text: Security assessments of all third -party providers proportional to the risks present, before or soon after engagement, and periodically thereafter Contractual requirements for security and privacy protections Continuous monitoring of critical third -party services Incident response coordination with key vendors Regular audits of third -party security controls for those handling sensitive data Before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, we conduct thorough information security assessments. All third parties with access to our information systems must review and acknowledge our acceptable use policy before access is granted.


text: Incident Response and Business Continuity We maintain a formal incident response plan with clearly defined roles, responsibilities, and procedures for: Identifying a cybersecurity incident Assessing its nature and scope Minimizing and containing the impact

companyName: Guerrilla RF, Inc.

ticker: GUER

secItem: Item 1C


text: Investigating the root cause Communication and reporting to stakeholders Recovering and restoring affected systems Our incident response procedures include escalation protocols to notify appropriate members of senior and executive management, the Board, and regulatory authorities in a timely manner based on the criticality of the cybersecurity incident. We conduct regular tabletop exercises and simulations to test the effectiveness of our response capabilities.


text: We also maintain business continuity and disaster recovery plans to ensure operational resilience in the event of a significant cybersecurity incident. These plans are regularly tested and updated based on lessons learned from exercises and actual incidents.


text: Cybersecurity Governance and Personnel The Audit Committee of our Board of Directors provides oversight of our cybersecurity program. The committee receives annual briefings from IT management on:


text: The state of our cybersecurity program Significant security incidents and their resolution Results of security assessments and audits Progress on security initiatives and investments Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our Senior Vice-President of IT, who has over 20 years of experience in information technology and cybersecurity, including a Bachelor of Science degree. Our SVP of IT reports directly to our Chief Executive Officer on a monthly basis and is responsible for updates to the Audit Committee regarding our cybersecurity posture and initiatives.


text: Our IT department includes staff members who hold certifications in security, networking, and systems administration. This team of qualified professionals works collaboratively to implement and maintain our comprehensive cybersecurity program. Their specialized expertise is supplemented by strategic partnerships with third -party security providers who hold additional industry-recognized certifications such as CISSP, CISM, CEH, and CompTIA Security+.


text: Managing incident response Providing regular reports to senior management and the Audit Committee In the event of a material cybersecurity incident, our SVP of IT is responsible for promptly reporting to the CEO and the Audit Committee. A special meeting of the Audit Committee or full Board may be convened as necessary to address significant cybersecurity matters.


text: Material Incidents As of December 31, 2024, we have not experienced any cybersecurity incidents that have materially affected our operations, business strategy, financial condition, or financial results. Our management has assessed known cybersecurity incidents for potential materiality and disclosure using formal documented processes.


text: While we have implemented extensive measures to fortify our defenses against cyber threats, it is important to acknowledge that the cybersecurity landscape is constantly evolving, with threat actors employing increasingly sophisticated tactics. Despite our best efforts, we cannot guarantee that our systems will be completely immune to cyber attacks. We remain vigilant in our efforts to protect our systems and data and continue to invest in our cybersecurity program to address emerging threats.


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board. Our cybersecurity policies, standards and practices follow recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We generally approach cybersecurity threats through a cross-functional, multilayered methodology, with specific the goals of: (i) identifying, preventing and mitigating cybersecurity threats to us; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our tenants, vendors and airport partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Sky Harbour Group Corp

ticker: SKYH


text: Risk Management and Strategy Consistent with overall ERM policies and practices, our cybersecurity program focuses on the following areas: we maintain cybersecurity threat operations with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response plans;


text: we deploy systems safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence;


text: we utilize collaboration mechanisms established with other entities, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks;


text: we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third -party systems;


text: we provide periodic training and education for personnel regarding cybersecurity threats, which reinforces our information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel;


text: we have established and maintain comprehensive incident response plans that fully outlines our response to, and recovery from a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are evaluated on an regular basis;


text: we utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, finance and other key business functions, as well as the members of the Board and the Audit Committee in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner; and the Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company's Chief Financial Officer, Chief Accounting Officer, other members of management.


text: The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that our management implements to address risks from cybersecurity threats. The Board and the Audit Committee each participate in relevant discussions on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee will also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed, to the extent applicable.


text: Our Director of Information Technology is principally responsible for overseeing our cybersecurity risk management program, in partnership with other members of our management team. The Director of Information Technology works in coordination with the other members of our cybersecurity committee, which includes our Chief Financial Officer, Chief Accounting Officer and In-house Counsel. Our Director of Information Technology has served in various roles in information technology and information security for over 27 years. Our Director of Information Technology, in coordination with our cybersecurity committee, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Through the ongoing communications with our organization, the Director of Information Technology and the cybersecurity committee monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: Cybersecurity risk management, including our processes for assessing, identifying and managing material risks from cybersecurity threats, is an integral part of our overall enterprise risk management program.

companyName: FOOT LOCKER, INC.


text: Cybersecurity risk management and strategy We use information technology and third -party service providers to support our global business processes and activities, which exposes us to cybersecurity risks.


text: Key Program Components To help manage cybersecurity risk, the Company uses cybersecurity frameworks and standards as a guide, such as the National Institute of Standards and Technology's Cybersecurity Framework, International Organization of Standardization ISO/IEC 27002, and Payment Card Industry (PCI) Security Standards. We use, and continue to improve, our cyber defense-in-depth strategy, which uses multiple layers of security for holistic protection.


text: Our cybersecurity risk management program includes: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including third -party network security reviews, scans, and audits, on at least an annual basis;


text: data protection and cybersecurity training for employees with access to information systems, certain individuals with privileged access, such as system administrators and developers, are subject to additional controls and monitoring activities; periodic phishing campaigns to train our employees to better identify, report, and avoid malicious content; a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; a disaster recovery plan and controls designed to protect against business interruption, including by backing up our critical systems; a third -party risk management process for service providers, suppliers, and vendors who have access to our information systems.


text: Cybersecurity Governance The Board of Directors has risk oversight responsibility regarding risks that could affect the Company. Oversight for certain risks is administered through committees of the Board. The Audit Committee of the Board is responsible for oversight over our enterprise risk management framework. Cybersecurity risk is included in our enterprise risk management program.


text: The Technology and Digital Engagement Committee of the Board has primary responsibility for oversight of the Company's cybersecurity risk. This Committee receives regular briefings from our Chief Operations Officer, Chief Technology Officer, Chief Information Security Officer, and outside experts on cybersecurity risks and cyber risk oversight. During these meetings, the Technology and Digital Engagement Committee and management discuss cybersecurity risks, risk management activities and efforts, best practices, the effectiveness of our security measures, and other related matters. The Technology and Digital Engagement Committee Chair reports on the committee's meetings, considerations, and actions to the Board at the next Board meeting following each committee meeting. The Audit Committee also discusses and receives updates on cybersecurity matters in connection with its oversight of enterprise risk management.


