text: The Company's Board of Directors has ultimate oversight of cybersecurity-related risks and it is assisted in this role by the Technology Committee and the Audit & Risk Committee. Processes for identifying, assessing, and managing cybersecurity-related risks are integrated into the Company's overall enterprise risk management process, which is overseen by the Audit & Risk Committee. The Audit & Risk Committee is responsible for monitoring risks that are being taken by the Company, understanding the enterprise-wide effect of those risks and reporting such risks to the Board. In fulfilling this role, the Technology Committee has primary oversight responsibility over management's efforts to manage and mitigate cybersecurity-related risk and reviews and approves the Company's cybersecurity strategy for protecting the Company's information assets and technology platforms. The Audit & Risk Committee oversees the Company's outsourced Internal Audit Department, which conducts reviews and assessments related to information security. Management provides periodic reports to the Technology Committee and the Audit & Risk Committee, both of which provide reports of their meetings to the full Board. These reports to the Board and its Committees address the threat environment, vulnerability assessments, specific cyber incidents and management's efforts to monitor, detect and prevent cyber threats.


text: The Company's information security program is primarily administered at the management level by the Information Security Department, which is led by the Company's Chief Information Officer (CIO), and is supported by Chief Information Security Officer (CISO), and the Information Technology Department, which is led by the Company's Chief Technology Officer (CTO). The Company's Information Security Department is responsible for day-to-day management of the Company's information security program, including data loss prevention, access control, threat monitoring, incident response and employee education and training. The Information Security Department also maintains policies related to cybersecurity and data security that provide the required governance for the information security program. Additionally, the Company's Information Technology Department maintains policies that govern technical aspects of the Company's information security program. Each policy is reviewed and approved by the Board at least annually. The Information Security team maintains and runs the Company's security operations center and is responsible for cybersecurity event management and maintaining security tooling. The Company also maintains an Information Technology Management Committee, which is comprised of representatives from the Information Security, Information Technology, Enterprise Risk, Operations, and members of executive management. This committee meets at least quarterly to discuss and review the Company's information security program and receives qualitative and quantitative update reports from the Information Security Department, Internal Audit Department, and Information Technology Department.

companyName: MainStreet Bancshares, Inc.

ticker: MNSB

secItem: Item 1C


text: The Company engages third party assessors, consultants and auditors in connection with its information security program, including to conduct external penetration testing, independent audits and risk assessments. The Company also utilizes third party service providers in the ordinary course of business. The Information Security Department performs information security assessments for third party service providers that store or process Company confidential data. These information security assessments include a review of any systems and organization control reports, proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes and third party data protection controls (which can include, but is not limited to: access reviews and controls, backups, monitoring, encryption standards and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.


text: As a regulated financial institution, the Company is also subject to financial privacy laws and its cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see Item 1A – Risk Factors.


text: Although the Company has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that the Company will not experience such an incident in the future.


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use their own electronic information systems. Any of these systems can be compromised, including by employees, customers and other individuals who are authorized to use them, and bad actors using sophisticated and a constantly evolving set of software, tools and strategies to do so. The nature of our business, as a financial-services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. See "Risks Related to Information Security and Business Interruption" section of the Risk Factors included in Item 1A of this 2024 Form 10-K for additional information. Implementing an Information Security Program that establishes policies and procedures for security operations and governance;

companyName: SECURITY FEDERAL CORP

ticker: SFDL


text: Establishing an Information Technology Steering Committee that is responsible for security administration, including conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; Implementing layers of controls and not allowing excessive reliance on any single control; Employing a variety of preventative and detective tools designed to monitor, block and provide alerts regarding suspicious activity; Continuously evaluating tools that can detect and help respond to cybersecurity threats in real-time; Leveraging people, processes and technology to manage and maintain cybersecurity controls; Maintaining a third party risk management program designed to identify, assess and manage risks associated with external service providers; Performing due diligence with respect to our third -party service providers, including their cybersecurity practices;


text: Engaging third -party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; and Conducting periodic cybersecurity training for our employees and the Company's Board.


text: The Information Security Program is a key part of our overall risk management system, which is administered by our Information Technology Steering Committee. The program includes administrative, technical and physical safeguards to help protect the security and confidentiality of customer records and information.


text: From time-to-time, we have identified cybersecurity threats that require us to make changes to our processes and to implement additional safeguards. While we have not experienced cybersecurity incidents that have materially affected our business, operations, or financial condition to date, we recognize that evolving cyber threats present a continuing risk. A successful cybersecurity breach, particularly one affecting our critical systems or third-party service providers, could result in operational disruptions, financial losses, reputational damage, legal or regulatory consequences, and loss of customer confidence. For example, unauthorized access to our systems could lead to data theft, fraud, or extended downtime impacting our ability to provide financial services. If such an event were to occur, it could have a material adverse effect on our results of operations and financial condition.


text: The Company's management team is responsible for the day-to-day management of cybersecurity risks we face and oversees the Information Technology Steering Committee. The Information Technology Steering Committee manages the oversight of the information security assessment, development of policies, standards and procedures, testing, training and security report processes for the Company. The Information Technology Steering Committee is comprised of officers with the appropriate expertise and authority to oversee the Information Security Program.


text: In addition, the Company's Board is responsible for the oversight of risk management, including cybersecurity risks. In that role, the Company's Board, with support from the Company's management and third party cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. The Board reviews and approves an information security program, vendor management policy (including third-party service providers), acceptable use policy, incident response policy and business continuity planning policy on an annual basis. All the aforementioned policies are developed and implemented by management of the Company. To carry out their duties, the Board receives updates from the Information Technology Steering Committee regarding cybersecurity risks and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity.


text: The Company faces various cybersecurity threats. The purpose of the Company's cybersecurity program is to assess, identify, manage and mitigate cybersecurity risk while supporting the achievement of the Company's business objectives.

companyName: NATIONAL PRESTO INDUSTRIES INC

ticker: NPK


text: Under the Company's comprehensive risk management program, the board of directors (the "Board") of the Company maintains oversight of the most significant risks facing the Company, including cybersecurity risks, while senior management is responsible for the identification and prioritization of risks that are material to the Company's business, corresponding risk-mitigation efforts and day-to-day management of the Company's risk management program. At least annually, the Board receives cybersecurity briefings from senior executives.


text: The Company's cybersecurity program sets the framework for the Company's approach to cybersecurity. Each business segment of the Company designates individuals with appropriate qualifications and experience to be responsible for addressing cybersecurity matters, including assessing, identifying and managing risks from cybersecurity threats, with a direct reporting line to senior management. Under the Company's approach to cybersecurity, each business segment designs and operates its own information and cybersecurity program tailored to its market, customer requirements, regulatory requirements and threats. The Company's cybersecurity policy and procedures are designed to ensure senior management receives timely and adequate information regarding cybersecurity matters, including threats and incident response, as appropriate to the matter.


text: As part of the Company's approach to cyber risk management, the Company performs internal audits of internal processes and controls relating to cybersecurity. Every year, the Company engages third -party experts to conduct cyber penetration testing. Based on their findings and recommendations, the Company makes the appropriate updates to its cybersecurity software.


