text: The Audit Committee of the Board of Directors is responsible for overseeing cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Management briefs the Audit Committee on the effectiveness of our cyber risk management program. In addition, cybersecurity risks are reviewed by the Board of Directors, at least annually.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows, or reputation. We have experienced, and will continue to experience, cyber incidents in the normal course of our business, however, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors – Risks Relating to Our Business – We may have risks associated with security of our information technology systems".

companyName: LIQTECH INTERNATIONAL INC

ticker: LIQT

secItem: Item 1C


text: The Company approaches cybersecurity as an enterprise-wide risk and uses external resources to assess risk and manage its IT and 24x7 cybersecurity operations, including managed service providers who assist in the support of key business systems. The Company may also periodically engage external consultants to assist with cybersecurity incident management, particularly where advanced or specialized expertise may be required. If a material cybersecurity breach occurs, the incident will be reviewed by management to determine whether further escalation is appropriate. The Executive Chairman of the Board and Chief Executive Officer and the Chief Financial Officer have primary responsibility for this review and assessment. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive team, and if deemed necessary or appropriate, the Board of Directors. The Board Audit Committee is responsible for reviewing and discussing the adequacy and effectiveness of the Company's information security policies and the procedures and controls regarding information systems. In addition, we plan to consult with outside counsel as appropriate, including on materiality analyses and disclosure matters, and to assist in making the final materiality determination regarding disclosure and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents as appropriate.

companyName: Catheter Precision, Inc.

ticker: VTAK


text: The Company maintains a cyber liability insurance policy that is designed to cover certain expenses, business losses, business interruption, and fines and penalties associated with a data breach or other similar incident. Cyber liability insurance also provides coverage in the event of a ransomware attack.


text: To date, the Company has not had a cybersecurity event that materially impacted or is reasonably likely to materially affect its business strategy, results of operations, financial condition, or the security of its proprietary data.


text: To combat ever-present cyber risks, the Company maintains a comprehensive cybersecurity program, which includes employee training, annual risk assessments and a comprehensive cybersecurity environment meant to detect, prevent, and limit unauthorized or harmful actions across our information technology environment. However, we operate in the medical device sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to patients, customers, and employees; violation of privacy laws and other litigation and legal risk; and reputational risk.

companyName: PULSE BIOSCIENCES, INC.

ticker: PLSE


text: We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We use recognized commercially reasonable measures, tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture on an ongoing basis through regular vulnerability scans, penetration tests and third-party reviews. Other key components of our cybersecurity program include, but are not limited to, asset management, encryption, data loss prevention technology, access controls, identity and access management (IAM), such as multi-factor authentication (MFA), vulnerability management, endpoint threat detection and response (EDR), logging and monitoring involving the use of security information and event management (SIEM), privileged access management (PAM), email and web gateway protection, multi-faceted backup and data recovery solutions, anti-malware, firewalls, IDS and IPS, auditing and monitoring, regular policy updates, security awareness training, anti-phishing campaigns, intrusion detection and prevention, vulnerability and patch management, and third-party risk management. We also subscribe to third-party threat intelligence tools and services that support monitoring, analyzing, and responding to emerging risks and threats. We require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards, although currently we do not audit this. While we believe our cybersecurity practices are comparable to those of similarly situated companies, the Company does not currently audit its third-party service providers' cybersecurity practices, except through annual SOC-1 reviews and its regulatory and quality control auditing of vendors engaged in clinical trials or the manufacture of products used in the assembly of our medical devices. We also rely on industry leading third party service providers to provide the systems required to effectively run our clinical trials and require that these third-party service providers implement and maintain standard cybersecurity practices. We have business continuity plans that we regularly review and update in line with our evolving applications architecture. We believe our cybersecurity practices comply with applicable legal requirements, including those established by the FDA.


text: To date, we have not experienced any material security incidents or data breaches as a result of a compromise of our information systems and are not aware of any cybersecurity incidents that have had a material impact or are reasonably likely to materially affect our business strategy, operating results, or financial condition.


text: One of the key functions of our board of directors is informed oversight of our compliance program, including the processes used to mitigate risks associated with cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure generally, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its enterprise-level oversight of risks associated with cybersecurity threats directly as a whole, as well as through delegation of responsibility to our Audit Committee, which serves and functions as the Board's primary oversight body to monitor the Company's cybersecurity and related information technology risk. The Audit Committee receives periodic reports from management personnel responsible for enterprise risk management, which also evaluates cybersecurity among other enterprise level risks on an annual basis. It also assesses the experience of management personnel responsible for preventing, mitigating, detecting, and remediating any cyber incidents, including applicable third-party providers. The Audit Committee also oversees the Company's disclosure of any cybersecurity incident deemed material as required by the SEC or any other governmental authority, as applicable.