text: We maintain a security incident response plan that is utilized when cybersecurity incidents are detected. We conduct periodic tabletop exercises, in which different internal and external stakeholders, including from time to time our CEO, Non-Executive Chair, or Board of Directors, participate in a simulated cyber scenario. The purpose of these exercises is to test our security incident response plan, identify weaknesses or gaps, and ensure that all participants are aware of, and familiar with, their roles and responsibilities.


text: Our Chief Information Security Officer, with oversight from the Chief Technology Officer and Chief Operations Officer, is primarily responsible for assessing and managing cybersecurity risks. Our Chief Information Security Officer has extensive cybersecurity knowledge and skills gained from over 25 years' experience in the field. He holds a Certified Information Systems Security Professional certification, issued by ISC, which is a globally recognized credential demonstrating expertise in information security and risk management. Our Chief Information Security Officer stays up to date on developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition also informs our program of prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Several experienced information security professionals report to our Chief Information Security Officer and he is supported by a team of trained cybersecurity team members. In addition to our in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: The Company regularly updates and assesses its information security strategy and responses for new and emerging threats. To date, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations or financial position. Notwithstanding the breadth of the Company's information security program, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse impact. Also see "Risks Related to Technology, Data Security, and Privacy" included as part of Item 1A. "Risk Factors," which is incorporated by reference herein.


text: Risk management and strategy We assess material risks from cyber security threats on an ongoing basis, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As our Company grows, we plan to develop a more robust and detailed strategy for cyber security in alignment with nationally accepted standards.

companyName: ZION OIL & GAS INC

ticker: ZNOG


text: Our management and the Board recognize the critical importance of maintaining the trust and confidence of our business partners and employees, including the importance of managing cyber security risks as part of our larger risk management program. While all of our personnel play a part in managing cyber security risks, one of the key functions of our Board is informed oversight of our risk management process, including risks from cyber security threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks that we face. In general, we seek to address cyber security risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cyber security threats and effectively responding to cyber security incidents when they occur.


text: The company has not experienced a cyber security incident or a cyber security threat during 2024 nor in any prior years. The company's overall risk management systems and processes have followed the recommended guidelines of our cyber security insurance company. The Audit Committee has the board's oversight of risk from cyber security threats and the responsibility for reviewing the management processes. Management's role in assessing and managing material risks from cyber security threats is the responsibility of the Chief Financial Officer, who reports and coordinates any potential material risk to the Audit Committee.


text: Cybersecurity incidents continue to become more prevalent requiring adequate and continuous assessment, identification, and management of material risks associated with cybersecurity threats. These risks include, among other things, disruption of our business processes and proprietary software, and potential unwanted disclosure of protected personal information which may cause harm to our employees, and clients, violations of privacy laws and regulations, breach of confidentiality and other contractual obligations, litigation and legal action, and financial and reputational harm. We utilize cybersecurity technologies and established procedures and processes to identify, assess, and manage these material cybersecurity risks.

companyName: HireQuest, Inc.

ticker: HQI


text: Risk Assessments Our Chief Information Officer ("CIO") heads our technology team which establishes processes and procedures to assess technology related risks, including cybersecurity risks, to the Company. Protections we have in place include regular network monitoring, vulnerability assessments, and tabletop exercises to inform the company of potential risks and mitigation strategies. We also execute enterprise risk management assessments, which include cybersecurity threat risks.


text: Our CIO has reviewed the standards created by the National Institute of Standards and Technology and has incorporated their approaches where appropriate. We conduct internal and external risk assessments.


text: Our Board of Directors has ultimate oversight with respect to cybersecurity. At each regularly scheduled board meeting, the Board discusses the steps the Company has taken to ensure proper security. While we have not experienced material cybersecurity incidents in the past, our policies and procedures require us to inform the Board of any material incident.


text: Ongoing Activities To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, we undertake the following activities: All corporate machines are protected by anti-virus software and enterprise network protection; We require two -factor authentication on all corporate machines; We require two -factor authentication for all corporate email accounts; We require all corporate employees to complete quarterly cybersecurity training provided by a third -party; Our CIO and other members of our technology team proactively monitor all potential risks and immediately respond to threats; Our data is backed up in multiple offline air-gapped devices; We test all backups quarterly; We monitor regulations to ensure our policies and procedures are up-to-date and compliant.


text: Incident Response Our incident response plan identifies the key employees responsible for responding to a cybersecurity incident including our CIO, CLO, CEO, and other executives along with the technology department, and coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The Company has not experienced incidents in the past which were material to our operating results or business.


text: Third-Party Risk Management Our polices and processes address cybersecurity threat risks associated with the use of third -party service providers, including those who access, use and/or store our client, candidate, associate and employee data or have access to our network and systems. Third-party risks are included within our enterprise risk management assessment program, as well as our information security-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third -party service providers. We perform due diligence on third parties that have access to our systems, data or facilities that house such systems or data. This allows us to identify high-risk providers and continually monitor for cybersecurity threat risks appropriately. Additionally, we require contracts with all third parties that have access to our network and systems to include baseline security requirements for adequate data handling, as well as to provide the company with audit rights. Such contractual requirements are reviewed during each subsequent contract renewal process.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Gyrodyne, LLC

ticker: GYRO


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT service provider to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes that isolate the Company's financial and operating records from any other systems including email and other internet applications.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information from cybersecurity threats. Cadiz Inc.

companyName: CADIZ INC

ticker: CDZI


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; offsite backup storage of critical systems and information; the use of external service providers to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process to identify and mitigate risks from third parties, such as service providers, suppliers, and vendors.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats, see Item 1A, "Risk Factors", above.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit & Risk Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program as part of our overall enterprise risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management promptly updates the Committee regarding any material cybersecurity incidents, and as necessary as to any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team, with the assistance of our external service providers, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises the cybersecurity activities of both our internal personnel and our retained external cybersecurity consultants.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including, confidential information that is proprietary, strategic or competitive in nature, and data related to financial and customer data ("Information Systems and Data").

companyName: BOSTON OMAHA Corp

ticker: BOC


text: While to date, we have not had a major cyber incident against our platforms, nor experienced significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "Disruptions to or any breach of our information technology systems could disrupt our business operations which could have a material adverse effect on our business, prospects, results of operations, financial condition and/or cash flows."


text: Our officers and employees and our IT vendors help identify, assess and manage our cybersecurity threats and risks and the unique needs of each of our billboard, surety insurance, broadband and other businesses and the various offices in which we operate. We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools, including but not limited to tools for monitoring, geolocation, remote wiping, threat detection, intrusion detection and prevention, patch management, distributed denial of service (DDoS) protection and forensics; conducting (directly or through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threats and actors; conducting vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile; and evaluating threats reported to us.