text: Although the Company has designed its cybersecurity program and oversight to mitigate cybersecurity risks, the Company faces unknown cybersecurity risks, threats, and attacks. On March 1, 2025, the Company experienced a system outage caused by a cybersecurity incident. Upon discovery, the Company activated its incident response team, comprised of internal personnel and external cybersecurity experts retained to assist in addressing the incident. While the full scope of the impact is not yet known, the incident could have the potential to have a material impact on the Company's financial condition and results of operations. The Company is continuing its forensic investigation and analysis to assess the potential impact.


text: There can be no assurance the Company will not experience material effects from security breaches in the future. As cyber threats develop and grow, the Company may need to make significant further investments to protect data and its infrastructure, including the implementation of new computer systems or upgrades to existing systems, deployment of additional personnel and protection-related technologies, engagement of third -party consultants, and training employees. See Item 1A - Risk Factors above for additional discussion of various cybersecurity risks.


text: Cybersecurity Risk Management and Strategy We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our critical systems and information. While everyone at our company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by our Board of Directors and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.

companyName: CREATIVE REALITIES, INC.

ticker: CREX


text: Our cybersecurity risk management program includes: physical, technological, and administrative controls intended to support our cybersecurity and data governance framework, including protections designed to protect the confidentiality, integrity, and availability of our key information systems and customer, employee, partner, and other third -party information stored on those systems, such as access controls, encryption, data handling requirements, and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices;


text: a defined procedure for timely incident detection, containment, response, and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents;


text: cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services, and broader enterprise IT environment; cybersecurity awareness training of our employees, incident response personnel, and senior management; a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents;


text: the use of external consultants or other third -party experts and service providers, where considered appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls; and.


text: annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information, such as consumer information.


text: During the year ended December 31, 2024, we did not identify risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents we have experienced from time to time, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material adverse effect on our operations, business strategy, operating results, and financial condition. For more information regarding cybersecurity risks that we face and potential related impacts on our business, see the section titled "Risk Factors" in Part I, Item 1A of this Report.


text: Board Governance Our full Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Our management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risks, including cybersecurity risks, and any actions management has taken to limit, monitor or control those risks. The Board of Directors receives briefings from management periodically on our cyber risk management program and presentations on cybersecurity topics as part of the Board of Directors' continuing education on topics that impact public companies.


text: Risk Management and Strategy Aemetis' cybersecurity and information security framework includes physical, administrative and technical safeguards, as well as plans and procedures we believe are reasonable to help Aemetis prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact our operations, facilities and employees. These plans are based upon our assessment of risk considering our industry, specific operations, cyber perimeter, social exposure, information confidentiality and tertiary stakeholders.

companyName: AEMETIS, INC

ticker: AMTX


text: Our efforts focus on protecting and enhancing the security of our information systems, software, networks, and other assets. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or degrade service or our operations; sabotage systems; or otherwise cause harm to Aemetis, our customers, suppliers, or other key stakeholders. We employ capabilities, processes, and other security measures we believe are designed to reduce and mitigate these risks.


text: Aemetis contracts with a primary Managed Security Provider (MSP) to provide services that assist us with assessing, enhancing, implementing and monitoring our cybersecurity risk management programs and responding to incidents. Aemetis maintains cyber recovery plans as well as a cybersecurity insurance policy.


text: Aemetis utilizes a third -party cybersecurity and information security awareness training programs. Training is administered and tracked through online learning modules and ongoing phishing simulations. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe our controls are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.


text: Role of Management Aemetis' cybersecurity initiative is led by its Chief Financial Officer, who is in the unique position of being able to integrate cybersecurity with the financial internal control framework. He is responsible for administration of the cybersecurity and information security program and risk management, using his experience working with information technology and financial control system during a majority of his career, including over 10 years of overseeing the Aemetis information technology and security program.


text: We utilize a Managed Security Provider (MSP) who serves as the central point for identifying all cybersecurity incidents and reporting, including incidents that directly target company network, internal information systems and incidents originating from third parties. The MSP provides end-to-end operations for the purpose of monitoring, detecting, alerting and responding to cyber incidents. The MSP is also responsible for activating the containment and resolution efforts where appropriate to support Aemetis through the resolution of the incident.


text: The MSP escalates incidents with significant impact and pervasiveness to Aemetis' Chief Financial Officer, who evaluates each incident in terms of its impact on Aemetis and operations, ability to conduct business with customers and suppliers, brand reputation and health, safety or the environment, and the speed and degree to which the incident has been contained. Our Chief Financial Officer, working with the executive management team, also manages the communication with our Board and outside parties. After initial identification, evaluation and escalation for material events, the MSP monitors all cybersecurity incidents for changes in degree of impact or pervasiveness.


text: Role of the Board The Board of Directors ("Board") recognizes the importance of cybersecurity in safeguarding the sensitive data and protecting the perimeter of the computer network. The Board is responsible for overseeing overall risk management for the Corporation, including review of the cybersecurity program. As part of its oversight responsibilities, the Board receives an annual cybersecurity update from the Chief Financial Officer. The annual review includes oversight of cyber exposure, risk assessment, incident response, integration with other control activities, internal monitoring, and risk management processes, such as updates to Aemetis' cybersecurity programs and mitigation strategies, and other cybersecurity developments.


text: SharpLink has established policies and processes for assessing, identifying and managing material cybersecurity risks, and have integrated these processes into our overall risk-management processes. We have also established policies and processes for managing and responding to material cybersecurity incidents.

companyName: Sharplink, Inc.

ticker: SBET


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We devote appropriate resources and designate members of our management, including our Chief Executive Officer and Chief Financial Officer, to manage the risk assessment and mitigation process.


text: Employees are provided specific guidance to mitigate the risk of a cybersecurity attack. This guidance includes safeguards over confidential data, being aware of suspicious emails, choosing and changing passwords, protection of Company issued and use of personal devices, managing large data transfers and use of VPNs when outside the office. Employees are directed to immediately contact either the Chief Financial Officer and Vice President of Affiliate Marketing if they encounter any suspicious activity.


text: We also require appropriate third -party service providers to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect our company. We oversee and identify risks from cybersecurity threats associated with our use of service providers through an onboarding vendor risk management program, including an inherent risk assessment.


text: We have not, to date, experienced a cybersecurity incident which was determined to be material, although, like any technology provider, we have experienced incidents in the past. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K under the heading "Despite our security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. Any such breach could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, and regulatory penalties, disruption of our operations and the services we provide to clients, damage to our reputation, and a loss of confidence in our products and services, each of which could adversely affect our business, financial condition, results of operations and prospects," which should be read in conjunction with the information above.


text: Cybersecurity Governance One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing our strategic risk exposure, and our executive officers are responsible for day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk-oversight function as a whole, as well as through the Audit Committee.


text: Our Chief Financial Officer and Vice President of Affiliate Marketing are responsible for assessing and managing material risks from cybersecurity threats, as well as managing, responding to and reporting material cyber incidents if any occur. They will provide periodic briefings, as required, to the Audit Committee and to the Board of Directors about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, our policies for managing and responding to cybersecurity incidents include procedures for appropriate escalations to our Audit Committee Chair.


