text: We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to provide alerts and monitor and block suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal and third -party specialists. We also maintain a third -party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the ability to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including notification of and escalation to the appropriate team members as well as executive management and the Board of Directors. The Incident Response Plan is coordinated through the Director of Technology Solutions and key members of management. The Incident Response Plan facilitates coordination across multiple departments and is evaluated at least annually.

companyName: FIRST OF LONG ISLAND CORP

secItem: Item 1C


text: Notwithstanding our defensive measures and processes, the threat posed by cyberattacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyberattacks. To date, the Corporation has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Corporation.


text: The Director of Technology Solutions provides information security updates to the IT Steering Committee and the Risk Committee. Cybersecurity metrics are reported to the IT Steering Committee monthly and to the Risk Committee on a quarterly basis. Security training is provided to all staff through targeted training overseen by the Director of Technology Solutions. All Board members receive cybersecurity training annually.


text: The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program. At least annually, the Director of Technology Solutions and the Chief Risk Officer report to the Risk Committee the overall status of the Information Security Program. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Safeguarding the security and integrity of our systems, networks and data is an important element of our business activities. We invest in resources that help us develop and implement various cybersecurity programs and processes that are designed to assess, identify and manage material risks from cybersecurity threats and to address the ever-evolving cybersecurity landscape.

companyName: PAMT CORP

ticker: PAMT


text: Our cybersecurity program utilizes various risk mitigation techniques to manage cybersecurity risk by deploying enhanced detection tools. We conduct cybersecurity penetration tests, purple team exercises, and risk assessments through both internal subject matter experts and with the support of third parties to identify threats and vulnerabilities that could adversely impact our business operations. We also attempt to assess the cybersecurity risk profile of, and threats related to, our business partners, vendors and service providers through various assertions of their security practices. In the normal course, we engage assessors, consultants and other third parties to assist in various cyber-related matters. The underlying controls of our cybersecurity program utilize recognized practices and standards for cybersecurity and information technology security. Our risk-based approach enables us to design and implement cybersecurity programs that are specific to our corporate resources, customer profiles and business network.


text: Our senior management team oversees our cybersecurity strategy and has the overall responsibility for assessing and managing our exposure to cybersecurity risk, with the audit committee of the board of directors providing board level oversight of the activities conducted by management to monitor and mitigate cybersecurity risks. Our corporate strategy for information security is led by the Chief Technology Officer ("CTO") of our primary operating company, P.A.M. Transport, Inc., who develops and directs our information security strategy and policy. He also oversees the engineering and operations related to cybersecurity and issues the proper response when a cyber threat is detected. Our CTO has 23 years of experience in technology and 17 years in compliance and cybersecurity management. Cybersecurity strategy and updates are reviewed by our senior management team on a periodic basis. The audit committee periodically receives a report on cybersecurity matters and related risk exposure from our CTO or senior management and discusses this exposure and our risk management strategies and related controls with management and the internal and external auditors. When covered during an audit committee meeting, the chair of the audit committee reports on its discussion to the full board.


text: We have experienced, and will continue to experience, cyber incidents in the normal course of our business. While our approach to cybersecurity risk management is intended to mitigate the threat of a cyber attack or other data compromising incident, it may not be successful in preventing all attacks which could have a significant adverse impact to our business and reputation. See "Risk Factors" above for additional information on risks related our business, including from risks related to cyber-attacks, compromised information security, and technology disruptions and failures. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: ZEVRA THERAPEUTICS, INC.

ticker: ZVRA


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: risk assessments designed to help identify material risks from cybersecurity threats to our critical systems, and information;


text: a security team principally responsible for managing ( 1) our cybersecurity risk assessment processes, ( 2) our security controls, and ( 3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; cybersecurity awareness training of our employees, including incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process for key service providers, based on our assessment of their criticality to our operations and respective risk profile. For more information, see " If our security measures are compromised now, or in the future, or the security, confidentiality, integrity or availability of, our information technology systems, software, services, communications or data is compromised, limited or fails, this could result in a material adverse impact, including without limitation, a material interruption to our operations, harm to our reputation, significant fines, penalties and liability, breach or a triggering of data protection laws, privacy policies and data protection obligations, loss of customers or sales, or material disruption of our clinical trials or other business activity. " in the " Risk Factors " section above.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Our management team, including R. LaDuane Clifton, Chief Financial Officer and Treasurer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team includes IT staff such as a Director of IT with more than 21 years of IT-related experience in various roles including managing information security, managing privacy and data protection, evaluating cybersecurity risks, developing cybersecurity strategy, and implementing cybersecurity programs.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: The Company's cybersecurity environment is led by our information technology (IT) group, which, in addition to cybersecurity matters, oversees the Company's IT infrastructure. The IT group is responsible for monitoring and managing the security of the Company's corporate network and enterprise systems, including technical controls, and safety protocols and responding to security threats.

companyName: US ENERGY CORP

ticker: USEG


text: The Company maintains a cybersecurity risk management program that establishes safeguards for protecting the confidentiality, integrity, and availability of our data, technology, and information systems. The program includes general controls for managing changes in and access to the Company's IT environment, cybersecurity awareness and training to help employees identify and mitigate against cybersecurity threats, cybersecurity incident response plans and third-party incident response retainers to help expedite the Company's response in the event of a cybersecurity incident.


text: The Company's Director of IT is primarily responsible for the day-to-day operation of the Company's cybersecurity program and for identifying cybersecurity threats and incidents and managing the material risks associated with the cybersecurity threats. The Company's Director of IT engages third-party vendors and cybersecurity consortiums periodically for cybersecurity-related guidance and certifications. In the event of a cybersecurity incident, the Company's process calls for the Director of IT and Chief Financial Officer, to work to assess and respond to the incident and provide briefings to the Chief Executive Officer and the Audit Committee of the Board of Directors.


text: The Audit Committee is responsible for providing oversight over management's processes to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate any incidents. The Audit Committee also reports material cybersecurity risks to the Board. We believe this risk management process provides visibility and oversight to allow the Board and executive leadership team to make timely, data-driven decisions ensuring that the Company, its employees, investors, and partners are adequately protected.


text: As of and for the year ended December 31, 2024, there have been no cybersecurity incidents that have materially affected the Company's business strategy, results of operations, or financial condition.


text: The Company has established protocols for evaluating, identifying, and mitigating significant risks stemming from cybersecurity threats. These protocols are integrated into the Company's overarching risk management framework, including potential risks arising from the utilization of third-party service providers. Furthermore, the Company has instituted monitoring procedures to proactively address and minimize risks associated with data breaches or security breaches originating from external sources. Periodically, the Company may enlist the expertise of third-party consultants, legal advisors, and audit firms to assess and fortify its risk management systems, as well as to manage and resolve specific cybersecurity incidents, as deemed necessary.