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plans and procedures, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, vendor risk management program, employee training and penetration testing.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program, and members of our management team and IT consultants work together to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and report regularly to our board of directors on cybersecurity matters.


text: We use third -party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers, threat intelligence service providers, dark web monitoring services, and other cybersecurity software providers.


text: We use third -party service providers to perform a variety of functions throughout our business, including but not limited to application providers, hosting companies, contract manufacturing organizations and contract research organizations. We have a vendor management program to oversee, identify and manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for vendors that may include, depending on the vendor and nature of services being performed, security questionnaires, review of the vendor's written security program, review of security assessments, audits and reports, vulnerability scans related to the vendor, security assessment calls with the vendor's security personnel, and the imposition of certain contractual obligations on the vendor, among other elements, in accordance with the processes outlined in our internal vendor selection, management, and oversight process policy and other internal guidelines. More specifically, the level of assessment may depend on the following: the nature of the services provided and the data the vendors may collect, retain, and utilize, the sensitivity of the Information Systems and Data at issue, and the identity of the provider. Our board of directors addresses our cybersecurity risk management as part of its general oversight function.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by various members of our management team and IT consultants, which includes individuals who have a diverse combination of relevant expertise, experience, education and training. Our team includes individuals with relevant experience in enterprise risk management and disclosure controls and procedures. Additionally, certain members of our team have experience managing cybersecurity programs and are specifically assigned cybersecurity oversight.


text: Certain members of our management team are responsible for hiring appropriate employees and consultants, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management. Our cybersecurity incident management team, and other individuals as needed, work to help us mitigate and remediate cybersecurity incidents of which we are notified. In addition, our incident response processes include a procedure for reporting certain cybersecurity incidents to the board of directors.


text: Commencing in 2024, our Audit and Risk Committee, on behalf of the board of directors, is overseeing our cybersecurity risk management program.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are fully integrated into the Company's overall risk management approach, and cybersecurity risks are subject to oversight by the Company's board of managers. The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with specific the goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: Risk Management and Strategy Consistent with overall Company policies and practices, the Company's cybersecurity program focuses on the following areas:


text: Vigilance: The Company uses a reputable third -party managed service provider ("MSP") for cybersecurity support, which has operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. The Company's MSP is staffed with several security personnel, many of which have Certified Information Systems Security Professional ("CISSP") certifications.


text: Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. In the event of a potential cybersecurity incident, the Company's MSP has the capability to take a number of immediate steps to isolate the potential threat.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third -party systems.


text: Training: The Company provides annual mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. The Company also conducts monthly "phishing" email testing for every employee and provides remedial follow-up training when necessary.


text: Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans, in coordination with the Company's MSP, that fully address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident.


text: Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's operations, risk management, internal audit and other key business functions, as well as the members of the board of managers in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.


text: Governance: The board of managers' oversight of cybersecurity risk management is supported by the Company's Incident Response Team (the "IRT"), which is made up of the Company's Co-Chief Information Officers, the Chief Operating Officer, and their designees. The IRT regularly interacts with the board of managers and members of management.


text: The IRT, in coordination with the board of managers, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. Any cybersecurity incidents that are detected by the Company's MSP are routed directly to the IRT. The board of managers receives reports on cybersecurity risks from management. The board of managers will be informed of any cybersecurity incident that is determined by the IRT to be material, and will receive ongoing updates regarding such material incident until it has been addressed. At least once each year, the board of managers and the IRT discuss the Company's approach to cybersecurity risk management with the Company's Co-Chief Information Officers.


text: The Company's Co-Chief Information Officers are the members of the Company's management principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Co-Chief Information Officers work in coordination with the other members of the IRT, which includes our Co-Chief Information Officers, our Chief Operating Officer, and their designees. The Company's Co-Chief Information Officers have each served in various roles in information technology and information security for over 30 years, including in leadership positions with both small and large companies. The Co-Chief Information Security Officers each have extensive knowledge in technology and cybersecurity. The Company's President and interim Chief Financial Officer, Chief Operating Officer, and Chief Compliance Officer each hold undergraduate, and, in some cases, graduate, degrees in their respective fields, and each have over 20 years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.


text: The Company's Co-Chief Information Officers, in coordination with the IRT, work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. The Co-Chief Information Officers and the rest of the IRT, in collaboration with the Company's MSP, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the board of managers when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company's business strategy, results of operations, or financial condition. See the "General Risk Factors" section in Part I, Item 1A, Risk Factors for more information about the Company's cybersecurity risks.


text: Our information security program is managed through a dynamic enterprise-wide cybersecurity strategy, policies, standards, architecture, and processes. The Bank relies upon a formalized internal Information and Cybersecurity Program (the "Program") to safeguard confidential information, maintain the confidentiality of our customers' data and to ensure the integrity of financial transactions. The Program is approved by the Bank's Board of Directors or a committee thereof annually, and is designed to identify reasonably foreseeable internal and external threats, assess the likelihood and potential damage these threats could cause, and assess the appropriateness of policies, standards and procedures used to identify and mitigate risks associated with a material cybersecurity incident. The Program has been designed to align with industry best practices, as well as regulatory guidelines and laws and leverages the National Institute of Standards and Technology Cybersecurity framework ("NIST CSF") as its baseline. We are dedicated to cybersecurity and maintaining the trust and confidence of our customers and stockholders.

companyName: Bogota Financial Corp.

ticker: BSBK


text: Additionally, we maintain an Incident Response Plan that provides established procedures for timely reporting and escalation of significant cybersecurity incidents. Our commitment involves promptly notifying regulatory authorities, customers, and other stakeholders in the event of any material cyber incidents that may impact our operations or the security of sensitive information. The Incident Response Plan is coordinated through the Vice President of Information Technology ("VP of IT") and key members of executive management who are responsible for escalation as part of the Plan.