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. We continuously work to enhance our cybersecurity risk management program.


text: Cybersecurity Risk Management Program Overview We recognize the critical role that properly managing cybersecurity risk plays in maintaining the trust and confidence of our stockholders, the patients in our clinical trials, our employees, our business partners and our other stakeholders. Accordingly, our cybersecurity program is designed to identify, assess, manage and mitigate material risks from cybersecurity threats through a variety measures, including risk assessments, implementation of security measures, and ongoing monitoring of systems and networks. In collaboration with our third-party IT service providers, a cross-functional team comprised of representatives from our administrative, finance and legal functions actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We also engage external experts, including IT experts, other consultants, and auditors to evaluate our cybersecurity measures and risk management processes.

companyName: CervoMed Inc.

ticker: CRVO


text: We also identify our cybersecurity threat risks by comparing our processes to industry standards and best practices as well as by engaging experts to manage our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, the activities we undertake include the following: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws, as applicable;


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and other evaluations on a routine basis;


text: provide training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: leverage threat intelligence available to us and our third party IT service provider to help us identify, protect, detect, respond and recover if there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Board Oversight of Cybersecurity Risk Management and Governance Our Board is responsible for general oversight of our risk environment and associated management policies and practices and has delegated to its Audit Committee the responsibility for oversight of certain major risk categories and exposures, including with respect to cybersecurity and management's processes to monitor and control them. The Audit Committee meets regularly throughout the year and, on no less than a quarterly basis, receives and reviews a report from management, including the Company's Chief Financial Officer and General Counsel, regarding the Company's IT, cybersecurity, data security, and physical security risk, including any suspected material or immaterial cybersecurity incidents during the preceding quarter, if any, and discusses such matters with appropriate management and other personnel. In addition, on a semi-annual basis, the Audit Committee receives a report from the Company's primary third-party IT and cybersecurity regarding the Company's IT environment, overall cybersecurity risk management program and strategy and education regarding emerging trends and threats.


text: Management's Role in Cybersecurity Risk Management and Governance Our executive management team is responsible for assessing and managing material risks from cybersecurity threats and possess relevant experience and expertise in various disciplines that are key to effectively managing such risks. The experience and expertise of our executive management team is also supplemented by our external IT service providers that collectively have extensive, broad experience and expertise in these areas. Our executive management team reports information about such risks to the Audit Committee of the Board on at least a quarterly basis.


text: We depend on and engage various other third parties, including suppliers, vendors, and service providers, to support key elements of our business including our IT infrastructure. We have implemented various control processes designed to address cybersecurity threat risks associated with our use of such third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, IT, and/or compliance personnel. In addition, cybersecurity risks and posture are, as appropriate and applicable, a factor considered in the selection process prior to our engagement of third-party service providers.


text: In response to an identified cybersecurity incident, a group comprised of appropriate management personnel, our third-party IT service provider and, depending on the scope and severity of the incident, additional third-party subject matters experts, will be assembled to develop and implement a response strategy to contain, control, and remediate the cybersecurity incident, including securing our affected systems and/or information, mitigating harmful effects of the incident, preventing further compromises, and communicating information to affected parties, regulatory agencies and law enforcement, as necessary. This group will also report any such cybersecurity incident to the Audit Committee of the Board.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis by both management and the Board, including how such risks could materially affect our business strategy, operational results, and financial condition, and from time-to-time the Company engages third-parties to provide independent risk assessments.


text: As of the date of this Annual Report, we have not experienced a cybersecurity incident that results in a material effect on our business strategy, results of operations or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such an incident or risks related thereto.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading Item 1A. Risk Factors – General Risks Related to the Company ' s Business and Operations, which disclosures are incorporated by reference herein.


text: Material Effects from Cybersecurity Incidents Our business is subject to risk from cybersecurity threats and incidents, including attempts to gain unauthorized access to our systems or networks, or those of our managers, employees, and third-party vendors and service providers, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. We consider cybersecurity risk a serious threat to our assets and our people and have put processes in place designed to mitigate the risk and impact of any such cybersecurity threat or incident.

companyName: Nuvera Communications, Inc.

ticker: NUVR


text: Our operations rely on the secure, accurate and timely receipt, storage, transmission, use, disclosure, and other processing of confidential and other information (including personal information) in our systems and networks. We also rely on the secure, accurate and timely receipt, storage, transmission, use, disclosure, and other processing of confidential and other information in the systems and networks of our customers and third parties, including suppliers, sellers and servicers, financial market utilities, and other third parties. Cybersecurity risks for companies like ours continue to increase. Like many companies and government entities, from time to time we have been, and expect to continue to be, the target of attempted cybersecurity incidents and other information security threats, including those from nation-state and nation-state supported actors.


text: As of the date of this report we have not experienced or aware of any cybersecurity incidents resulting, or reasonably likely to result in, a material impact to us, including to our business, financial condition, and results of operations. There is no assurance that our cybersecurity risk management program will prevent cybersecurity incidents from having such impacts in the future.


text: Additionally, insider threats also remain a risk given our workforce diversification to include contractors, remote workers, part-time employees, and full-time employees. As referenced above, our third-party vendors and service providers and their supply chain connections remain a potential source of risk.


text: For additional information, see Risk Factors – Risks Related to Our Business. Potential cybersecurity threats are changing rapidly and advancing in sophistication. We may not be able to protect our systems and networks, or the confidentiality of our confidential or other information (including personal information), from cybersecurity incidents and other unauthorized access, disclosure, and disruption.


text: Cybersecurity Risk Management and Strategy Our cybersecurity program is built upon the National Institute for Standards and Technology and other best practice frameworks. We employ processes for assessing, identifying, and managing material risks from cybersecurity threats, including engaging an independent cybersecurity consultant to audit our systems and procedures, make recommendations for improvement and monitor remediation of any identified risks. We also conduct random vulnerability testing including network penetration testing, phishing, and social engineering tests. In addition, we also require Systems and Organization Control ("SOC") type reports from our service providers for our payroll and human resources system and stock administrator.


text: Although we maintain systems and controls designed to prevent cybersecurity breaches from occurring, and we have processes to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of a breach occurring cannot be eliminated entirely. As we engage in more electronic transactions with service customers and vendors, and rely more on cloud-based information systems, the related security risks will increase, and we will need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our internal information technology systems or those of our third-party contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational harm.


text: Cybersecurity Governance All employees of the Company have ownership in managing cybersecurity and data privacy risks, however, oversight responsibility is shared by our BOD, Audit Committee, and cybersecurity management team. The Audit Committee is responsible for implementing our cybersecurity policies and provides regularly updates to the BOD Our cybersecurity management team, in conjunction with our third-party chief information security officer ("CISO"), conduct regular assessment and management of material risks from cybersecurity threats, including review with our internal cybersecurity management team. All employees and consultants are directed to report to our cybersecurity management team any irregular or suspicious activity that could indicate a cybersecurity threat or incident.


text: Nuvera's Senior Information Technology and Transport manager and his staff have primary responsibility for identifying, assessing, and managing our exposure to cybersecurity threats and incidents, subject to oversight by the Audit Committee of the BOD of the processes we establish to assess, monitor, and mitigate that exposure. As members of Nuvera's Cybersecurity Committee, the Information Technology and Transport manager and his team bring a combined sixty years of information technology experience at Nuvera in security, incident response, and local and external network architecture. Executive, Finance and Compliance members of Nuvera's Cybersecurity Committee bring over twenty-five years of experience in risk management, regulatory and compliance. Nuvera relies on their CISO from FRSecure for recommendations and direction on strategy, policy, and process. FRSecure has a team with a combined three hundred years of experience in information security with thirty difference certifications.


