affiliates regularly assess risks from cybersecurity threats, monitor their information systems for potential vulnerabilities, and test those systems according to their cybersecurity policies, standards, processes, and practices, which are integrated into their overall approach to enterprise risk management. To protect their information systems from cybersecurity threats, the Advisor and its affiliates use various security tools that help them identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.


text: Advisor and its affiliates also partner with independent third-party experts to provide a comprehensive cybersecurity solution that safeguards organizations against a broad spectrum of cyber threats. This comprehensive cybersecurity solution offers advanced threat detection, prevention, and response capabilities, including real-time monitoring, threat intelligence, behavioral analysis, endpoint detection and response, malware prevention, and automated response actions. Additionally, the comprehensive cybersecurity solution also provides access to cybersecurity experts, who provide proactive threat monitoring and incident response support to effectively detect, investigate, and remediate security incidents.


text: Advisor and its affiliates engage vendors to enhance cybersecurity safeguards and improve incident response and update or replace systems and applications as appropriate to improve data processing and storage management and enhance security. These cybersecurity safeguards include multi-tiered backup protocols, which incorporate immutable backups, embody an innovative approach to data security, providing an additional barrier against ransomware and other cyber threats. Immutable backups ensure that data remains unmodifiable and immune to deletion for a predefined duration, thereby shielding it from unauthorized tampering or access. This technology utilizes sophisticated methods, including immutable storage repositories and ransomware-resistant backup architectures, to uphold the integrity and accessibility of vital data. Through the enforcement of stringent access controls and encryption measures, the resilience and availability of backup data is ensured, empowering an organization to swiftly and securely recover from cyber incidents.


text: further protect their information systems, the Advisor and its affiliates structure and monitor relationships with various third-party service providers and periodically conduct due diligence on their cybersecurity architecture and process design.


text: date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, our business strategy, results of operations, or financial condition.


text: Board of Directors oversees our risk management process, including cybersecurity risks. The Audit Committee oversees our enterprise risk assessment. The Audit Committee's meetings include discussions of specific risk areas, including, among others, those relating to cybersecurity. Our management team, including our Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Financial Officer has primary responsibility for our overall cybersecurity risk management program.


text: Director of Information Technology is responsible for leading the assessment and management of cybersecurity threats. We have implemented a governance program for our cybersecurity efforts. This includes regularly updating privacy notices, terms of use, and lease documents.


text: The Advisor and its affiliates have developed and implemented policies to identify and mitigate cybersecurity risks and provide training to their employees at onboarding and thereafter as necessary. Such updates are communicated to all their employees, and actionable guidance is provided when new risks arise.


text: Cybersecurity is critical to supporting our business and protecting our customers in an increasingly complex environment. We face a variety of cybersecurity threats including attacks that are common to most industries, such as ransomware and denial-of-service, as well as attacks from advanced and highly organized adversaries targeting financial services companies. Our information systems have from time to time experienced such attacks despite our best efforts to prevent them. Our customers, suppliers, and other third parties also face similar cybersecurity threats, and a cybersecurity incident impacting any party could have a material impact on our operations, performance, or operating results. None of these threats or incidents have to date materially affected our business strategy, results of operations, or financial condition. However, we cannot assure that any future security breaches will not occur or that any such events that have occurred or may occur in the future will not result in material harm to our business, operations, reputation or profitability. These threats and related risks highlight the importance of allocating resources to protect the Company and our customers. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors, of

companyName: Tectonic Financial, Inc.


text: The Company maintains a formal Information Security Program that includes risk assessments regularly conducted by internal resources as well as third-party experts.


text: These assessments are used to evaluate potential security threats that may have a negative impact on the organization, detect potential vulnerabilities and mitigate any identified security risks. Our program leverages industry standards and frameworks and is designed to protect the confidentiality, integrity, and availability of our information assets and systems.