text: We use a layered defense management approach to managing cybersecurity. The Bank's cybersecurity operations function is headed by the VP of IT who is responsible for managing information security risks by developing and implementing information security strategies, architecture, and procedures and acts as the first line of defense. The VP of IT oversees a team of internal and external security professionals in safeguarding our critical data, systems, and assets against threats, breaches, and attacks. The VP of IT is also responsible for ensuring the confidentiality, integrity, and availability of information assets.


text: The information security program, policies, and standards are managed by the Bank's Information Security Officer (the "ISO"), who leads the enterprise wide technology risk management function. The ISO acts as the second line of defense and provides risk oversight for the Bank's technology operating infrastructure and operations. The ISO manages testing of technology controls, technology risk assessments, risk reporting, information security third-party due diligence, monitoring the implementation of risk mitigation actions, and tracking their effectiveness over time. The Bank's internal auditors and Board of Directors act as the third line of defense, providing the independent assurance function. In addition to the above risk management framework, we engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third -party specialists. We also maintain a third -party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. Additionally, we actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections for any portion of our workforce that has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to opine on their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Our Operations" in Item 1A. Risk Factors.


text: As part of our governance structure, the Board of Directors, Chief Executive Officer and VP of IT play an active role in overseeing our cybersecurity program. Regular briefings on cyber risk management and incident response activities are conducted, ensuring a high level of governance and accountability in addressing cybersecurity concerns. The Bank and its vendors provide periodic reports to our Board of Directors, or committee thereof, as well as to our senior management team as appropriate. These reports include updates on the Bank's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: We are steadfast in our commitment to collaborate with regulatory authorities to enhance industry-wide cybersecurity standards. Given the ongoing and changing cyber threat landscape, we are committed to invest in, improve and update our cybersecurity practices on an ongoing basis. Regular assessments, testing, audits, and training of all employees are conducted to adapt to emerging threats and enhance our ability to safeguard the interests of our customers.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and customer-facing products.

companyName: LIQTECH INTERNATIONAL INC

ticker: LIQT


text: The underlying controls and processes of our cyber risk management program are consistent with recognized practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the International Organization Standardization 27001 Information Security Management System Requirements.


text: Cyber partners are also a key part of our cybersecurity infrastructure. We utilize third -party software to provide continuous monitoring of our infrastructure and to coordinate the investigation and remediation of alerts. A program for staging incident response drills is intended to prepare support teams in the event of a significant incident.


text: The Chief Financial Officer, who is responsible for assessing and managing our cyber-risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The Chief Financial Officer has experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants.


text: The Audit Committee of the Board of Directors is responsible for overseeing cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Management briefs the Audit Committee on the effectiveness of our cyber risk management program. In addition, cybersecurity risks are reviewed by the Board of Directors, at least annually.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows, or reputation. We have experienced, and will continue to experience, cyber incidents in the normal course of our business, however, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors – Risks Relating to Our Business – We may have risks associated with security of our information technology systems".


text: The Company approaches cybersecurity as an enterprise-wide risk and uses external resources to assess risk and manage its IT and 24x7 cybersecurity operations, including managed service providers who assist in the support of key business systems. The Company may also periodically engage external consultants to assist with cybersecurity incident management, particularly where advanced or specialized expertise may be required. If a material cybersecurity breach occurs, the incident will be reviewed by management to determine whether further escalation is appropriate. The Executive Chairman of the Board and Chief Executive Officer and the Chief Financial Officer have primary responsibility for this review and assessment. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive team, and if deemed necessary or appropriate, the Board of Directors. The Board Audit Committee is responsible for reviewing and discussing the adequacy and effectiveness of the Company's information security policies and the procedures and controls regarding information systems. In addition, we plan to consult with outside counsel as appropriate, including on materiality analyses and disclosure matters, and to assist in making the final materiality determination regarding disclosure and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents as appropriate.

companyName: Catheter Precision, Inc.

ticker: VTAK


text: The Company maintains a cyber liability insurance policy that is designed to cover certain expenses, business losses, business interruption, and fines and penalties associated with a data breach or other similar incident. Cyber liability insurance also provides coverage in the event of a ransomware attack.


text: To date, the Company has not had a cybersecurity event that materially impacted or is reasonably likely to materially affect its business strategy, results of operations, financial condition, or the security of its proprietary data.


text: Cybersecurity Risk Management and Strategy To combat ever-present cyber risks, the Company maintains a comprehensive cybersecurity program, which includes employee training, annual risk assessments and a comprehensive cybersecurity environment meant to detect, prevent, and limit unauthorized or harmful actions across our information technology environment. However, we operate in the medical device sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to patients, customers, and employees; violation of privacy laws and other litigation and legal risk; and reputational risk.

companyName: PULSE BIOSCIENCES, INC.

ticker: PLSE


text: We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We use recognized commercially reasonable measures, tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture on an ongoing basis through regular vulnerability scans, penetration tests and third-party reviews. Other key components of our cybersecurity program include, but are not limited to, asset management, encryption, data loss prevention technology, access controls, identity and access management (IAM), such as multi-factor authentication (MFA), vulnerability management, endpoint threat detection and response (EDR), logging and monitoring involving the use of security information and event management (SIEM), privileged access management (PAM), email and web gateway protection, multi-faceted backup and data recovery solutions, anti-malware, firewalls, IDS and IPS, auditing and monitoring, regular policy updates, security awareness training, anti-phishing campaigns, intrusion detection and prevention, vulnerability and patch management, and third-party risk management. We also subscribe to third-party threat intelligence tools and services that support monitoring, analyzing, and responding to emerging risks and threats. We require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards, although currently we do not audit this. While we believe our cybersecurity practices are comparable to those of similarly situated companies, the Company does not currently audit its third-party service providers' cybersecurity practices, except through annual SOC-1 reviews and its regulatory and quality control auditing of vendors engaged in clinical trials or the manufacture of products used in the assembly of our medical devices. We also rely on industry leading third party service providers to provide the systems required to effectively run our clinical trials and require that these third-party service providers implement and maintain standard cybersecurity practices. We have business continuity plans that we regularly review and update in line with our evolving applications architecture. We believe our cybersecurity practices comply with applicable legal requirements, including those established by the FDA.


text: To date, we have not experienced any material security incidents or data breaches as a result of a compromise of our information systems and are not aware of any cybersecurity incidents that have had a material impact or are reasonably likely to materially affect our business strategy, operating results, or financial condition.