text: If a potentially material cybersecurity threat or incident is identified or discovered, the Company's Cybersecurity Management Team will trigger our incidence response plan, including notifying our CEO, CFO, and other relevant business executives. Our Cybersecurity Management Team, along with our CISO, will work with the appropriate leaders and employees in any impacted business groups, as well as appropriate personnel in our finance, legal and other impacted departments, to assess the risks to the Company and potential impact while determining appropriate remediation steps. If executive management determines that a cybersecurity threat or incident could be material to the Company, our management will notify the Audit Committee, who will escalate the risk to our full BOD, depending on an assessment of the risk.


text: Risk Management and Strategy Ensuring the protection of sensitive data is fundamental to our operational integrity and strategic vision. Cybersecurity and data protection form essential pillars of our long-term strategy, safeguarding confidential information concerning our business, employees, customers, suppliers, and shareholders.

companyName: Whitestone REIT

ticker: WSR


text: Our corporate infrastructure, including information technology systems, communication networks, enterprise applications, and financial platforms, serves as vital tools for our business operations. These systems support crucial functions such as tenant and vendor management, internal communications, and financial record-keeping, underscoring the criticality of secure data collection, storage, and transmission.


text: To mitigate material risks posed by cybersecurity threats to our critical networks, third -party services, and data assets, we have instituted a comprehensive suite of information security processes. These measures encompass the diligent identification, assessment, and management of potential risks, threat monitoring services, and vulnerability assessments.


text: Cross-Functional Collaboration and Coordination: We foster collaboration among various departments, including our information security function, legal team, management, and third -party service providers, to effectively identify, assess, and manage cybersecurity risks.


text: Ongoing Evaluation and Assessment of Systems and Processes: We continuously evaluate and enhance our systems and processes to adapt to evolving cybersecurity threats, ensuring the resilience and effectiveness of our security measures.


text: Security Awareness Program: We conduct regular training and testing programs to enhance the cybersecurity awareness and readiness of our personnel, empowering them to actively contribute to our cybersecurity efforts.


text: Additionally, we engage third -party providers to augment our cybersecurity capabilities. These partnerships entail ongoing assistance for threat monitoring and mitigation, as well as targeted support for specialized security expertise.


text: As of December 31, 2024, we have not detected any cybersecurity threats, including prior incidents, that have materially impacted the Company, our business strategy, our financial results, or our financial health. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to our Risk Factors discussion in the section titled "We face risks relating to Cybersecurity attacks, loss of confidential information and other business disruptions" in this Form 10-K.


text: Aligned with our risk management governance structure, our management team oversees the daily management of cybersecurity risk, while our Board and its Audit Committee maintain an active and ongoing oversight role, with the Audit Committee receiving regular reports from management regarding cybersecurity risks and countermeasures being undertaken or considered, including updates to the internal and external cybersecurity landscape and relevant technical developments.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: SERVOTRONICS INC /DE/


text: Our cybersecurity risk management program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to the other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; a security team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security procedures;


text: training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process for service providers, suppliers, and vendors. In the last three fiscal years, the Company has not experienced any material cybersecurity incidents.


text: Cybersecurity Governance The Board of Directors ("the Board") regularly receives reports from our executive officers and third parties on cybersecurity matters. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.


text: Management is responsible for developing cybersecurity programs, including as may be required by applicable law or regulation. These individuals' expertise in IT and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience. They are informed by their respective cybersecurity teams and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.


text: Cybersecurity threats continue to evolve as the threat landscape evolves. The Bank continuously works to evolve its cybersecurity practices with the changing landscape. Significant resources are devoted to protecting and enhancing the security of networks, computer systems, data storage devices, and other systems and technology. The Bank's security efforts and implemented controls are designed to protect against, among other things, cybersecurity attacks that can result in unauthorized access of confidential information, the destruction of data, disruptions to or degradations of service, the sabotaging of systems or other damage.

companyName: RBB Bancorp

ticker: RBB


text: Third parties with which the Bank does business, which facilitate the Bank's business activities, e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries are sources of cybersecurity risk to the Bank. Third-party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises could have a material adverse effect on the Bank, including in circumstances in which an affected third party is unable to deliver a product or service to the Bank or results in lost or compromised information of the Bank or its clients or customers.


text: Bank customers are also sources of cybersecurity risk to the Bank and its information assets, particularly when their activities and systems are beyond the Bank's own security and control systems. The Bank provides information to its customers and other external parties concerning cybersecurity risks including opportunities to reduce cybersecurity risk.


text: The security program is commensurate with the size and complexity of the Bank. Risks from cybersecurity threats, including any previous cybersecurity events, have not materially affected the Bank or its business strategy, results of operations or financial condition.


text: Cybersecurity Risk Management The Bank maintains an Information Security and Cybersecurity Program to support the management of cybersecurity risk as a component of the Bank's Enterprise Risk Management ("ERM") framework. The information security and cybersecurity program is designed to manage risks relating to cybersecurity threats and leverages controls, best practices recommendations, and standards from the Federal Financial Institutions Examination Council ("FFIEC") and the National institute of Standards and Technology ("NIST") Cybersecurity Framework, and standards set by relevant legal and regulatory authorities.


text: The Information Security Officer ("ISO") oversees the Bank's Information Security and Cybersecurity Program and leads the Information Security team. Reporting to the Chief Risk Officer ("CRO") and Chief Information Officer ("CIO"), the ISO and his team are responsible for identifying, assessing and managing information security and cybersecurity risks, and for implementing and maintaining controls to prevent, detect and respond to cybersecurity threats and incidents, safeguarding the confidentiality, integrity and availability of the Bank's information systems and data.


text: As part of the Information Security and Cybersecurity Program, the Bank conducts periodic employee training to educate employees on information and cybersecurity risks and to reinforce security management practices and compliance with the Bank's security policies and standards. Training is mandatory for all employees and is supplemented by testing initiatives, including periodic phishing tests.


text: The Bank's policies and procedures concerning cybersecurity matters include processes to safeguard its information systems, monitor these systems, protect the confidentiality and integrity of its data, detect intrusions into its systems, and respond to cybersecurity incidents. Extensive technical controls are in place for identifying and managing cybersecurity risks and safeguarding Bank information systems and information. The Bank uses sophisticated industry-recognized monitoring and threat detection technologies that continuously monitor its information systems and provide threat detection alerts. The Bank's strategy for assessing, identifying, and managing cybersecurity risks and for evaluating the effectiveness of its cybersecurity program includes periodic risk assessments and testing of its systems, processes and procedures through audits, penetration testing, vulnerability scans, tabletop exercises, and other related exercises.


text: The Bank has an incident response program designed to enable the Bank to respond to cybersecurity incidents, coordinate as appropriate with law enforcement and other government agencies, notify clients and customers, as applicable, and recover from such incidents. In addition, the Bank actively partners with appropriate government and law enforcement agencies and peer industry forums to participate in threat intelligence discussions and simulations to assist with understanding the full spectrum of cybersecurity risks and enhancing defenses and improving resiliency in the Bank's operating environment.