text: At the operational level, the Company has established an information security team, including a Privacy and Security Council ("PSC"), consisting of representatives from IT, Legal, HR, and Finance, to help provide governance and strategic direction for managing cyber risks, maintaining IT regulatory compliance, and optimizing technology initiatives for alignment with our company goals and objectives. Pursuant to various policies adopted by the Company since 2021, including the Company's Privacy Policy, the Company's senior most IT employee, our Information Security Coordinator (our "ISC"), is a member of the PSC and has frontline responsibility for assessing, identifying and managing material risks from cybersecurity threats. The PSC convenes not less than annually, and meetings include updates on cybersecurity matters provided by the information security team.


text: Our ISC has expertise in the following areas which assist in assessing and managing applicable cybersecurity risk: 27 years of IT experience including endpoint detection, security, incident management and response, vulnerability management and response, event management and response, and network security segmentation. The ISC provides regular reports on ongoing risk and mitigation practices, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company, to our Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, and General Counsel, who then report to the Audit Committee and the Board.


text: Our incident response plan designates our ISC as primarily responsible for identifying and evaluating any cybersecurity incident or suspected incident and reporting any such incidents to our General Counsel in order for management to evaluate materiality, and to report to our Audit Committee, our Board and make public disclosures, as applicable. Our General Counsel is responsible for routinely updating both the Board and the Audit Committee on the Company's cybersecurity personnel, practices and processes and, pursuant to our data breach response policy, which is updated from time to time, he must report to the Board in the event of any detected material incident and regularly update the Board on any mitigation and remediation steps being taken in connection with the Company's response. The Company has, from time to time, engaged external experts, including cybersecurity assessors, consultants, auditors, and legal counsel, in evaluating and testing our risk management systems and on a project-specific basis to assist us with projects that will improve our IT infrastructure, strengthen our products' security posture, and improve our cyber readiness. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's chief executive officer and board of directors. The Company engages information technology "managed service providers" (MSPs) to manage the Company's computer and information systems at its three office locations and remote locations. The MSPs are responsible for evaluating and testing the Company's risk management systems and assessing and remediating potential cybersecurity incidents as appropriate.

companyName: BIOLARGO, INC.

ticker: BLGO


text: The executives in charge of each physical office location are responsible for assessing and managing cybersecurity risks for their locations, and the Company's chief executive officer is responsible for assessing and managing cybersecurity risks to the Company as a whole. Because none of these individuals has specific training or experience in managing cybersecurity risks, MSPs that have expertise and experience in doing so are retained and relied upon. Our chief executive officer is responsible for escalating any cybersecurity matters as appropriate, in consultation with our legal counsel. Our board of directors is ultimately responsible for oversight of cybersecurity risk management and receives regular reports from Company management.


text: Presidio Property Trust uses a cross-departmental approach to addressing cybersecurity risk, including input from senior management, employees, external consultants, and our Board of Directors (the "Board"). Senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner, including providing periodic training to staff and an annual third-party review of the Company's current posture to protect against threats. The Audit Committee of the Board of Directors oversees the steps taken by Presidio Property Trust's management to monitor and mitigate cybersecurity risks. Senior management briefs the Audit Committee and the Board of Directors on cybersecurity matters on at least an annual basis.

companyName: Presidio Property Trust, Inc.

ticker: SQFT


text: The Company operates almost exclusively in a Software-as-a-Service (SaaS) IT environment. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third -party service providers. The internal business owners of the hosted applications are required to document quarterly user access reviews and obtain a System and Organization Controls (SOC) 1 and/or SOC 2 report from our SaaS vendors. With assistance from an external consultant, management conducts an annual review of third -party SOC reports with a specific focus on their data protection procedures. If a third -party vendor is not able to provide a SOC report, management takes additional steps to assess their cybersecurity preparedness and assess our relationship with them on that basis. Our assessment of risks associated with the use of third -party providers is a significant part of the Company's overall cybersecurity risk management framework.