text: Cybersecurity Governance One of the key functions of our board of directors is informed oversight of our compliance program, including the processes used to mitigate risks associated with cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure generally, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its enterprise-level oversight of risks associated with cybersecurity threats directly as a whole, as well as through delegation of responsibility to our Audit Committee, which serves and functions as the Board's primary oversight body to monitor the Company's cybersecurity and related information technology risk. The Audit Committee receives periodic reports from management personnel responsible for enterprise risk management, which also evaluates cybersecurity among other enterprise level risks on an annual basis. It also assesses the experience of management personnel responsible for preventing, mitigating, detecting, and remediating any cyber incidents, including applicable third-party providers. The Audit Committee also oversees the Company's disclosure of any cybersecurity incident deemed material as required by the SEC or any other governmental authority, as applicable.


text: At the operational level, the Company has established an information security team, including a Privacy and Security Council ("PSC"), consisting of representatives from IT, Legal, HR, and Finance, to help provide governance and strategic direction for managing cyber risks, maintaining IT regulatory compliance, and optimizing technology initiatives for alignment with our company goals and objectives. Pursuant to various policies adopted by the Company since 2021, including the Company's Privacy Policy, the Company's senior most IT employee, our Information Security Coordinator (our "ISC"), is a member of the PSC and has frontline responsibility for assessing, identifying and managing material risks from cybersecurity threats. The PSC convenes not less than annually, and meetings include updates on cybersecurity matters provided by the information security team.


text: Our ISC has expertise in the following areas which assist in assessing and managing applicable cybersecurity risk: 27 years of IT experience including endpoint detection, security, incident management and response, vulnerability management and response, event management and response, and network security segmentation. The ISC provides regular reports on ongoing risk and mitigation practices, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company, to our Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, and General Counsel, who then report to the Audit Committee and the Board.


text: Our incident response plan designates our ISC as primarily responsible for identifying and evaluating any cybersecurity incident or suspected incident and reporting any such incidents to our General Counsel in order for management to evaluate materiality, and to report to our Audit Committee, our Board and make public disclosures, as applicable. Our General Counsel is responsible for routinely updating both the Board and the Audit Committee on the Company's cybersecurity personnel, practices and processes and, pursuant to our data breach response policy, which is updated from time to time, he must report to the Board in the event of any detected material incident and regularly update the Board on any mitigation and remediation steps being taken in connection with the Company's response. The Company has, from time to time, engaged external experts, including cybersecurity assessors, consultants, auditors, and legal counsel, in evaluating and testing our risk management systems and on a project-specific basis to assist us with projects that will improve our IT infrastructure, strengthen our products' security posture, and improve our cyber readiness. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's chief executive officer and board of directors. The Company engages information technology "managed service providers" (MSPs) to manage the Company's computer and information systems at its three office locations and remote locations. The MSPs are responsible for evaluating and testing the Company's risk management systems and assessing and remediating potential cybersecurity incidents as appropriate.

companyName: BIOLARGO, INC.

ticker: BLGO


text: The executives in charge of each physical office location are responsible for assessing and managing cybersecurity risks for their locations, and the Company's chief executive officer is responsible for assessing and managing cybersecurity risks to the Company as a whole. Because none of these individuals has specific training or experience in managing cybersecurity risks, MSPs that have expertise and experience in doing so are retained and relied upon. Our chief executive officer is responsible for escalating any cybersecurity matters as appropriate, in consultation with our legal counsel. Our board of directors is ultimately responsible for oversight of cybersecurity risk management and receives regular reports from Company management.


text: Presidio Property Trust uses a cross-departmental approach to addressing cybersecurity risk, including input from senior management, employees, external consultants, and our Board of Directors (the "Board"). Senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner, including providing periodic training to staff and an annual third-party review of the Company's current posture to protect against threats. The Audit Committee of the Board of Directors oversees the steps taken by Presidio Property Trust's management to monitor and mitigate cybersecurity risks. Senior management briefs the Audit Committee and the Board of Directors on cybersecurity matters on at least an annual basis.

companyName: Presidio Property Trust, Inc.

ticker: SQFT


text: The Company operates almost exclusively in a Software-as-a-Service (SaaS) IT environment. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third -party service providers. The internal business owners of the hosted applications are required to document quarterly user access reviews and obtain a System and Organization Controls (SOC) 1 and/or SOC 2 report from our SaaS vendors. With assistance from an external consultant, management conducts an annual review of third -party SOC reports with a specific focus on their data protection procedures. If a third -party vendor is not able to provide a SOC report, management takes additional steps to assess their cybersecurity preparedness and assess our relationship with them on that basis. Our assessment of risks associated with the use of third -party providers is a significant part of the Company's overall cybersecurity risk management framework.


text: The Company has also engaged a third -party managed service provider to manage server, network, and email security, including continuous monitoring and industry-leading antivirus software. Presidio Property Trust has robust business continuity and disaster recovery procedures in place, and an insurance policy that provides for network security liability, event response and recovery, direct business interruption, contingent business interruption, cyber extortion, social engineering, and computer fraud should an incident occur.


text: In addition, we have Company-wide policies and procedures concerning cybersecurity matters, including access security, system change management, development lifecycle, incident management and business continuity/disaster recovery policies. These policies go through an annual internal review process and are approved by appropriate members of management. Presidio Property Trust uses a third -party consultant to assess the Company's compliance with Sarbanes Oxley requirements.


text: Presidio Property Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Company has not, to date, experienced cyber incidents in the normal course of its business, nor have prior cybersecurity incidents had a material adverse effect on the Company's business, financial condition, results of operations, or cash flows. For more information about the cybersecurity risks we face, see the risk factor entitled "Risks related to cyber-attacks, cyber intrusions and other security breaches" in Item 1A- Risk Factors.


text: Risk Management and Strategy The Company understands the importance of managing risks from cybersecurity incidents and utilizes a multilayered strategy guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework for assessing, identifying, detecting and responding to threats and other potential incidents. Key aspects of our strategy for managing risks of cybersecurity threats include: Timely security patching of endpoints; Network and endpoint-based monitoring with autonomous protection capabilities; Backups which are regularly tested for recovery with key backups hardened against malicious access; Third-party security services for audit, benchmarking, and improvement of our cyber security program;

companyName: FutureFuel Corp.

ticker: FF


text: Ongoing monitoring and evaluation of our cybersecurity posture and performance through regular vulnerability scans, simulated phishing tests, and penetration tests; Oversight of third -party service providers by conducting vendor due diligence upon onboarding and ongoing monitoring;


text: An incident response plan designed to coordinate the activities that we and our third -party security service providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate incidents, as well as to comply with applicable legal obligations and mitigate any reputational damage;


text: Structured management of change process to ensure material changes to our systems or operations have an updated assessment of their potential impact associated with internal and external threats to the security, confidentiality, integrity, and availability of our data and systems, along with other material risks to our operations;


text: Ongoing, annual employee security awareness training; and Cybersecurity insurance coverage to help mitigate the risk of loss from cybersecurity incidents.