text: The Bank engages third parties on a regular basis to assess, test, audit or assist with the implementation of risk management strategies, policies, and procedures to enhance the detection and management of cybersecurity risks. Cybersecurity risk management strategies include, but are not limited to: consultants who assist with assessing risks, assessing systems alignment with NIST Cybersecurity Framework, and FFIEC, penetration testing, tabletop exercises and other regulatory agency requirements.


text: The Bank maintains a process to evaluate and manage risks associated with third-party service providers. We conduct a full vendor due diligence review before engagement, review specific security measures in our contracts, and maintain continued monitoring during the engagement including yearly due diligence reviews.


text: The IT Committee and Audit Committee are the principal board committees that oversee the Bank's assessment and management of cybersecurity risk, including oversight of the implementation and maintenance of appropriate controls in support of the Bank's Information Security and Cybersecurity Program. Both the IT and Audit Committees are comprised of professionals with risk management and information technology expertise to manage any material risk from a cybersecurity threat standpoint.


text: The membership of the IT Committee includes members of the executive management team as well as directors of the Bank. The CIO and ISO actively participate in all IT Committee meetings. The CIO has over 20 years of work experience in the development, operation and management of Information Technology at financial institutions. The ISO has over 10 years of work experience in building and overseeing cybersecurity programs at financial institutions. Both CIO and ISO have extensive experience and qualifications in various technology and information security disciplines, including relevant experience at the Bank. Additionally, the Audit Committee has oversight of the management of cybersecurity risk via validation and review of IT and cybersecurity risk assessments and audits. The ISO provides reporting metrics on cybersecurity risks to the IT Committee, which meets at least four times a year. The IT and Audit Committees assist the Board of Directors in its oversight.


text: As part of its oversight of management's implementation and maintenance of the Bank's risk management framework, the Bank's Board of Directors receives regular updates directly from both IT and Audit Committees concerning cybersecurity matters. These updates generally include information regarding cybersecurity and technology developments, the Bank's Information Security Program and recommended changes to that program, cybersecurity policies and practices, and ongoing initiatives to improve information security, as well as any significant cybersecurity incidents and the Bank's efforts to address those incidents.


text: Notwithstanding the Bank's efforts at cybersecurity, the Bank cannot guarantee that those efforts will successfully prevent or mitigate a cybersecurity incident that could have a material adverse effect on it. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Bank, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A. Risk Factors– Risks Related to Our Business.


text: Risk Management & Strategy Rocky Brands recognizes the critical importance of developing, implementing, and maintaining a robust information security program to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have established information security programs and policies, including processes for identifying, assessing, and managing risks arising from cybersecurity threats. These processes involve regular assessments of our information systems and infrastructure to identify vulnerabilities and threats. We focus on executing a centralized information technology and cybersecurity program. Our Company-wide approach is to be positioned as one security program, one posture and one roadmap for the enterprise. This platform is administered across our departments by our cybersecurity team led by our Vice President of Information Technology. Our information security programs and policies are aligned with those of the Center for Internet Security (CIS), Control Objectives for Information Technologies (COBIT), and National Institute of Standards Technology (NIST).

companyName: ROCKY BRANDS, INC.

ticker: RCKY


text: We are integrating our information security programs and cybersecurity risk management processes into our overall enterprise risk management ("ERM") strategy. We are developing an entity-wide information technology ERM framework and will take steps to monitor, report on and communicate to stakeholders consistent with our ERM strategy. Recognizing the cybersecurity risk landscape is complex and ever evolving, we engage with a broad group of external experts and consultants, and auditors in evaluating and testing our information security programs. We leverage this specialized expertise to manage threat detection and response management, conduct regular audits and consult on our overall information security programs.


text: We are acutely aware of risks associated with third -party service providers and we incorporate cybersecurity into our third -party vendor management policy. We conduct thorough security assessment to determine the category of risk third parties pose to Rocky Brands, with a priority focus on vendors with products or services that will have access to private and sensitive information. Vendor assessments incorporate inputs, including for example, BitSight and Service Organization Control Type 2 ( "SOC2") information available for our third -party vendors. Our assessments and monitoring are designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Although no cybersecurity incidents during the year ended December 31, 2024 which had a material impact on our business strategy, results of operations or financial condition, the scope and impact of any future incident cannot be predicted. See Item 1A. - Risk Factors for more information about our information security and cybersecurity risks.


text: Our Board of Directors has established governance protocol over risk management, including general oversight of information technology security and cybersecurity risk. The Audit Committee is central to the Board's oversight of cybersecurity risks and is primarily responsible for this domain. The Audit Committee actively participates in discussions with management, external experts and amongst themselves regarding cybersecurity risks. The Audit Committee is comprised of Board members with broad expertise, including technology, risk management and finance, enabling them to effectively oversee and govern cybersecurity risks. One Audit Committee member is certified under the National Association of Corporate Directors Certificate in Cyber-Risk Oversight Program.


text: We have developed a robust organizational structure to manage and oversee our information technology and cybersecurity programs, including full-time information security associates dedicated to cybersecurity. These individuals possess relevant experience and expertise in cybersecurity and risk management. Our Director, IT Infrastructure & Security leads our information security, data privacy and protection, and information technology compliance programs. The Director stays current with security related topics by either webinars, training classes or cybersecurity conferences. Guided by management, our information technology teams maintain a detailed Cyber Incident Response Plan ("CIRP") and hold frequent meetings to ensure the proper communication and execution of our security controls and procedures. The Cybersecurity team has various expertise ranging in Associate of ISC2-CISSP certification and extensive training on current security products. The Director, IT Infrastructure & Security regularly reports to the Vice President of Information Technology and maintains ongoing dialog with the reporting structure to our CEO, CFO and COO, and Board of Directors regarding our information security programs. This reporting includes updates on matters evaluated under our CIRP, the current threat landscape, cybersecurity initiatives, and the effectiveness of our cybersecurity programs.


text: Our Vice President of Information Technology has more than 35 years working as an IT professional, 13 years of which has been at the Company in various roles such as, Programming, Business Analysis, Systems Analysis, Operations, EDI Manager, and Applications Director.


text: Cybersecurity is an area of increasing concern to the management of and investors in CPS. While CPS has been International Traffic in Arms Regulations (ITAR) compliant for many years, that in itself does not mitigate the risks of a cybersecurity incident. The Company is currently also working towards full compliance with NIST 800 - 171 as well as CMMC compliance. In working towards this goal, CPS has retained an outside consulting firm to help us implement the policies, processes and procedures to further mitigate cybersecurity risks.

companyName: CPS TECHNOLOGIES CORP/DE/

ticker: CPSH


text: CPS generally keeps all employee personally identifiable information with its payroll service provider. Each year the provider furnishes us with their Service Organization Controls ("SOC") report which includes their cybersecurity policies and procedures.