companyName: BLUM HOLDINGS, INC.

ticker: BLMH


text: Under our enterprise risk management initiative, our Board of Directors and the Audit Committee engage in regular discussions with our senior management team, including the Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, to manage cybersecurity threats. The Board and Audit Committee are promptly briefed on any cybersecurity incident surpassing predetermined reporting thresholds, receiving continuous updates until resolution.


text: Cybersecurity threats represent a paramount concern for the Company. Our information systems department collaborates closely with senior management to implement a comprehensive program aimed at safeguarding our information systems and promptly responding to cybersecurity incidents, adhering to established incident response and recovery protocols. Cross-functional teams are deployed across the organization to address and mitigate cybersecurity threats, with senior management overseeing prevention, detection, and remediation efforts in real-time, reporting significant developments to the Board and Audit Committee as necessary.


text: For the fiscal year ending December 31, 2024, no cybersecurity threats were identified that significantly impacted or are expected to significantly impact our business strategy, financial performance, or financial position. However, despite the robust capabilities, processes, and security measures in place, there exists the possibility of undetected vulnerabilities or misjudged risks. While our preventive measures aim to mitigate cybersecurity incidents, absolute security cannot be guaranteed, necessitating ongoing vigilance and adaptability in addressing potential risks.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: LIQUIDMETAL TECHNOLOGIES INC

ticker: LQMT


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: an information technology team principally responsible for managing ( 1) our cybersecurity risk assessment processes, ( 2) our security controls, and ( 3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program.


text: The Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including the Chief Executive Officer and President, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from information technology personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: The Company's information security program is designed to preserve the accuracy and integrity of all forms of information processed by us and to protect such information, including our employees', customers' and end users' personally identifiable information and information related to our operations, from misuse, loss, or theft. Our information security program is founded on principles and standards of the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity issued by the U.S. government.

companyName: Apyx Medical Corp

ticker: APYX


text: The outsourced Chief Information Security Officer ("CISO") works closely with the Chief Financial Officer to collectively manage our global information security, information technology and data privacy programs. The Company's information security program includes a robust set of controls and safeguards for the systems, applications, and databases of the Company and of its third-party vendors. The CISO manages the information security program and sets annual targets and security objectives. The program includes regular risk assessments and recurring internal and external audits to assess the program's maturity and effectiveness. The results of these assessments and audits help inform decisions to make program adjustments and ensure that the program's security objectives are effective and up to date. Additional features of our cybersecurity program include security controls, such as firewalls and intrusion detection systems; data loss prevention tools; penetration testing of network, cloud, and application platforms; security assessments of our third-party vendors; and security awareness education for our employees and specialized training for our information security specialists.


text: We have implemented security monitoring capabilities, designed to alert us to suspicious activity and have developed an incident response program that includes periodic coordinated response exercises designed to restore business operations as quickly and as orderly as possible in the event of a breach. In the event of cyber incident which may be considered "material" under the SEC's disclosure rules, Apyx Medical has established a separate committee comprised of the CISO, Chief Financial Officer, Outside Counsel, Chief Executive Officer, and Department Heads, if necessary. This committee is responsible for determining whether a cyber incident, or series of incidents, is "material" and requires disclosure under Item 1.05 of Form 8-K as well as informing the Board of Directors about the incident from a risk oversight perspective.


text: The Board of Directors oversees risks relating to cybersecurity. The CISO and Chief Financial Officer present to the Board of Directors on a quarterly basis and the results of the risk assessments and audits on at least an annual basis. These reports also include detailed updates on the Company's performance preparing for, preventing, detecting, responding to, and recovering from cyber incidents. Apyx outsources the majority of our IT services and security to a well-respected company in the industry.


text: Failure of our information security program to prevent or detect a cyber incident could result in the compromise of Company and customer information, reputational damage, and/or financial loss. During the periods covered by this report, we did not experience any material cyber incidents and the expenses we incurred from cyber incidents were immaterial. While prior incidents have not had a material impact on us, future incidents could have a material adverse effect on our business, results of operations and cash flows. For additional information about our cybersecurity risks, see Item 1A — Risk Factors on this Annual Report on Form 10-K.


text: We have developed a comprehensive Information Security Program ("ISP") that was designed as the guiding policy to establish standards designed to protect the confidentiality of nonpublic, sensitive personal and business information, protect against potential threats to the security or integrity of such information, and protect against unauthorized access to or use of such information. The ISP applies to all Company employees, contractors, consultants, and third-party vendors as well as all technology owned and operated by the Bank. The scope of the ISP covers customer data as well as the Company's strategic and proprietary information. The Board of Directors approves the ISP annually. Additionally, the Information Technology Steering Committee ("ITSC") must approve significant modifications to the ISP prior to review and approval by the Board of Directors. The Chief Information Officer ("CIO") is responsible for the implementation and maintenance of the ISP.

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: Identification of sources and types of technology threats Tools and processes to manage technology security, such as change control approval, employing a Unified Threat Management System, and usage of anti-virus and anti-spam hardware Ongoing security assessments conducted by third -party vendors, such as vulnerability assessments and penetration testing, and mitigation of any findings Continuous firewall monitoring provided by a third -party vendor Information security training for employees provided by a third -party vendor Annual security audits of third -party vendors Our Information Security Governance Plan ("InfoSec") is a component of the ISP and provides for strategic oversight of critical aspects of the Bank's information security. The objective of InfoSec is to provide a framework for decision-making and accountability for information security issues to ensure that the ISP is actively monitored, and information security permeates through all areas and initiatives across the organization. InfoSec is actively managed by an InfoSec Governance Council ("ISGC") that consists of the Chief Risk Officer ("CRO"), virtual Chief Information Security Officer ("CISO"), Chief Strategy and Innovation Officer ("CSIO"), a cybersecurity focused systems engineer, and the CIO. The CRO, CISO, and CIO are part of the ITSC, along with other executives of the Bank.


text: Security assessments are an ongoing activity within the Bank, and the Security Assessment Policy identifies security assessment requirements and those individuals accountable for ensuring the assessments comply with the requirements. All assessment activities must be approved by the CRO. The coverage of assessments includes, but is not limited to, physical security assessment, information technology general controls audit, vulnerability assessment, penetration testing, and social engineering testing. Results are shared with the ITSC, executive management and the Board of Directors.