text: The Company has also engaged a third -party managed service provider to manage server, network, and email security, including continuous monitoring and industry-leading antivirus software. Presidio Property Trust has robust business continuity and disaster recovery procedures in place, and an insurance policy that provides for network security liability, event response and recovery, direct business interruption, contingent business interruption, cyber extortion, social engineering, and computer fraud should an incident occur.


text: In addition, we have Company-wide policies and procedures concerning cybersecurity matters, including access security, system change management, development lifecycle, incident management and business continuity/disaster recovery policies. These policies go through an annual internal review process and are approved by appropriate members of management. Presidio Property Trust uses a third -party consultant to assess the Company's compliance with Sarbanes Oxley requirements.


text: Presidio Property Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Company has not, to date, experienced cyber incidents in the normal course of its business, nor have prior cybersecurity incidents had a material adverse effect on the Company's business, financial condition, results of operations, or cash flows. For more information about the cybersecurity risks we face, see the risk factor entitled "Risks related to cyber-attacks, cyber intrusions and other security breaches" in Item 1A- Risk Factors.


text: The Company understands the importance of managing risks from cybersecurity incidents and utilizes a multilayered strategy guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework for assessing, identifying, detecting and responding to threats and other potential incidents. Key aspects of our strategy for managing risks of cybersecurity threats include: Timely security patching of endpoints; Network and endpoint-based monitoring with autonomous protection capabilities; Backups which are regularly tested for recovery with key backups hardened against malicious access; Third-party security services for audit, benchmarking, and improvement of our cyber security program;

companyName: FutureFuel Corp.

ticker: FF


text: Ongoing monitoring and evaluation of our cybersecurity posture and performance through regular vulnerability scans, simulated phishing tests, and penetration tests; Oversight of third -party service providers by conducting vendor due diligence upon onboarding and ongoing monitoring;


text: An incident response plan designed to coordinate the activities that we and our third -party security service providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate incidents, as well as to comply with applicable legal obligations and mitigate any reputational damage;


text: Structured management of change process to ensure material changes to our systems or operations have an updated assessment of their potential impact associated with internal and external threats to the security, confidentiality, integrity, and availability of our data and systems, along with other material risks to our operations;


text: Ongoing, annual employee security awareness training; and Cybersecurity insurance coverage to help mitigate the risk of loss from cybersecurity incidents.


text: To date, the Company does not believe that cybersecurity incidents have materially affected the Company, its business strategy, results of operations, or financial condition. The Company cannot provide assurance that it will not be materially affected by any future material cybersecurity incidents. For more information about the cybersecurity risks the Company faces, see Item 1A, Risk Factors, above.


text: The Company's Information Technology ("IT") Director is responsible for developing and implementing our cybersecurity program and has over 20 years of cybersecurity experience in various roles involving information security, developing cybersecurity strategies, and implementing cybersecurity programs. Our program includes that all employees complete annual cybersecurity awareness training. The IT Director is responsible for reporting audit findings and risk information to the Company's Chief Financial Officer ("CFO").


text: Our board of directors is responsible for overseeing our enterprise risk management activities in general, and each of the committees of our board of directors assists the board of directors in the role of risk oversight. The Audit Committee of the board of directors oversees our cybersecurity risk and receives reports from time to time from our CFO on cybersecurity risk management. Promptly after becoming aware of a material cybersecurity incident affecting our IT systems or data, the IT Director would work with management to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity incidents.


text: Rekor recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and our exposure management solutions. Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data depending on the environment.

companyName: Rekor Systems, Inc.

ticker: REKR


text: We have an established policy on information security, as well as overall corporate information, workforce and workplace standards policies. These are collectively designed to establish auditable procedures for information security oversight by management, including: 1) identification of different types and forms of information, 2) guidelines for acceptable use and dissemination of information, 3) handling use and destruction of information, 4) personnel and physical site security, 5) incident reporting and response, 6) recovery plans, and 7) standards for web-based applications, communications and mobile devices. Three levels of security procedures have been identified as relating to the sensitivity of the information we manage in connection with different operations. Our policies call for the individuals assigned to these procedures to review and certify them annually and to recommend changes where appropriate. All breaches are required to be reported to senior management and the Board, together with a report on response and recovery, as well as recommendations to address further challenges.