text: Management is not aware of any previous cybersecurity incidents of any significance. Nevertheless, there is always a risk that a phishing attempt, ransomware or other attack by a bad actor could be successful. Although CPS is generally down the supply chain from prime contractors, the fact that we do work in the aerospace and defense industries does make us a potential target. Please refer to the risk factors titled " Manufacturing interruptions or delays could affect our ability to meet customer demand and lead to higher costs " and " If we are subject to cyber-attacks, we could incur substantial costs and, if such attacks are successful, we could incur significant liabilities, reputational harm, and disruption to our operations " in "Risk Factors" in Part I, Item 1A of this Form 10 -K for more information on the risks posed to us by cybersecurity threats. Based on information currently available, management does not believe that there is a reasonably likely risk of these issues, nevertheless the possibility of one occurring cannot be completely ruled out.


text: Risk Management Strategy As a financial institution, cybersecurity presents significant risks that could materially impact the Company's operations, financial performance, and reputation. A successful cyberattack could result in operational disruptions, financial losses, regulatory scrutiny, legal liability, and reputational damage. Accordingly, the protection of customer and business information is a top priority. Cybersecurity risk management is a component of the Company's formal Information Security Program. The Information Security Program is incorporated into the Company's Enterprise Risk Management Program, ensuring a holistic approach to risk prevention, detection, mitigation, and remediation of cybersecurity threats.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: The Information Security Program is based on regulation and guidance established by agencies, including but not limited to, the Federal Financial Institutions Counsel ("FFIEC") and the FDIC. The Information Security Program begins with risk assessment. At least annually, the Company's Information Security team completes an information security risk assessment in accordance with regulatory guidance. While cyber threats are included in the overall information security risk assessment, a targeted cybersecurity risk assessment is also completed, utilizing the FFIEC Cybersecurity Assessment Tool ("FFIEC CAT"). The FFIEC CAT specifically assesses the maturity and effectiveness of the Bank's cybersecurity programs. In addition to the FFIEC CAT, the Bank partners with internal and external auditors to conduct various assessments throughout the year to identify, manage, and mitigate cybersecurity risks. The assessments conducted include but are not limited to: vulnerability assessments, penetration testing, social engineering, and onsite security assessments. Risk assessments consider size and complexity, are formally documented, and adapt to changes in the technology and organizational environment. Management and the Board of Directors use risk assessment data to make informed risk management decisions based on a full understanding of the risks. Management and the Board also consider the results of these assessments when overseeing operations. A strong, high-level risk assessment process provides the foundation for more detailed assessments within the functional risk management areas, as well as improves policy and internal control decisions across the organization.


text: Information Security Risk Assessment Information security controls result from an effective risk assessment process. The Company identifies, measures, controls, and monitors threats to avoid risks that threaten the safety and soundness of the organization. In accordance with the Gramm-Leach-Bliley Act (GLBA) and FDIC regulation 12 CFR Part 364 Appendix B III B, the objectives of the information security risk assessment include:


text: Identifying reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems. Assessing the likelihood and potential damage of these threats, taking into consideration the sensitivity of customer information. Assessing the sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risks.


text: Cybersecurity Risk Assessment Cybersecurity is an integral subset of information security and refers to anything intended to protect enterprises and individuals from intentional attacks, breaches, incidents, and consequences. The foundation of this protection begins with identifying the risk of these threats and assessing the controls in place to mitigate such risks. The Company has included cyber threats in its information security risk assessment in accordance with regulatory guidance and conducts a targeted cyber risk assessment using the FFIEC CAT. Utilizing the FFIEC CAT, the Company's inherent risk profile is documented along with its maturity level and effectiveness in managing cyber risk.


text: Both the Information Security Risk Assessment and the FFIEC CAT results are presented to, and approved by, the Audit Committee of the Board of Directors at least annually.


text: Risk Management Plan Once risk assessments are complete, a risk management plan is prepared to ensure controls are developed or enhanced to mitigate risks to acceptable levels. The Risk Management Plan is presented to, and approved by, the Audit Committee of the Board of Directors annually and progress on remediation activities is shared quarterly.


text: Information Security Program Vendor Management. The Company maintains a formally documented Vendor Management Program that includes an information security review of all new and existing third -party vendor relationships. The Vendor Management team ensures initial and ongoing due diligence is performed on all third -party relationships according to policy. Quarterly Vendor Management program updates are provided, and the policy is reviewed and approved annually by the Audit Committee of the Board of Directors.


text: Implementation of a multi-faceted threat intelligence gathering process. The Information Security and Information Technology teams subscribe to several threat intelligence news feeds and regularly attend cybersecurity threat intelligence webinars, trainings, and peer groups. Information on threat gathering is included in a quarterly report to the Board of Directors.


text: Implementation of a multi-layered defense strategy to fortify information protection. Technical, physical, and administrative control redundancies are deployed to ensure multiple layers of protection are in place against cyber threats. Control design and operating effectiveness is tested regularly by independent audit firms and reported to senior management and the Audit Committee of the Board of Directors.


text: Comprehensive security awareness training and testing for all bank employees. Various communication strategies to communicate new and existing cybersecurity threats are used. Employees receive regular virtual and in-person security awareness training through simulated tests, online training courses, company communications, and in-person training and testing events. Training and testing efforts are included in the quarterly update to the Board of Directors.


text: Incident Response. A comprehensive Incident Response Plan has been developed and tested. The Plan contains information for employees to ensure they can recognize, investigate, communicate, prevent, and document an incident that threatens the confidentiality, integrity, or availability of information or systems. All incidents are reported to, and the Plan is reviewed and approved by, the Audit Committee of the Board of Directors.


text: Independent Audit and Testing. The Company's Audit Department schedules and oversees a regular review of program design and effectiveness by independent third -party audit firms that specialize in technology and cybersecurity. Results are reported directly to senior management and the Audit Committee of the Board of Directors.


text: Remediation Tracking. Remediation and tracking sheets are developed for all audit and assessment results. Progress is monitored by the Audit Department and reported to the Audit Committee of the Board of Directors regularly.


text: Cyber Insurance Coverage. The Company maintains a cyber insurance policy as part of its overall risk management strategy to mitigate financial losses in the event of a cybersecurity incident.


text: The Company's Board of Directors provides active oversight of cybersecurity threats in accordance with the Board-approved Information Security Policy and Program. Direct oversight of the Program is delegated to the Audit Committee of the Board of Directors. The Audit Committee has an established risk appetite statement that defines the Company's risk acceptance tolerance. The Audit Committee reviews and approves the Risk Appetite statement annually. The Audit Committee also plays a critical role in overseeing the Bank's efforts to develop, implement, and maintain an effective Information Security Program. With direction and oversight by the Audit Committee, the Bank's Chief Risk Officer ("CRO") oversees the enterprise-wide risk management program, and the Chief Information Officer ("CIO") is the Board-appointed Information Security Officer, responsible for the Information Security Program, including cybersecurity. The CRO and CIO report cybersecurity related matters directly to the Audit Committee.