text: There is an established Incident Response Program ("IRP") that provides a framework for us to respond quickly, decisively, and appropriately to limit the impact of an adverse event, such as a cybersecurity incident, on customers and information resources. Procedures have been developed that outline the necessary steps should an incident occur, such as incident identification, classification, and escalation. We use a Cybersecurity Assessment Tool to assess our cybersecurity preparedness on a periodic basis. A Cybersecurity Incident Response Team, which is part of our general Incident Response Team, will take the appropriate actions as outlined in the IRP in the event a cybersecurity situation occurs.


text: We do not believe that risks from cybersecurity threats, including the previously disclosed cyber-attack that occurred in April 2023, have materially impacted or are reasonably likely to materially impact our overall business strategy, results of operations, or financial condition. We maintain cybersecurity insurance to cover the costs resulting from cyber-attacks; however, the policy may not cover all losses from cybersecurity incidents. Refer to the discussion on the April 2023 incident in Note 15 - Commitments and Contingent Liabilities of our Consolidated Financial Statements and the discussion of cybersecurity risk in Part I, Item 1A, "Risk Factors".


text: Board of Directors The Board of Directors, in coordination with the Audit Committee, oversees the Company's management of cybersecurity risk. The Board receives monthly reports from the CIO, focusing on cybersecurity and information technology updates. The reports include key insights regarding our security risk score, areas of focus, and metrics from our third-party provider regarding security investigations and incidents as well as the results of training and phishing simulations. The Audit Committee receives periodic updates on information security risk and maturity of our ISP. The Audit Committee also receives reports with the results of security assessments conducted by third-parties.


text: Under the leadership of the CIO, the ITSC serves to improve the effectiveness of information technology at the Bank and ensure alignment with the Bank's strategic business plan and statement of risk appetite. Composition of the ITSC consists of senior management from the business areas. The virtual CISO is a non-voting member of the ITSC. Meetings occur at least bi-annually. The ITSC is tasked with reviewing the Bank's technology, information security, business continuity, digital initiatives, vendor management, and data management strategic direction and providing feedback to management.


text: The ISGC acts on the behalf of and to assist the Board of Directors and executive management in fulfilling its oversight responsibilities regarding the Bank's information security programs and risks. The ISGC is comprised of members from Risk, Information Technology, and other strategic areas within the Bank and meets at least quarterly. The responsibilities of the ISGC include providing strategic oversight and implementation guidance for the ISP, aligning cybersecurity and business objectives, monitoring and reporting on cybersecurity and information security incidents, and promoting a strong culture around information security.


text: As stated above, the CIO is a member of the ISGC, chairs the ITSC, and reports to the CSIO. The CIO has over 40 years of business experience in information technology and cybersecurity and is a Certified Bank Cybersecurity Manager. The virtual CISO is outsourced to a third-party vendor that specializes in partnering with organizations to enhance cybersecurity management and reports to the CRO.


text: Our business heavily relies on various IT and application systems, which contain proprietary and confidential information about our operations, employees, customers, and our customers' customers, including personally identifiable information. These systems are connected to and/or accessed from the Internet and, as a result, are susceptible to cyber-attacks. We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. Our process is supported by both management and our Board of Directors. Organizationally, our businesses are structured as three operating and reportable segments: Ting, Wavelo and Tucows Domains. These segments are decentralized; management and cybersecurity resources are organized both at the parent company level and within each decentralized segment. Each segment has dedicated liaisons for cybersecurity, compliance, and risk management activities.

companyName: TUCOWS INC /PA/

ticker: TCX


text: We maintain and continue to expand our investment in the development of our information security management system ("ISMS"). Our ISMS leverages a risk-based approach and is informed by industry standard guidance, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization for Standardization ("ISO") 27001 Information Security Management System Requirements. A material cyber-attack on Company systems, distribution partners and their key operating systems, or any other third -party partners or vendors and their key operating systems may interrupt the ability to operate the Company's business, damage the Company's reputation, or result in monetary damages. The development of the ISMS is focused on the protections of the confidentiality, integrity, and availability of the Company's information system infrastructure as well as the data in the Company's care, custody and control. The Company engages third parties to evaluate certain aspects of the ISMS, provide threat intelligence, and perform vulnerability assessments and other services as needed.


text: The Company follows an established process to identify and evaluate risks from cybersecurity threats that may arise internally or through the introduction of third parties to the ISMS. This evaluation is part of the Company's risk management process. The process may include, but is not limited to, evaluating the third party's cybersecurity maturity and/or imposing certain contractual conditions.


text: Operationally, the Company maintains Security and Network Operations Centers, which provide 24/7 coverage and support of on-call cybersecurity and network professionals to triage and respond to immediate cybersecurity threats and outages. The Company also assesses cybersecurity risks on a quarterly basis and ranks them according to their risk profile. These risks are communicated to management and to the Board of Directors as part of the normal course of operations.


text: Cybersecurity incidents are responded to in accordance with the Company's established Cybersecurity Incident Response Plan ("IRP"). In the event of an incident, we follow our IRP, which includes evaluation of the severity of the incident based on factors such as the number of assets affected, the extent of the incident, the likelihood of inappropriate data exposure, operational impact and/or reliability impact. Dependent upon the severity of an incident, the incident is escalated to the senior leadership, including the CEO and senior leadership. Senior leadership then determines whether, based on various factors, the incident requires immediate escalation to the Board of Directors and to third -party incident response organizations and notification to functional areas, such as legal and finance, as well as senior leadership and the Board, and external entities, as appropriate and required. We maintain relationships with third -party Digital Forensics and Incident Response ("DFIR") service providers to strengthen our incident response capabilities in the event that we determine the need to augment our effort during an incident and to provide us additional assurance that our responses to complex incidents or highly sophisticated threat actors have been effective and complete.


text: Although the risks from cyber threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future and we continue to closely monitor cyber risk. For a detailed description of the risks related to cybersecurity, see Item 1A. "Risk Factors." of this Annual Report, which should be read in conjunction with this Item 1C.


text: Board Governance and Management The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership manages our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The corporate information security function is responsible for managing and continually enhancing our information security posture and information security infrastructure with the ultimate goal of preventing cybersecurity incidents and reducing their severity to the extent feasible, while simultaneously increasing our resilience in an effort to minimize the business impact should an incident occur.


text: Senior leadership, including our CEO, who also has relevant experience in cybersecurity matters, regularly brief the Board of Directors on our cybersecurity and information security initiatives, and the Board of Directors is apprised of cybersecurity incidents deemed to have a material business impact.


text: Risk Management Strategy We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: While everyone at our company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by our Board of Directors, the audit committee of the Board of Directors ("Audit Committee") and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.