text: Our information security procedures are overseen by our Vice President of Risk Management, supported by our Chief Technology Officer and our IT Manager, who are responsible to provide regular reports to our Interim President and Chief Executive Officer and Chief Financial Officer as well as the Technology and Social Responsibility Committee and the Governance Committee of our Board. These procedures are responsible for identifying, assessing, and managing cybersecurity threats and risks and work to monitor and evaluate our threat environment and risk profile using various methods. These methods include evaluating our and our industry's risk profile, coordinating with law enforcement concerning select threats, and engaging with third parties to conduct external audits and threat assessments for certain systems.


text: Our Information Security Policy and procedures are reviewed on an ongoing basis. These procedures are implemented by our Vice President of Risk Management, assisted by a managed service provider ("MSP"). Our MSP has over 15 years of experience and possesses various cybersecurity certifications. Third-party service providers can assist us from time to time in identifying, assessing, and managing material risks from cybersecurity threats, including for example cybersecurity consultants and software providers, managed cybersecurity service providers, threat intelligence service providers, forensic investigators, penetration testing firms, dark web monitoring services, and professional services firms, including legal counsel and auditors. By partnering with these specialized providers, we can leverage their insights and expertise to implement cybersecurity strategies and processes that are designed to align with industry best practices.


text: Our senior management evaluates material risks from cybersecurity threats against our overall business objectives and this evaluation and the management of material risks from cybersecurity threats is integrated into our overall risk management processes. This integration is designed to ensure that cybersecurity considerations are part of our decision-making processes.


text: See Risk Factors in this Annual Report on Form 10 -K for a description of the risks from cybersecurity threats that may materially affect us and how they may do so.


text: We have made cybersecurity and the protection of our customers' data a top priority. The critical areas that we consider for our evolving cybersecurity program include access control; data encryption; SSDLC/change management; BCP/DRP; endpoint security; patch management; vulnerability assessments; compliance management; data privacy; incident response; monitoring, alerting, and logging; employee training (ingrained in our onboarding process, and mandatory online and in person training annually); and cyber insurance (coverage areas include ransomware, and business interruption which are critical to our clients and availability of business operations).

companyName: Fluent, Inc.

ticker: FLNT


text: Risk Management & Strategy Our cyber risk management program is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. To help protect our company from a major cybersecurity incident that could have a material impact on operations or our financial results, we have implemented policies, procedures, programs and controls, including investments in technology that focus on cybersecurity incident prevention, identification and mitigation. These investments include best practice applications such as CrowdStrike, Okta, Intune and Kandji. These tools also strengthen our overall IT posture as well as our monitoring and alerting and patching processes. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the continuous monitoring such as National Institute of Standards and Technology ("NIST"). We execute an NIST 800-53 review annually and use the results of existing cyber risks to prioritize projects designed to address these gaps and create a go-forward strategy. Our internal and external auditors review our IT and cybersecurity controls annually for design and operating effectiveness.


text: Our Cybersecurity Program is governed by the Company's IT, Legal, and Compliance teams. Our Chief Technology Officer ("CTO") has over 20 years of experience in marketing technology and analytics. Our Vice President of IT Governance, Risk and Compliance ("VP of IT") has over 20 years of experience in IT internal and external audits, IT consulting, and governance, risk, and compliance. Our General Counsel regularly coordinates with the IT team on data security and compliance issues. The CTO and General Counsel report directly to the Chief Executive Officer ("CEO"), so any material issues are raised to the CEO, and a status update of key cybersecurity projects and any material breaches is provided quarterly to the Board's Audit Committee, which includes both an internal and external audit.


text: Incident Disclosure and Materiality Our incident management procedures include identification, evaluation, definition, and escalation based on the determination of materiality. This determination involves the Company's IT, Legal, and Compliance teams, executive officers, and cyber insurance provider. Breach notifications and escalation to the Audit Committee would also be based on the materiality determination. The collaboration among IT, Legal, and Compliance helps ensure and prevent gaps with laws and regulations. Each quarter, the VP of IT provides an update on key cybersecurity projects and any material breaches at the quarterly Audit Committee meeting, at which both the internal and external auditors are present.


text: While we did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition. See Item 1A. "Risk Factors" for more information on our cybersecurity-related risks.


text: We have established certain processes for identifying, evaluating, and managing material risks from cybersecurity threats as a part of our overall technology management strategy. These processes are designed and reassessed on a periodic basis to help protect our technology assets and operations from internal and external security threats. We also engage with third parties, including consultants, to enhance our security processes.

companyName: AVENUE THERAPEUTICS, INC.