text: To date, the Company does not believe that cybersecurity incidents have materially affected the Company, its business strategy, results of operations, or financial condition. The Company cannot provide assurance that it will not be materially affected by any future material cybersecurity incidents. For more information about the cybersecurity risks the Company faces, see Item 1A, Risk Factors, above.


text: The Company's Information Technology ("IT") Director is responsible for developing and implementing our cybersecurity program and has over 20 years of cybersecurity experience in various roles involving information security, developing cybersecurity strategies, and implementing cybersecurity programs. Our program includes that all employees complete annual cybersecurity awareness training. The IT Director is responsible for reporting audit findings and risk information to the Company's Chief Financial Officer ("CFO").


text: Our board of directors is responsible for overseeing our enterprise risk management activities in general, and each of the committees of our board of directors assists the board of directors in the role of risk oversight. The Audit Committee of the board of directors oversees our cybersecurity risk and receives reports from time to time from our CFO on cybersecurity risk management. Promptly after becoming aware of a material cybersecurity incident affecting our IT systems or data, the IT Director would work with management to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity incidents.


text: Rekor recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and our exposure management solutions. Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data depending on the environment.

companyName: Rekor Systems, Inc.

ticker: REKR


text: We have an established policy on information security, as well as overall corporate information, workforce and workplace standards policies. These are collectively designed to establish auditable procedures for information security oversight by management, including: 1) identification of different types and forms of information, 2) guidelines for acceptable use and dissemination of information, 3) handling use and destruction of information, 4) personnel and physical site security, 5) incident reporting and response, 6) recovery plans, and 7) standards for web-based applications, communications and mobile devices. Three levels of security procedures have been identified as relating to the sensitivity of the information we manage in connection with different operations. Our policies call for the individuals assigned to these procedures to review and certify them annually and to recommend changes where appropriate. All breaches are required to be reported to senior management and the Board, together with a report on response and recovery, as well as recommendations to address further challenges.


text: Our information security procedures are overseen by our Vice President of Risk Management, supported by our Chief Technology Officer and our IT Manager, who are responsible to provide regular reports to our Interim President and Chief Executive Officer and Chief Financial Officer as well as the Technology and Social Responsibility Committee and the Governance Committee of our Board. These procedures are responsible for identifying, assessing, and managing cybersecurity threats and risks and work to monitor and evaluate our threat environment and risk profile using various methods. These methods include evaluating our and our industry's risk profile, coordinating with law enforcement concerning select threats, and engaging with third parties to conduct external audits and threat assessments for certain systems.


text: Our Information Security Policy and procedures are reviewed on an ongoing basis. These procedures are implemented by our Vice President of Risk Management, assisted by a managed service provider ("MSP"). Our MSP has over 15 years of experience and possesses various cybersecurity certifications. Third-party service providers can assist us from time to time in identifying, assessing, and managing material risks from cybersecurity threats, including for example cybersecurity consultants and software providers, managed cybersecurity service providers, threat intelligence service providers, forensic investigators, penetration testing firms, dark web monitoring services, and professional services firms, including legal counsel and auditors. By partnering with these specialized providers, we can leverage their insights and expertise to implement cybersecurity strategies and processes that are designed to align with industry best practices.


text: Our senior management evaluates material risks from cybersecurity threats against our overall business objectives and this evaluation and the management of material risks from cybersecurity threats is integrated into our overall risk management processes. This integration is designed to ensure that cybersecurity considerations are part of our decision-making processes.


text: See Risk Factors in this Annual Report on Form 10 -K for a description of the risks from cybersecurity threats that may materially affect us and how they may do so.


text: We have made cybersecurity and the protection of our customers' data a top priority. The critical areas that we consider for our evolving cybersecurity program include access control; data encryption; SSDLC/change management; BCP/DRP; endpoint security; patch management; vulnerability assessments; compliance management; data privacy; incident response; monitoring, alerting, and logging; employee training (ingrained in our onboarding process, and mandatory online and in person training annually); and cyber insurance (coverage areas include ransomware, and business interruption which are critical to our clients and availability of business operations).

companyName: Fluent, Inc.

ticker: FLNT


text: Risk Management & Strategy Our cyber risk management program is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. To help protect our company from a major cybersecurity incident that could have a material impact on operations or our financial results, we have implemented policies, procedures, programs and controls, including investments in technology that focus on cybersecurity incident prevention, identification and mitigation. These investments include best practice applications such as CrowdStrike, Okta, Intune and Kandji. These tools also strengthen our overall IT posture as well as our monitoring and alerting and patching processes. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the continuous monitoring such as National Institute of Standards and Technology ("NIST"). We execute an NIST 800-53 review annually and use the results of existing cyber risks to prioritize projects designed to address these gaps and create a go-forward strategy. Our internal and external auditors review our IT and cybersecurity controls annually for design and operating effectiveness.


text: Our Cybersecurity Program is governed by the Company's IT, Legal, and Compliance teams. Our Chief Technology Officer ("CTO") has over 20 years of experience in marketing technology and analytics. Our Vice President of IT Governance, Risk and Compliance ("VP of IT") has over 20 years of experience in IT internal and external audits, IT consulting, and governance, risk, and compliance. Our General Counsel regularly coordinates with the IT team on data security and compliance issues. The CTO and General Counsel report directly to the Chief Executive Officer ("CEO"), so any material issues are raised to the CEO, and a status update of key cybersecurity projects and any material breaches is provided quarterly to the Board's Audit Committee, which includes both an internal and external audit.


text: Incident Disclosure and Materiality Our incident management procedures include identification, evaluation, definition, and escalation based on the determination of materiality. This determination involves the Company's IT, Legal, and Compliance teams, executive officers, and cyber insurance provider. Breach notifications and escalation to the Audit Committee would also be based on the materiality determination. The collaboration among IT, Legal, and Compliance helps ensure and prevent gaps with laws and regulations. Each quarter, the VP of IT provides an update on key cybersecurity projects and any material breaches at the quarterly Audit Committee meeting, at which both the internal and external auditors are present.


text: While we did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition. See Item 1A. "Risk Factors" for more information on our cybersecurity-related risks.


text: Cybersecurity Risk Management and Strategy We have established certain processes for identifying, evaluating, and managing material risks from cybersecurity threats as a part of our overall technology management strategy. These processes are designed and reassessed on a periodic basis to help protect our technology assets and operations from internal and external security threats. We also engage with third parties, including consultants, to enhance our security processes.