text: Our cybersecurity risk management program includes: physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and customer, employee, bank partner and other third -party information stored on those systems, such as access controls, encryption, data handling requirements and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices;


text: a defined procedure for timely incident detection, containment, response and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents;


text: cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services and broader enterprise Information Technology ("IT") environment; a security team responsible for managing our cybersecurity risk assessment processes and security controls;


text: the use of external consultants or other third -party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls;


text: annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information, such as consumer information; and a third -party risk management process that includes internal vetting of certain third -party vendors and service providers with whom we may share data and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third -party vendor or service provider or otherwise implicating the third -party technology and systems used.


text: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, results of operations or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, refer to Part I, Item 1A "Risk Factors."


text: With oversight from our Board of Directors, the Audit Committee is primarily responsible for assisting our Board of Directors in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including relating to cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including processes and policies for determining risk tolerance, and reviews management's strategies for adequately mitigating and managing identified risks, including risks relating to cybersecurity threats.


text: The Audit Committee receives updates from our Chief Information Officer on our cybersecurity risks on a periodic basis or more frequently if needed, and reviews metrics about cyber threat response preparedness, program maturity milestones, risk mitigation status, third party service providers and the current and emerging threat landscape. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity threats or incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to our Board of Directors regarding its activities, including those related to key cybersecurity risks, mitigation strategies and ongoing developments, on a periodic basis or more frequently as needed. The Board of Directors also receives updates from our Chief Information Officer on our cyber risk management program and other matters relating to our data privacy and cybersecurity approach, including risk mitigations to bolster and enhance our data protection and data governance framework. Members of our Board of Directors receive presentations that include cybersecurity topics and the management of key cybersecurity risks from our Chief Information Officer as part of the continuing education of our Board of Directors on topics that impact public companies.


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis, and supervises both our internal cybersecurity personnel and the relationship with our retained external cybersecurity consultants. Our Chief Information Officer's experience includes over 10 years of working in the cybersecurity field in various industries, including the financial services industry.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Holley recognizes the importance of maintaining the safety and security of our information systems and data and has risk-based processes in place for overseeing and managing material risks from cybersecurity threats. Our cybersecurity program, which is further described below, is supported by our information technology team, management and our board of directors. Additionally, our cybersecurity processes and reporting structure are incorporated into our enterprise risk management program, which addresses both the corporate information technology environment and customer-facing products. We will continue to invest in the security and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.

companyName: Holley Inc.

ticker: HLLY


text: Management ' s Role Holley's information technology team, which is responsible for developing and implementing our cybersecurity program, currently operates under the oversight of our Chief Information Officer ("CIO"). The CIO is generally responsible for managing risks from cybersecurity threats, as well as overseeing the safeguarding and fortification of our networks and systems. The CIO reports directly to the Chief Financial Officer ("CFO"). Combined the two have a proven track record in developing and leading data science teams. The CFO's expertise in business, finance and technology enables him to guide the team in making strategic information technology investments that strike a balance between growth opportunities, risk mitigation and return on investment. The information technology team is comprised of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, penetration testing processes and methodologies, and risk communication and reporting. Our Chief Information Officer ("CIO") is overseeing our cybersecurity program and is responsible for the management and oversight of Holley's cybersecurity program.


text: Our board of directors, in coordination with the Audit Committee, oversees Holley's enterprise risk management activities, including the management of risks from cybersecurity threats. Our Audit Committee directly oversees our cybersecurity program. The Audit Committee receives updates, biannually or more frequently, as needed, from management on the Company's cyber risk management processes, including reports on risk trends related to cybersecurity. If a cybersecurity incident is identified, the information technology team, in conjunction with management, will take appropriate actions to mitigate and remediate the incident in a timely manner. Management will determine the materiality of the incident and inform the Audit Committee, as appropriate.


text: Technical Safeguards and Continuous Monitoring As part of our cybersecurity program, we regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. We utilize data analytics to detect anomalies and search for cyber threats. Our cybersecurity processes include a continuous monitoring system which supports comprehensive cyber threat detection and response capabilities and complements the technology, processes and threat detection techniques we use to monitor, manage and mitigate cybersecurity threats. Cyber partners are a key part of Holley's cybersecurity infrastructure. We partner with leading cybersecurity companies, leveraging third -party technology and expertise. We engage with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in our environment.


text: Training and Awareness We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access participate annually in required training, including privacy and security training designed to enhance employee awareness of how to detect and respond to cybersecurity threats. We have created an Incident Response Plan that provides our support team with a clear framework for effectively responding to significant incidents.


text: Our information technology team is responsible for identifying and managing any cybersecurity threats that occur with our vendors and suppliers. The team communicates with our suppliers and vendors and relies on them to apprise Holley of any cybersecurity issues.


text: W e have not identified risks from cybersecurity threats that have materially affected us, including our financial position, results of operations, cash flows, or reputation, although certain risks, if realized, are reasonably likely to materially affect us. For more information regarding the risks we face from cybersecurity threats and how those risks could affect us, please see Item 1A. "Risk Factors. "


text: The Company relies extensively on various information systems and other electronic resources to operate its business. In addition, nearly all of the Company's customers, service providers and other business partners on whom the Company depends, including the providers of the Company's online banking, mobile banking and accounting systems, use these systems and their own electronic information systems. Any of these systems can be compromised, including by employees, customers and other individuals who are authorized to use them, and bad actors using sophisticated and constantly evolving set of software, tools and strategies to do so. The nature of the Company's business, as a financial services provider, and the Company's relative size, make the Company and its business partners high-value targets for these bad actors to pursue. See Item 1A. Risk Factors—Operational, Strategic and Reputational Risks of this Form 10-K for additional information.