text: The Information Security team, engaged in enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes, ensures a complete approach to safeguarding the confidentiality, integrity, and availability of sensitive information. The Information Security team consists of experienced information security professionals and is led by the CIO. The CIO has more than 25 years of information technology and banking leadership experience and holds a Certified Information Systems Security Professional ("CISSP") designation. Reporting to the CIO is the Information Security Manager who has more than 10 years of cybersecurity experience in the Financial Institution industry and possesses a master's degree in information systems management with an emphasis in cybersecurity. Complementing the independent Information Security team, is the Information Technology (IT) team. The IT System Administration & Engineering Manager has over eight years financial institution technology experience and a master's degree in information systems management with a cybersecurity management specialization and the Systems Support Manager has over 20 years of financial institution technology experience, ensuring technology operations occur with a security-focused mindset. In addition to experienced information security and information technology teams, the Company engages with industry experts for managed security services. This collaborative effort includes threat intelligence gathering, firewall management, intrusion detection system monitoring, intrusion prevention services, and security information and event management monitoring, ensuring round-the-clock protection.


text: The Vendor Management team ensures compliance with the organization's Vendor Management Policy, including initial and ongoing due diligence of all third -party providers.


text: Risk assessments and risk management plans are developed, communicated, and tracked. Annually, the CIO presents the Information Security Risk Assessment to the IT Steering Committee and to the Audit Committee of the Board of Directors for review and approval. Quarterly, the CIO provides an Information Security Risk Management Plan status report to the Audit Committee and an Information/Cybersecurity Status report to the full Board of Directors. Reports encompass internal information and cybersecurity assessments, business continuity plans, disaster recovery measures, incident response planning and testing, patch management and vendor management program statuses, as well as internal self-audit results. The information security risk assessment and updates on projects aimed at fortifying information security systems and emerging cybersecurity threat insights are communicated to the Audit Committee, maintaining transparency, and ensuring informed decision-making. Annual review and approval of information security-related policies by the Audit Committee underscore our commitment to governance and regulatory compliance.


text: Audits and testing of program effectiveness are coordinated by the Company's Senior Vice President of Audit who oversees the Audit Department and reports to the Audit Committee of the Board of Directors, independent of the technology and cybersecurity functions. The Audit Department utilizes independent third -party audit firms with technology and cybersecurity expertise. Results of all audits and independent assessments are delivered directly to senior management and the Audit Committee of the Board of Directors by the SVP of Audit.


text: The Information Security team serves as the Bank's dedicated cybersecurity incident response team. Cybersecurity incident response is a sub-section of the Bank's Incident Response Plan. The Information Security team handles the technical aspects of the Bank's response to a cybersecurity incident. Escalation instructions are included in the Plan for engaging resources outside the Information Security team. The Board is notified immediately of cybersecurity incidents, as per the incident response instructions.


text: Cybersecurity Incidents As of the reporting period, the Company has not experienced any material cybersecurity incidents that have had a significant impact on operations, data integrity, or financial performance. However, the Company continuously monitors and evaluates cybersecurity threats, including those affecting third -party service providers. While some third -party vendors have reported cybersecurity events, none have materially impacted the Company's systems, computing environments, or customer data. The Company remains committed to enhancing its cybersecurity defenses through ongoing risk assessments, investment in technology, and adherence to industry best practices.


text: Risk management is an essential component of our culture and business model. Guarding against the specific risks posed by cybersecurity threats has been and will continue to be very dynamic in nature, requiring that we remain agile and aware of internal and external changes. We recognize that cybersecurity threats can be among the most critical risks facing large companies. As a result, cybersecurity is treated as a Board-level matter and overseen by the Board. However, both the Board and management have an integral role in the identification, assessment and management of cybersecurity risk.

companyName: US Alliance Corp


text: Management engages third parties with relevant expertise in assessing and managing cybersecurity threats. As a general matter, we take a proactive approach to assessing and monitoring cybersecurity-specific risks that is oriented around monitoring emerging external threats, ensuring controls are in place to identify and manage risk within our technology environment and creating a culture of vigilance across the organization. Annually we hire a third party to test for and resolve weaknesses and vulnerabilities within our systems and applications by using network and infrastructure vulnerability testing.


text: Our awareness and training program creates a risk-aware culture to ensure employees understand cybersecurity threats and are accountable for completing required training. We have an enterprise incident management plan that provides a framework for preparing for, managing and responding to cybersecurity incidents that may arise.


text: No risks from any known cybersecurity incidents have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further discussion related to how cybersecurity risks may impact our performance in the future, see Item 1A. "Risk Factors."


text: Risk Management and Strategy Managing cybersecurity risk is critical to supporting our vision, enabling our strategy, and safely operating our business. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process which covers all Company risks. As part of this process, appropriate personnel collaborate with third-party subject matter experts to gather insights for identifying and assessing material risks associated with cybersecurity threats, their severity, and potential mitigations. Further, we provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity event. Compare our processes to benchmark standards, such as those set by the National Institute of Standards and Technology ("NIST"). Closely monitor emerging data protection laws and implement changes to our processes as needed. Conduct annual cybersecurity management and incident training for employees involved in our systems that contain sensitive data.

companyName: Eton Pharmaceuticals, Inc.

ticker: ETON


text: Run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies as needed. Carry cybersecurity risk insurance that provides protection against potential losses arising from a cybersecurity incident.


text: As part of the above process, we engage third -party services to provide 24 -hour, 365 -day monitoring, escalation, and response to cyber events. In addition to consulting on best practices, we leverage a third -party expert security firm for independent evaluations of our security controls through penetration testing. These evaluations test both the design and the operational effectives of security controls.


text: Our process also addresses material risks from cybersecurity threats associated with our use of third -party service providers, including those in our supply chain, our product development partners, or those who have access to sensitive data or our systems. Third-party risks are included within our broader overall risk assessment process, and cybersecurity considerations are considered during the selection and oversight of our third -party service providers.


text: Our board of directors, in coordination with the Audit Committee, oversees our risk management program, including the management of risks associated with cybersecurity threats. Our board of directors and Audit Committee receive periodic updates on developments in our cybersecurity risk management practices, evolving standards, third-party vulnerability assessments, and information security issues. On an annual basis, our board of directors and the Audit Committee discuss our approach to overseeing cybersecurity threats with senior management, including our Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO").


text: Senior management works collaboratively across the organization to implement a program designed to protect our information systems from cybersecurity threats and to respond to any cybersecurity incidents in accordance with our incident response and recovery plans. A cross-functional team addresses cybersecurity threats and responds to cybersecurity incidents through communications within the team and with third-party experts to stay informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents and report such incidents to the board of directors and the Audit Committee when appropriate.


text: As of the date of this Form 10-K, we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business, strategy, results of operations, or financial condition at this time. For further discussion of the risks associated with cybersecurity incidents, see Part I, Item 1A of this Form 10-K under the risk factor entitled "We rely significantly on information technology and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively."


text: Cybersecurity Risk Management and Strategy We have a multilayered framework for detecting and responding to reasonably foreseeable cybersecurity risks and threats. To protect our information technology ("IT") systems from cybersecurity threats, we use various tools that help prevent, detect, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. In the event of a material change to our systems or operations, we would assess the internal and external threats to the security, confidentiality, integrity, and availability of our data and systems, along with other material risks to our operations. We leverage technical safeguards intended to protect the Company's information systems from cybersecurity threats, including firewalls, threat monitoring, intrusion prevention and detection systems, anti-malware, access controls, privilege management, asset and endpoint management, and ongoing system security assessments. We oversee third -party service providers by conducting vendor diligence and reviews on a regular basis. We monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular network scans, system audits, and intelligence feeds. The results of these assessments are used to improve our security posture through remediation efforts.