companyName: AVENUE THERAPEUTICS, INC.

ticker: ATXI


text: We have previously engaged and currently engage third parties to assess the effectiveness of our cybersecurity and technology management strategy and continue to seek to implement new, and improve existing, processes regularly to adjust for changes in technology, internal or external threats, business strategy, and regulatory requirements. We, and our third parties, have deployed managed detection and response services to monitor our technology infrastructure and information systems for possible threats. Our technology management strategy also includes ongoing security training and education for employees regarding threats, including their role and responsibility in detecting and responding to such threats.


text: We review the processes of our third party vendors and consider their ability to adhere to relevant industry practices and maintain adequate technology risk programs. In addition, we maintain cyber and cyber-related crime insurance coverage policies as part of our overall risk management strategy, however, our policies may not be sufficient to cover against all potential future claims, if any.


text: In the last two fiscal years, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition. Although we proactively attempt to prevent all threats, we are unable to eliminate all risk from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A. Risk Factors "Our business and operations would suffer in the event of computer system failures, cyber-attacks, or deficiencies in our or third parties' cybersecurity".


text: Cybersecurity Governance While our Board of Directors is responsible for oversight and risk management in general, our Audit Committee provides oversight of our technology management strategy to ensure that cybersecurity threats and risks are identified, evaluated, and managed. The Audit Committee receives periodic updates from our management team regarding the overall state of our technology management strategy and any relevant risks from cybersecurity threats and cybersecurity incidents.


text: Our management team is responsible for assessing and managing the material risks from cybersecurity threats and our Interim Chief Financial Officer leads these efforts on behalf of the management team. Our management team members have expertise in information systems, compliance and corporate governance, which we believe are disciplines that are effective in the management of the Company's cybersecurity risk. Our Interim Chief Financial Officer is well-informed on emerging cybersecurity risks and solutions used to mitigate and remediate loss due to cybersecurity incidents and is responsible for our internal cybersecurity programs and oversight of third-party cybersecurity vendors who monitor and execute on the prevention, detection, and mitigation of cybersecurity threats and incidents.


text: We continue to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance and are reviewed yearly by our board of directors.

companyName: Allarity Therapeutics, Inc.

ticker: ALLR


text: Risk Management and Strategy As of December 31, 2024, we have implemented a set of cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities. Our employees have received cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. Important security measures such as multifactor authentication, firewalls, Endpoint Detection and Response (EDR), encryption, etc. have been implemented. We continue to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Currently we are in the process of expanding our risk management procedure to include a broader cybersecurity risk management process. The updated risk management process will include annual review by our board of directors.


text: Our board of directors are currently implementing as oversight procedure for IT governance and cyber security risk management. It is expected that IT governance and cybersecurity will be included in the company's quarterly management review meetings under the supervision of our senior leadership, including our Chief Executive Officer and Chief Financial Officer, with regularly meets with and provides periodic briefings to our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Cybersecurity Threat Disclosure To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. For further discussion of cybersecurity risks, please see Item 1A, "Risk Factors."


text: Cybersecurity Governance The Company's Board considers cybersecurity risk as part of its risk oversight function and considers cybersecurity and IT risks as key strategic risks of the Company. The Board oversees management's implementation of the Company's cybersecurity risk management program, receiving at least annual updates from management (including our Chief Information Officer) on cybersecurity risks, including briefings on the Company's cyber risk management program and cybersecurity incidents, and reviewing cybersecurity topics impacting companies with management and external experts.

companyName: RCM TECHNOLOGIES, INC.

ticker: RCMT


text: The Company's Chief Information Officer leads the IT and cybersecurity functions and has primary responsibility for leading the Company's overall cybersecurity risk management program, supervising both internal cybersecurity personnel and external cybersecurity service providers. The Company's cybersecurity function is responsible for assessing and managing material risks from cybersecurity threats, as well as informing management about and monitoring the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers and alerts and reports produced by security tools deployed in the IT environment.


text: The Company's Chief Information Officer and Vice President of IT security and Compliance have significant experience in managing and leading information systems and deploying cybersecurity technologies and have extensive cybersecurity training and knowledge. The Company's Vice President of IT security and Compliance has several industry certifications, including CISSP (Certified Information Security System Professional), CCSP (Certified Cloud Security Professional) and CCSK (Certificate of Cloud Security Knowledge). The Company's Chief Information Officer reports to the Chief Executive Officer, and the Company's Vice President of IT Security and Compliance reports to the Company's Chief Information Officer.


text: Risk management and strategy With the assistance of our IT vendor, we established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an information technology ("IT") consultant who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process. Our Board of Directors provides oversight to our cybersecurity efforts to ensure effective governance in managing risks associated with cybersecurity threats. Our CFO provides periodic updates to the Board of Directors regarding our cybersecurity program, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company.

companyName: Harvard Apparatus Regenerative Technology, Inc.

ticker: HRGN


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, responses may include re-design, implementation, and maintenance of reasonable safeguards to minimize identified risks and address any identified gaps in existing safeguards and regularly monitoring of the effectiveness of our safeguards.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to " Cyber-attacks or other failures in telecommunications or information technology systems and deficiency in our, or those of third parties upon which we rely, cybersecurity could result in information theft, data corruption and significant disruption of our business operations. " under Item 1A, "Risk Factors," in this annual report on Form 10 -K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our full board of directors directly administers its cybersecurity risk oversight function and our audit committee provides additional oversight of maintaining and monitoring cybersecurity risks.


text: Our Chief Financial Officer is primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third -party service providers.


text: Our Chief Financial Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Cybersecurity risk management and strategy Cybersecurity and risks associated with information security are operational risks included in the Company's Enterprise Risk Management ("ERM") Framework. Under the ERM Framework, the Company's Information Technology department and all employees are the first line of defense ("First Line"). Those in the First Line are each responsible for identifying and managing the information security risk associated with their activities. The Company's IT Steering Committee is part of the independent risk oversight of information security risk along with the Company's Compliance and ERM Committees, both of which are management risk oversight committees.

companyName: Oak Valley Bancorp

ticker: OVLY


text: The BOD and IT Steering committee are primarily responsible for monitoring management's implementation of operations and technology risk controls, including those relating to cyber security and information security. The Company maintains a data protection and information security program designed to ensure adequate governance and oversight is in place while evolving to meet changes in applicable laws and regulations, and best practices. The Company's information security controls and programs are designed to align with the National Institute of Standards and Technology ("NIST") standards for cybersecurity and the Federal Financial Institutions Examination Council ("FFIEC") examination guidelines, along with applicable privacy laws.