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: Accordingly, the Company has devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, as noted below:


text: Identifying and assessing cybersecurity threats: The Company regularly evaluates its systems and data for potential vulnerabilities and analyzes the evolving cyber threat landscape, to ensure it proactively addresses risks before they materialize. The Company employs monitoring tools that can detect and help respond to cybersecurity threats in real-time.


text: Cybersecurity risks are seamlessly integrated into the Company's broader risk management framework, ensuring a holistic view and prioritized mitigation strategies.


text: Management of Third-Party Risk: The Company's comprehensive third -party management process includes rigorous due diligence, oversight and identification of cybersecurity risks associated with vendors and service providers.


text: The Company has an internal cybersecurity team that is responsible for conducting regular assessments of its information systems, existing controls, vulnerabilities and potential improvements.


text: The Company leverages the expertise of independent consultants, legal advisors, and audit firms to evaluate the effectiveness of our risk management systems and address potential cybersecurity incidents efficiently. Training: The Company conducts periodic cybersecurity training for its workforce.


text: This information security program is a key part of the Company's overall risk management system, which is administered by the Director of Information Security. The program includes administrative, technical and physical safeguards to help protect the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of the Company's businesses and geographic locations.


text: From time-to-time, the Company has identified cybersecurity threats and cybersecurity incidents that require the Company to make changes to its processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected the Company, it is possible that threats and incidents the Company identifies in the future could have a material adverse effect on its business strategy, results of operations and financial condition.


text: The Company's management team is responsible for the day-to-day management of cybersecurity risks it faces, including the Company's Executive Vice President and Chief Operating Officer and Director of Information Security. The Company's current Director of Information Security has over 29 years of experience. For the past 8 years, the Company's Director of Information Security has successfully managed teams, implementing and maintaining robust cybersecurity and data protection controls to safeguard the Company's information assets. The Company's Director of Information Security reports directly to our Executive Vice President and Chief Operating Officer, who possesses extensive expertise gained through over 30 years in various risk, operations and leadership roles. This combined experience ensures exceptional guidance and oversight of our cybersecurity program.


text: In addition, the Board, both as a whole and through its Risk Committee (the "Risk Committee"), is responsible for the oversight of risk management, including cybersecurity risks. In that role, the Board and the Risk Committee, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, both the Board and the Risk Committee receive quarterly reports from the Company's management team regarding cybersecurity risks and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents.


text: The Company recognizes the critical importance of identifying, assessing and managing material risks from cybersecurity threats and is committed to implementing and maintaining a comprehensive information security program to manage such risks and safeguard its systems and data.

companyName: MainStreet Bancshares, Inc.

ticker: MNSB


text: The Company's Board of Directors has ultimate oversight of cybersecurity-related risks and it is assisted in this role by the Technology Committee and the Audit & Risk Committee. Processes for identifying, assessing, and managing cybersecurity-related risks are integrated into the Company's overall enterprise risk management process, which is overseen by the Audit & Risk Committee. The Audit & Risk Committee is responsible for monitoring risks that are being taken by the Company, understanding the enterprise-wide effect of those risks and reporting such risks to the Board. In fulfilling this role, the Technology Committee has primary oversight responsibility over management's efforts to manage and mitigate cybersecurity-related risk and reviews and approves the Company's cybersecurity strategy for protecting the Company's information assets and technology platforms. The Audit & Risk Committee oversees the Company's outsourced Internal Audit Department, which conducts reviews and assessments related to information security. Management provides periodic reports to the Technology Committee and the Audit & Risk Committee, both of which provide reports of their meetings to the full Board. These reports to the Board and its Committees address the threat environment, vulnerability assessments, specific cyber incidents and management's efforts to monitor, detect and prevent cyber threats.


text: The Company's information security program is primarily administered at the management level by the Information Security Department, which is led by the Company's Chief Information Officer (CIO), and is supported by Chief Information Security Officer (CISO), and the Information Technology Department, which is led by the Company's Chief Technology Officer (CTO). The Company's Information Security Department is responsible for day-to-day management of the Company's information security program, including data loss prevention, access control, threat monitoring, incident response and employee education and training. The Information Security Department also maintains policies related to cybersecurity and data security that provide the required governance for the information security program. Additionally, the Company's Information Technology Department maintains policies that govern technical aspects of the Company's information security program. Each policy is reviewed and approved by the Board at least annually. The Information Security team maintains and runs the Company's security operations center and is responsible for cybersecurity event management and maintaining security tooling. The Company also maintains an Information Technology Management Committee, which is comprised of representatives from the Information Security, Information Technology, Enterprise Risk, Operations, and members of executive management. This committee meets at least quarterly to discuss and review the Company's information security program and receives qualitative and quantitative update reports from the Information Security Department, Internal Audit Department, and Information Technology Department.


text: The Company engages third party assessors, consultants and auditors in connection with its information security program, including to conduct external penetration testing, independent audits and risk assessments. The Company also utilizes third party service providers in the ordinary course of business. The Information Security Department performs information security assessments for third party service providers that store or process Company confidential data. These information security assessments include a review of any systems and organization control reports, proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes and third party data protection controls (which can include, but is not limited to: access reviews and controls, backups, monitoring, encryption standards and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.


text: As a regulated financial institution, the Company is also subject to financial privacy laws and its cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see Item 1A – Risk Factors.


text: Although the Company has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that the Company will not experience such an incident in the future.


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use their own electronic information systems. Any of these systems can be compromised, including by employees, customers and other individuals who are authorized to use them, and bad actors using sophisticated and a constantly evolving set of software, tools and strategies to do so. The nature of our business, as a financial-services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. See "Risks Related to Information Security and Business Interruption" section of the Risk Factors included in Item 1A of this 2024 Form 10-K for additional information. Implementing an Information Security Program that establishes policies and procedures for security operations and governance;

companyName: SECURITY FEDERAL CORP

ticker: SFDL


text: Establishing an Information Technology Steering Committee that is responsible for security administration, including conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; Implementing layers of controls and not allowing excessive reliance on any single control; Employing a variety of preventative and detective tools designed to monitor, block and provide alerts regarding suspicious activity; Continuously evaluating tools that can detect and help respond to cybersecurity threats in real-time; Leveraging people, processes and technology to manage and maintain cybersecurity controls; Maintaining a third party risk management program designed to identify, assess and manage risks associated with external service providers; Performing due diligence with respect to our third -party service providers, including their cybersecurity practices;


text: Engaging third -party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; and Conducting periodic cybersecurity training for our employees and the Company's Board.


text: The Information Security Program is a key part of our overall risk management system, which is administered by our Information Technology Steering Committee. The program includes administrative, technical and physical safeguards to help protect the security and confidentiality of customer records and information.


text: From time-to-time, we have identified cybersecurity threats that require us to make changes to our processes and to implement additional safeguards. While we have not experienced cybersecurity incidents that have materially affected our business, operations, or financial condition to date, we recognize that evolving cyber threats present a continuing risk. A successful cybersecurity breach, particularly one affecting our critical systems or third-party service providers, could result in operational disruptions, financial losses, reputational damage, legal or regulatory consequences, and loss of customer confidence. For example, unauthorized access to our systems could lead to data theft, fraud, or extended downtime impacting our ability to provide financial services. If such an event were to occur, it could have a material adverse effect on our results of operations and financial condition.