companyName: TaoWeave, Inc.

ticker: TWAV


text: We have developed an incident management process designed to coordinate the activities to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate any reputational damage.


text: Our business strategy, results of operations, and financial condition have not been materially affected as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see "Item 1A, Risk Factors" in this Annual Report.


text: Oblong's Director of IT is responsible for assessing and managing cybersecurity risks. It has extensive experience focused on increasing the organization's resilience to security threats and staying current on new developments by monitoring the cybersecurity landscape. The team monitors Oblong's IT environment for potential security threats, investigating and acting on security events to minimize potential risks to the environment.


text: Oblong's Audit Committee engages in oversight of Oblong's cybersecurity risks and receives regular updates from management on technology and security updates and Oblong's assessment of cybersecurity threats and mitigation plans. The Audit Committee oversees the processes over internal controls and financial reporting, including controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. In the event of a material cybersecurity incident affecting our IT systems or data management, the Audit Committee would promptly work to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity incidents.


text: Plumas Bancorp maintains a cyber risk management program that is designed to prevent, detect, and respond to information security threats. The Board of Directors is responsible for oversight of the Company's information security program, which is designed and implemented by management under the direction of the Chief Information Officer. In addition, the Internal Auditor and Risk Management Officer consider cybersecurity threat risks alongside other company risks as part of our overall risk assessment and management process.

companyName: PLUMAS BANCORP

ticker: PLBC


text: The Chief Information Officer supervises the information security team, which is responsible for maintaining and implementing our enterprise-wide cybersecurity strategy, policy, standards, and architecture processes. The Information Security Officer, in coordination with compliance and human resources, conducts annual and ongoing company-wide information security awareness training. The Chief Information Officer and Information Security Officer have combined over 35 years of IT management experience. We have developed processes to identify and oversee risks from cybersecurity threats associated with third-party service providers, which include the information security team assessing cybersecurity robustness during third-party vendor onboarding, the inclusion of protective provisions in third-party vendor agreements, and risk-based monitoring of third-party vendors on an ongoing basis.


text: The Board of Directors receives regular reports from the Chief Information Officer and the Information Security Officer on Plumas Bancorp's cyber risks and threats, the status of projects to strengthen Plumas Bancorp's information security systems, assessments of Plumas Bancorp's security program, and the emerging threat landscape. Additionally, the Chief Information Officer chairs the Technology Steering Committee, which drives awareness, ownership, and alignment across all business functions for effective cybersecurity risk management and reporting. In addition to conducting internal audits, Plumas Bancorp annually engages third parties to audit its information security programs, whose findings are reported to the Audit and Executive Committees of the Board. The Company also engages with key third-party vendors, industry participants, government agencies, and intelligence and law enforcement communities as part of our efforts, which are reported to the Technology Steering Committee and Board of Directors.


text: The Company has experienced and expects that it will continue to experience cyber-based attempts to compromise its information systems, although none, to its knowledge, has had a material adverse effect on its business, financial condition, or results of operations. Like all financial institutions, the Company faces the risks of such threats, the consequences of which could be material. See Item 1A – Risk Factors – "Cybersecurity breaches and technological discussions could damage our reputation and profitability," above. In addition, given the constant and evolving threat of cyber-based attacks, the Company incurs significant costs in its efforts to detect and prevent security breaches and incidents, and these costs may increase in the future.


text: Risk Management and Strategy We have implemented cybersecu rity and data protection policies and procedures to assess, identify and manage risks from cybersecurity threats. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees receive awareness notices and are informed about new email threats and recent phishing attempts and email frauds. We have capable employees with significant expertise in cybersecurity related to our industry. We evaluate, create and deploy advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks. We also engage third -party service providers and consults to support our cyber risk management efforts, including through periodic security testing.

companyName: TABLE TRAC INC

ticker: TBTC


text: Our Information Technology General Controls are firmly established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery.


text: To date, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For additional information about our cybersecurity risks, see "Any disruption in our software and related information technology systems due to a cyber incident could adversely affect our business, operating results and financial condition" under the heading "Risk Factors Relating To Our Business" in Item 1A. of this Annual Report.


text: The Board of Directors has oversight of the cyber security risk management and strategy. The senior leadership, including our Chief Executive Officer and Chief Financial Officer, regularly meets with and provides periodic briefings to our Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our Chief Executive Officer and Chief Financial Officer are responsible for implementing and maintaining our cybersecurity risk assessment and management processes.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Associated Capital Group, Inc.

ticker: ACGP


text: Our cybersecurity risk management program is aligned with the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;


text: a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: training and risk awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process for service providers, suppliers, and vendors.


text: In the last three years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial.


text: The operations of the Company are dependent on technology information and communications systems. A failure of any such system, or a security breach or cyberattack related thereto, could significantly disrupt the Company's operations. The service providers of the Company are also subject to cybersecurity threats. If the Company and/or any service provider of the Company fails to adopt, implement or adhere to adequate cybersecurity measures, or in the event of a breach of any network, information relating to the Company or the Company's operations, as well as personal information relating to the Company's clients, may be lost, damaged or corrupted, or improperly accessed, used or disclosed.


text: Any system failure, security breach or cyberattack on the Company and/or any service provider of the Company could cause the Company to suffer financial loss, disruption to its business, including its trading capabilities and its ability to transfer payments, increased operating costs, liability to third parties, regulatory intervention and reputational damage, among other things, any one or all of which could have a material adverse effect on the Company.


text: Cybersecurity Governance Our Board of Directors is responsible for overseeing cybersecurity threats, among other things. Our Chief Technology Officer, who reports to our Chief Executive Officer and President, provides our senior management and our Board of Directors periodic reports on our cybersecurity risks and any material cybersecurity incidents.


text: Our cybersecurity risk management team, in conjunction with various information technology, internal audit, legal and compliance personnel, has primary responsibility for our overall cybersecurity risk management program.


text: Our team of cybersecurity professionals, led by our Chief Technology Officer, who has over 20 years of experience in the cybersecurity space and advanced training in the field of cybersecurity and technology, has primary responsibility for our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our information technology team also monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk Management and Strategy The Company has processes, policies and procedures for identifying, assessing, managing, and responding to cybersecurity threats and incidents. These are integrated into our overall risk management systems, as overseen by the Board, primarily through the Audit Committee. Our policies and procedures include protocols for assessing potential material impacts from cybersecurity threats, escalating to management and the Board of Directors, engaging external stakeholders, and reporting incidents based on applicable legal requirements.

companyName: OCULUS INC.

ticker: OVTZ


text: We use specialized IT tools and services, including with the support of third -party service providers, to understand, manage, mitigate and continually remediate identified threats. The Company logs identified cybersecurity threats and tracks corresponding risk management activities. Identified cybersecurity threats are discussed with management for resolution planning and escalation. Testing of our security controls in connection with the auditing of our financial systems is completed annually.


text: We regularly evaluate the cybersecurity threats associated with third -party suppliers and service providers that have access to the Company's networks, confidential information, and information systems. We provide third -party vendors, consultants, and partners with detailed security requirements for securing their connections to our IT networks. In addition, we seek to make third -party service providers contractually responsible for identifying and remediating security issues within their technology and service environment.