text: Information Security is the responsibility of the officers, employees, and agents of the Company with oversight by the Board of Directors ("BOD"). Our investment in people is critical to maintaining an effective cyber defense, which begins by developing and maintaining a robust Information Security function within the First Line. The Company's Chief Information Officer ("CIO") has over 25 years of network architecture, information technology and cybersecurity experience. Collectively, the Company's senior leadership in this area have nearly 80 years of experience. Each Company employee is responsible for an effective cybersecurity defense which is enforced with mandatory interactive cyber awareness training, periodic newsletters, executive security briefs and updates. Additionally, the BOD is informed about cybersecurity and the relevant risks posed to the Company via regular updates from the Company's CIO. The BOD is regularly informed and actively oversees the data security and privacy program and its policies. The BOD also receives regular education on innovative technology, cybersecurity, information systems/data management, fintech and privacy.


text: Cybersecurity assessments The Company engages external third parties to perform assessments on our adherence to the FFIEC's recommendations on cyber preparedness and NIST Cybersecurity Framework, as well as to review for best practices for the use of cloud services and FedLine requirements. To validate the effectiveness of the Company's overall information security controls, external third parties also perform full-scope external and internal penetration testing designed to mimic the tactics used by individual hackers or criminal hacking organizations. The Company also engages external third parties to perform ongoing adversarial simulation.


text: The Company conducts regular internal cybersecurity assessments intended to measure inherent risk and drive the adjustment of our security posture according to the latest threats. These assessments include alignment with the FFIEC's recommendations on cyber preparedness and GLBA Safeguards Rule to protect user data. The Company performs continuous internal and external vulnerability scanning to measure and react to new vulnerabilities and seeks conformance to industry best practices for both cloud-based and on-premises technology. The Company reviews vendor and partner security practices to ensure they maintain proper information security safeguards.


text: Cybersecurity operational measures Led by our CIO, the Company's data protection, information, cyber and technology services team collaborates with subject-matter experts throughout the business to identify, monitor and mitigate material risks, as well as to monitor compliance with the Company's security polices, applicable laws and regulations. The Company's security monitoring team manages the security of our systems through the ingestion of multiple external threat feeds and systems logs. Through the collection and integration of security-related IT infrastructure information, external threat intelligence and the expertise of trained security analysts, the Company works to identify and address potential indicators of compromise. Potential security events are identified and addressed through defined IT incident response activities and with support of the Company's Incident Response Plan. The Incident Response Plan is in place and updated regularly with the intent to reduce impacts to clients and the Company caused by a declared cyber incident, such as an event involving malicious code, unauthorized disclosure, loss of information or unauthorized use of information or systems. The Incident Response Plan organizes resources to manage and resolve events that harm or threaten the security of information assets. The Incident Response Plan includes involvement of the Company's Executive Leadership Team and BOD based on the severity of a cyber event, including the analysis of reporting requirements. The Incident Response Plan is tested annually and includes technical and executive management in simulated crisis management cybersecurity tabletop exercises.


text: As of the date of this report, other than the risks discussed in "Risk Factors," the Company knows of no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Risk Management and Strategy Omeros maintains a cybersecurity risk management program that is designed to assess, identify, manage and respond to risks from cybersecurity threats in a robust manner. This program shares certain common methodologies, reporting channels and governance processes applicable to our management of other risk areas, such as legal, compliance, strategic, operational and financial risk.

companyName: OMEROS CORP

ticker: OMER


text: We utilize a range of internal and external resources to assess and identify cybersecurity threats and vulnerabilities. We access and utilize information drawn from a variety of publications, reports and services to assess our cybersecurity risk profile, develop awareness of emerging cybersecurity threats and threat actors and identify risk factors that are particularly relevant to the biotechnology and pharmaceutical sector and to our company. We also work with third parties that assist us to identify, assess and manage cybersecurity risks, including external auditors, consulting firms, managed security service providers and penetration testing firms.


text: We have implemented and maintain various technical, physical and organizational measures, processes, standards and/or policies designed to manage and mitigate material risks from cybersecurity threats. These include data encryption, network security controls, access controls, physical security, asset management, system hardening, vulnerability management and patching and continuous monitoring of information technology systems and network telemetry data using a variety of manual and automated tools and systems designed to detect and respond to suspicious or unusual activity. We maintain systems and plans for business continuity and disaster recovery and have implemented tools and procedures for cybersecurity incident detection and response. We also operate a cybersecurity training program for employees that includes required webinars and deployment of simulated phishing and similar attacks in which threat actors utilize social engineering to gain access to company systems.


text: We take a risk-weighted approach to mitigation of cybersecurity risks associated with use of third-party service providers. Based on an assessment of the cybersecurity risks presented by a given third-party service provider, we seek to minimize third-party cybersecurity risk on a case-by-case basis, generally through a combination of due diligence in the selection of qualified vendors and the imposition of contractual terms requiring the vendor to maintain specified cybersecurity safeguards and/or to accept financial responsibility for security breaches occurring within the vendor's area of responsibility.


text: We are not aware of any specific risks from specific cybersecurity threats, and have not experienced any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition. While we continue to invest in the security and resiliency of our information technology systems and to enhance our cybersecurity controls and processes, we cannot provide assurance that a future cybersecurity incident will not occur or that it would not materially affect our company. Please see Item 1A of Part I of this Annual Report under the heading "Risk Factors" for additional discussion about risks related to cybersecurity.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Pursuant to its charter, the audit committee of our board of directors is responsible for the oversight of management's efforts to address cybersecurity risk. Management reports to the audit committee on cybersecurity risk matters periodically, typically twice annually. These reports normally address matters such as: the evolving cybersecurity risk environment and the emergence of new threats; outcomes and learnings from penetration testing, security audits or vulnerability assessments; evaluation of existing controls, tools and procedures and progress on implementation of any new initiatives to manage and mitigate cybersecurity risk. In addition, members of our board of directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management program is managed by our Director of Information Technology (the "IT Director"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The IT Director has been with the organization since 2007, has a post-graduate degree in Information Security, and is a member of InfraGard, a partnership between the Federal Bureau of Investigation and members of the private sector for the protection of U.S. critical infrastructure. The IT Director is informed about and monitors prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with dedicated internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our information technology environment. The IT Director provides periodic reports on cybersecurity risk to the audit committee of our board of directors, as well as our chief executive officer and other members of our senior management as appropriate.