text: The Company's management team is responsible for the day-to-day management of cybersecurity risks we face and oversees the Information Technology Steering Committee. The Information Technology Steering Committee manages the oversight of the information security assessment, development of policies, standards and procedures, testing, training and security report processes for the Company. The Information Technology Steering Committee is comprised of officers with the appropriate expertise and authority to oversee the Information Security Program.


text: In addition, the Company's Board is responsible for the oversight of risk management, including cybersecurity risks. In that role, the Company's Board, with support from the Company's management and third party cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. The Board reviews and approves an information security program, vendor management policy (including third-party service providers), acceptable use policy, incident response policy and business continuity planning policy on an annual basis. All the aforementioned policies are developed and implemented by management of the Company. To carry out their duties, the Board receives updates from the Information Technology Steering Committee regarding cybersecurity risks and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity.


text: The Company faces various cybersecurity threats. The purpose of the Company's cybersecurity program is to assess, identify, manage and mitigate cybersecurity risk while supporting the achievement of the Company's business objectives.

companyName: NATIONAL PRESTO INDUSTRIES INC

ticker: NPK


text: Under the Company's comprehensive risk management program, the board of directors (the "Board") of the Company maintains oversight of the most significant risks facing the Company, including cybersecurity risks, while senior management is responsible for the identification and prioritization of risks that are material to the Company's business, corresponding risk-mitigation efforts and day-to-day management of the Company's risk management program. At least annually, the Board receives cybersecurity briefings from senior executives.


text: The Company's cybersecurity program sets the framework for the Company's approach to cybersecurity. Each business segment of the Company designates individuals with appropriate qualifications and experience to be responsible for addressing cybersecurity matters, including assessing, identifying and managing risks from cybersecurity threats, with a direct reporting line to senior management. Under the Company's approach to cybersecurity, each business segment designs and operates its own information and cybersecurity program tailored to its market, customer requirements, regulatory requirements and threats. The Company's cybersecurity policy and procedures are designed to ensure senior management receives timely and adequate information regarding cybersecurity matters, including threats and incident response, as appropriate to the matter.


text: As part of the Company's approach to cyber risk management, the Company performs internal audits of internal processes and controls relating to cybersecurity. Every year, the Company engages third -party experts to conduct cyber penetration testing. Based on their findings and recommendations, the Company makes the appropriate updates to its cybersecurity software.


text: Although the Company has designed its cybersecurity program and oversight to mitigate cybersecurity risks, the Company faces unknown cybersecurity risks, threats, and attacks. On March 1, 2025, the Company experienced a system outage caused by a cybersecurity incident. Upon discovery, the Company activated its incident response team, comprised of internal personnel and external cybersecurity experts retained to assist in addressing the incident. While the full scope of the impact is not yet known, the incident could have the potential to have a material impact on the Company's financial condition and results of operations. The Company is continuing its forensic investigation and analysis to assess the potential impact.


text: There can be no assurance the Company will not experience material effects from security breaches in the future. As cyber threats develop and grow, the Company may need to make significant further investments to protect data and its infrastructure, including the implementation of new computer systems or upgrades to existing systems, deployment of additional personnel and protection-related technologies, engagement of third -party consultants, and training employees. See Item 1A - Risk Factors above for additional discussion of various cybersecurity risks.


text: We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our critical systems and information. While everyone at our company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by our Board of Directors and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.

companyName: CREATIVE REALITIES, INC.

ticker: CREX


text: Our cybersecurity risk management program includes: physical, technological, and administrative controls intended to support our cybersecurity and data governance framework, including protections designed to protect the confidentiality, integrity, and availability of our key information systems and customer, employee, partner, and other third -party information stored on those systems, such as access controls, encryption, data handling requirements, and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices;


text: a defined procedure for timely incident detection, containment, response, and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents;


text: cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services, and broader enterprise IT environment; cybersecurity awareness training of our employees, incident response personnel, and senior management; a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents;


text: the use of external consultants or other third -party experts and service providers, where considered appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls; and.


text: annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information, such as consumer information.


text: During the year ended December 31, 2024, we did not identify risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents we have experienced from time to time, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material adverse effect on our operations, business strategy, operating results, and financial condition. For more information regarding cybersecurity risks that we face and potential related impacts on our business, see the section titled "Risk Factors" in Part I, Item 1A of this Report.


text: Board Governance Our full Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Our management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risks, including cybersecurity risks, and any actions management has taken to limit, monitor or control those risks. The Board of Directors receives briefings from management periodically on our cyber risk management program and presentations on cybersecurity topics as part of the Board of Directors' continuing education on topics that impact public companies.


text: Risk Management and Strategy Aemetis' cybersecurity and information security framework includes physical, administrative and technical safeguards, as well as plans and procedures we believe are reasonable to help Aemetis prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact our operations, facilities and employees. These plans are based upon our assessment of risk considering our industry, specific operations, cyber perimeter, social exposure, information confidentiality and tertiary stakeholders.

companyName: AEMETIS, INC

ticker: AMTX


text: Our efforts focus on protecting and enhancing the security of our information systems, software, networks, and other assets. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or degrade service or our operations; sabotage systems; or otherwise cause harm to Aemetis, our customers, suppliers, or other key stakeholders. We employ capabilities, processes, and other security measures we believe are designed to reduce and mitigate these risks.


text: Aemetis contracts with a primary Managed Security Provider (MSP) to provide services that assist us with assessing, enhancing, implementing and monitoring our cybersecurity risk management programs and responding to incidents. Aemetis maintains cyber recovery plans as well as a cybersecurity insurance policy.


text: Aemetis utilizes a third -party cybersecurity and information security awareness training programs. Training is administered and tracked through online learning modules and ongoing phishing simulations. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe our controls are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.


text: Role of Management Aemetis' cybersecurity initiative is led by its Chief Financial Officer, who is in the unique position of being able to integrate cybersecurity with the financial internal control framework. He is responsible for administration of the cybersecurity and information security program and risk management, using his experience working with information technology and financial control system during a majority of his career, including over 10 years of overseeing the Aemetis information technology and security program.


text: We utilize a Managed Security Provider (MSP) who serves as the central point for identifying all cybersecurity incidents and reporting, including incidents that directly target company network, internal information systems and incidents originating from third parties. The MSP provides end-to-end operations for the purpose of monitoring, detecting, alerting and responding to cyber incidents. The MSP is also responsible for activating the containment and resolution efforts where appropriate to support Aemetis through the resolution of the incident.


text: The MSP escalates incidents with significant impact and pervasiveness to Aemetis' Chief Financial Officer, who evaluates each incident in terms of its impact on Aemetis and operations, ability to conduct business with customers and suppliers, brand reputation and health, safety or the environment, and the speed and degree to which the incident has been contained. Our Chief Financial Officer, working with the executive management team, also manages the communication with our Board and outside parties. After initial identification, evaluation and escalation for material events, the MSP monitors all cybersecurity incidents for changes in degree of impact or pervasiveness.


text: Role of the Board The Board of Directors ("Board") recognizes the importance of cybersecurity in safeguarding the sensitive data and protecting the perimeter of the computer network. The Board is responsible for overseeing overall risk management for the Corporation, including review of the cybersecurity program. As part of its oversight responsibilities, the Board receives an annual cybersecurity update from the Chief Financial Officer. The annual review includes oversight of cyber exposure, risk assessment, incident response, integration with other control activities, internal monitoring, and risk management processes, such as updates to Aemetis' cybersecurity programs and mitigation strategies, and other cybersecurity developments.


text: SharpLink has established policies and processes for assessing, identifying and managing material cybersecurity risks, and have integrated these processes into our overall risk-management processes. We have also established policies and processes for managing and responding to material cybersecurity incidents.

companyName: Sharplink, Inc.

ticker: SBET


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We devote appropriate resources and designate members of our management, including our Chief Executive Officer and Chief Financial Officer, to manage the risk assessment and mitigation process.


text: Employees are provided specific guidance to mitigate the risk of a cybersecurity attack. This guidance includes safeguards over confidential data, being aware of suspicious emails, choosing and changing passwords, protection of Company issued and use of personal devices, managing large data transfers and use of VPNs when outside the office. Employees are directed to immediately contact either the Chief Financial Officer and Vice President of Affiliate Marketing if they encounter any suspicious activity.


text: We also require appropriate third -party service providers to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect our company. We oversee and identify risks from cybersecurity threats associated with our use of service providers through an onboarding vendor risk management program, including an inherent risk assessment.


text: We have not, to date, experienced a cybersecurity incident which was determined to be material, although, like any technology provider, we have experienced incidents in the past. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K under the heading "Despite our security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. Any such breach could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, and regulatory penalties, disruption of our operations and the services we provide to clients, damage to our reputation, and a loss of confidence in our products and services, each of which could adversely affect our business, financial condition, results of operations and prospects," which should be read in conjunction with the information above.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing our strategic risk exposure, and our executive officers are responsible for day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk-oversight function as a whole, as well as through the Audit Committee.


text: Our Chief Financial Officer and Vice President of Affiliate Marketing are responsible for assessing and managing material risks from cybersecurity threats, as well as managing, responding to and reporting material cyber incidents if any occur. They will provide periodic briefings, as required, to the Audit Committee and to the Board of Directors about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, our policies for managing and responding to cybersecurity incidents include procedures for appropriate escalations to our Audit Committee Chair.


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. We continuously work to enhance our cybersecurity risk management program.


text: Cybersecurity Risk Management Program Overview We recognize the critical role that properly managing cybersecurity risk plays in maintaining the trust and confidence of our stockholders, the patients in our clinical trials, our employees, our business partners and our other stakeholders. Accordingly, our cybersecurity program is designed to identify, assess, manage and mitigate material risks from cybersecurity threats through a variety measures, including risk assessments, implementation of security measures, and ongoing monitoring of systems and networks. In collaboration with our third-party IT service providers, a cross-functional team comprised of representatives from our administrative, finance and legal functions actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We also engage external experts, including IT experts, other consultants, and auditors to evaluate our cybersecurity measures and risk management processes.

companyName: CervoMed Inc.

ticker: CRVO


text: We also identify our cybersecurity threat risks by comparing our processes to industry standards and best practices as well as by engaging experts to manage our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, the activities we undertake include the following: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws, as applicable;


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and other evaluations on a routine basis;


text: provide training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: leverage threat intelligence available to us and our third party IT service provider to help us identify, protect, detect, respond and recover if there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Board Oversight of Cybersecurity Risk Management and Governance Our Board is responsible for general oversight of our risk environment and associated management policies and practices and has delegated to its Audit Committee the responsibility for oversight of certain major risk categories and exposures, including with respect to cybersecurity and management's processes to monitor and control them. The Audit Committee meets regularly throughout the year and, on no less than a quarterly basis, receives and reviews a report from management, including the Company's Chief Financial Officer and General Counsel, regarding the Company's IT, cybersecurity, data security, and physical security risk, including any suspected material or immaterial cybersecurity incidents during the preceding quarter, if any, and discusses such matters with appropriate management and other personnel. In addition, on a semi-annual basis, the Audit Committee receives a report from the Company's primary third-party IT and cybersecurity regarding the Company's IT environment, overall cybersecurity risk management program and strategy and education regarding emerging trends and threats.


text: Management's Role in Cybersecurity Risk Management and Governance Our executive management team is responsible for assessing and managing material risks from cybersecurity threats and possess relevant experience and expertise in various disciplines that are key to effectively managing such risks. The experience and expertise of our executive management team is also supplemented by our external IT service providers that collectively have extensive, broad experience and expertise in these areas. Our executive management team reports information about such risks to the Audit Committee of the Board on at least a quarterly basis.


text: We depend on and engage various other third parties, including suppliers, vendors, and service providers, to support key elements of our business including our IT infrastructure. We have implemented various control processes designed to address cybersecurity threat risks associated with our use of such third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, IT, and/or compliance personnel. In addition, cybersecurity risks and posture are, as appropriate and applicable, a factor considered in the selection process prior to our engagement of third-party service providers.


text: In response to an identified cybersecurity incident, a group comprised of appropriate management personnel, our third-party IT service provider and, depending on the scope and severity of the incident, additional third-party subject matters experts, will be assembled to develop and implement a response strategy to contain, control, and remediate the cybersecurity incident, including securing our affected systems and/or information, mitigating harmful effects of the incident, preventing further compromises, and communicating information to affected parties, regulatory agencies and law enforcement, as necessary. This group will also report any such cybersecurity incident to the Audit Committee of the Board.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis by both management and the Board, including how such risks could materially affect our business strategy, operational results, and financial condition, and from time-to-time the Company engages third-parties to provide independent risk assessments.


text: As of the date of this Annual Report, we have not experienced a cybersecurity incident that results in a material effect on our business strategy, results of operations or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such an incident or risks related thereto.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading Item 1A. Risk Factors – General Risks Related to the Company ' s Business and Operations, which disclosures are incorporated by reference herein.


text: Material Effects from Cybersecurity Incidents Our business is subject to risk from cybersecurity threats and incidents, including attempts to gain unauthorized access to our systems or networks, or those of our managers, employees, and third-party vendors and service providers, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. We consider cybersecurity risk a serious threat to our assets and our people and have put processes in place designed to mitigate the risk and impact of any such cybersecurity threat or incident.

companyName: Nuvera Communications, Inc.

ticker: NUVR


text: Our operations rely on the secure, accurate and timely receipt, storage, transmission, use, disclosure, and other processing of confidential and other information (including personal information) in our systems and networks. We also rely on the secure, accurate and timely receipt, storage, transmission, use, disclosure, and other processing of confidential and other information in the systems and networks of our customers and third parties, including suppliers, sellers and servicers, financial market utilities, and other third parties. Cybersecurity risks for companies like ours continue to increase. Like many companies and government entities, from time to time we have been, and expect to continue to be, the target of attempted cybersecurity incidents and other information security threats, including those from nation-state and nation-state supported actors.


text: As of the date of this report we have not experienced or aware of any cybersecurity incidents resulting, or reasonably likely to result in, a material impact to us, including to our business, financial condition, and results of operations. There is no assurance that our cybersecurity risk management program will prevent cybersecurity incidents from having such impacts in the future.


text: Additionally, insider threats also remain a risk given our workforce diversification to include contractors, remote workers, part-time employees, and full-time employees. As referenced above, our third-party vendors and service providers and their supply chain connections remain a potential source of risk.


text: For additional information, see Risk Factors – Risks Related to Our Business. Potential cybersecurity threats are changing rapidly and advancing in sophistication. We may not be able to protect our systems and networks, or the confidentiality of our confidential or other information (including personal information), from cybersecurity incidents and other unauthorized access, disclosure, and disruption.


text: Our cybersecurity program is built upon the National Institute for Standards and Technology and other best practice frameworks. We employ processes for assessing, identifying, and managing material risks from cybersecurity threats, including engaging an independent cybersecurity consultant to audit our systems and procedures, make recommendations for improvement and monitor remediation of any identified risks. We also conduct random vulnerability testing including network penetration testing, phishing, and social engineering tests. In addition, we also require Systems and Organization Control ("SOC") type reports from our service providers for our payroll and human resources system and stock administrator.


text: Although we maintain systems and controls designed to prevent cybersecurity breaches from occurring, and we have processes to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of a breach occurring cannot be eliminated entirely. As we engage in more electronic transactions with service customers and vendors, and rely more on cloud-based information systems, the related security risks will increase, and we will need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our internal information technology systems or those of our third-party contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational harm.


text: All employees of the Company have ownership in managing cybersecurity and data privacy risks, however, oversight responsibility is shared by our BOD, Audit Committee, and cybersecurity management team. The Audit Committee is responsible for implementing our cybersecurity policies and provides regularly updates to the BOD Our cybersecurity management team, in conjunction with our third-party chief information security officer ("CISO"), conduct regular assessment and management of material risks from cybersecurity threats, including review with our internal cybersecurity management team. All employees and consultants are directed to report to our cybersecurity management team any irregular or suspicious activity that could indicate a cybersecurity threat or incident.


text: Nuvera's Senior Information Technology and Transport manager and his staff have primary responsibility for identifying, assessing, and managing our exposure to cybersecurity threats and incidents, subject to oversight by the Audit Committee of the BOD of the processes we establish to assess, monitor, and mitigate that exposure. As members of Nuvera's Cybersecurity Committee, the Information Technology and Transport manager and his team bring a combined sixty years of information technology experience at Nuvera in security, incident response, and local and external network architecture. Executive, Finance and Compliance members of Nuvera's Cybersecurity Committee bring over twenty-five years of experience in risk management, regulatory and compliance. Nuvera relies on their CISO from FRSecure for recommendations and direction on strategy, policy, and process. FRSecure has a team with a combined three hundred years of experience in information security with thirty difference certifications.


text: If a potentially material cybersecurity threat or incident is identified or discovered, the Company's Cybersecurity Management Team will trigger our incidence response plan, including notifying our CEO, CFO, and other relevant business executives. Our Cybersecurity Management Team, along with our CISO, will work with the appropriate leaders and employees in any impacted business groups, as well as appropriate personnel in our finance, legal and other impacted departments, to assess the risks to the Company and potential impact while determining appropriate remediation steps. If executive management determines that a cybersecurity threat or incident could be material to the Company, our management will notify the Audit Committee, who will escalate the risk to our full BOD, depending on an assessment of the risk.


text: Ensuring the protection of sensitive data is fundamental to our operational integrity and strategic vision. Cybersecurity and data protection form essential pillars of our long-term strategy, safeguarding confidential information concerning our business, employees, customers, suppliers, and shareholders.

companyName: Whitestone REIT

ticker: WSR


text: Our corporate infrastructure, including information technology systems, communication networks, enterprise applications, and financial platforms, serves as vital tools for our business operations. These systems support crucial functions such as tenant and vendor management, internal communications, and financial record-keeping, underscoring the criticality of secure data collection, storage, and transmission.


text: To mitigate material risks posed by cybersecurity threats to our critical networks, third -party services, and data assets, we have instituted a comprehensive suite of information security processes. These measures encompass the diligent identification, assessment, and management of potential risks, threat monitoring services, and vulnerability assessments.


text: Cross-Functional Collaboration and Coordination: We foster collaboration among various departments, including our information security function, legal team, management, and third -party service providers, to effectively identify, assess, and manage cybersecurity risks.


text: Ongoing Evaluation and Assessment of Systems and Processes: We continuously evaluate and enhance our systems and processes to adapt to evolving cybersecurity threats, ensuring the resilience and effectiveness of our security measures.


text: Security Awareness Program: We conduct regular training and testing programs to enhance the cybersecurity awareness and readiness of our personnel, empowering them to actively contribute to our cybersecurity efforts.


text: Additionally, we engage third -party providers to augment our cybersecurity capabilities. These partnerships entail ongoing assistance for threat monitoring and mitigation, as well as targeted support for specialized security expertise.


text: As of December 31, 2024, we have not detected any cybersecurity threats, including prior incidents, that have materially impacted the Company, our business strategy, our financial results, or our financial health. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to our Risk Factors discussion in the section titled "We face risks relating to Cybersecurity attacks, loss of confidential information and other business disruptions" in this Form 10-K.


text: Aligned with our risk management governance structure, our management team oversees the daily management of cybersecurity risk, while our Board and its Audit Committee maintain an active and ongoing oversight role, with the Audit Committee receiving regular reports from management regarding cybersecurity risks and countermeasures being undertaken or considered, including updates to the internal and external cybersecurity landscape and relevant technical developments.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: SERVOTRONICS INC /DE/