ticker: ATXI


text: We have previously engaged and currently engage third parties to assess the effectiveness of our cybersecurity and technology management strategy and continue to seek to implement new, and improve existing, processes regularly to adjust for changes in technology, internal or external threats, business strategy, and regulatory requirements. We, and our third parties, have deployed managed detection and response services to monitor our technology infrastructure and information systems for possible threats. Our technology management strategy also includes ongoing security training and education for employees regarding threats, including their role and responsibility in detecting and responding to such threats.


text: We review the processes of our third party vendors and consider their ability to adhere to relevant industry practices and maintain adequate technology risk programs. In addition, we maintain cyber and cyber-related crime insurance coverage policies as part of our overall risk management strategy, however, our policies may not be sufficient to cover against all potential future claims, if any.


text: In the last two fiscal years, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition. Although we proactively attempt to prevent all threats, we are unable to eliminate all risk from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A. Risk Factors "Our business and operations would suffer in the event of computer system failures, cyber-attacks, or deficiencies in our or third parties' cybersecurity".


text: While our Board of Directors is responsible for oversight and risk management in general, our Audit Committee provides oversight of our technology management strategy to ensure that cybersecurity threats and risks are identified, evaluated, and managed. The Audit Committee receives periodic updates from our management team regarding the overall state of our technology management strategy and any relevant risks from cybersecurity threats and cybersecurity incidents.


text: Our management team is responsible for assessing and managing the material risks from cybersecurity threats and our Interim Chief Financial Officer leads these efforts on behalf of the management team. Our management team members have expertise in information systems, compliance and corporate governance, which we believe are disciplines that are effective in the management of the Company's cybersecurity risk. Our Interim Chief Financial Officer is well-informed on emerging cybersecurity risks and solutions used to mitigate and remediate loss due to cybersecurity incidents and is responsible for our internal cybersecurity programs and oversight of third-party cybersecurity vendors who monitor and execute on the prevention, detection, and mitigation of cybersecurity threats and incidents.


text: We continue to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance and are reviewed yearly by our board of directors.

companyName: Allarity Therapeutics, Inc.

ticker: ALLR


text: As of December 31, 2024, we have implemented a set of cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities. Our employees have received cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. Important security measures such as multifactor authentication, firewalls, Endpoint Detection and Response (EDR), encryption, etc. have been implemented. We continue to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Currently we are in the process of expanding our risk management procedure to include a broader cybersecurity risk management process. The updated risk management process will include annual review by our board of directors.


text: Our board of directors are currently implementing as oversight procedure for IT governance and cyber security risk management. It is expected that IT governance and cybersecurity will be included in the company's quarterly management review meetings under the supervision of our senior leadership, including our Chief Executive Officer and Chief Financial Officer, with regularly meets with and provides periodic briefings to our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.


text: Cybersecurity Threat Disclosure To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. For further discussion of cybersecurity risks, please see Item 1A, "Risk Factors."


text: The Company's Board considers cybersecurity risk as part of its risk oversight function and considers cybersecurity and IT risks as key strategic risks of the Company. The Board oversees management's implementation of the Company's cybersecurity risk management program, receiving at least annual updates from management (including our Chief Information Officer) on cybersecurity risks, including briefings on the Company's cyber risk management program and cybersecurity incidents, and reviewing cybersecurity topics impacting companies with management and external experts.

companyName: RCM TECHNOLOGIES, INC.

ticker: RCMT


text: The Company's Chief Information Officer leads the IT and cybersecurity functions and has primary responsibility for leading the Company's overall cybersecurity risk management program, supervising both internal cybersecurity personnel and external cybersecurity service providers. The Company's cybersecurity function is responsible for assessing and managing material risks from cybersecurity threats, as well as informing management about and monitoring the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers and alerts and reports produced by security tools deployed in the IT environment.


text: The Company's Chief Information Officer and Vice President of IT security and Compliance have significant experience in managing and leading information systems and deploying cybersecurity technologies and have extensive cybersecurity training and knowledge. The Company's Vice President of IT security and Compliance has several industry certifications, including CISSP (Certified Information Security System Professional), CCSP (Certified Cloud Security Professional) and CCSK (Certificate of Cloud Security Knowledge). The Company's Chief Information Officer reports to the Chief Executive Officer, and the Company's Vice President of IT Security and Compliance reports to the Company's Chief Information Officer.


text: With the assistance of our IT vendor, we established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an information technology ("IT") consultant who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process. Our Board of Directors provides oversight to our cybersecurity efforts to ensure effective governance in managing risks associated with cybersecurity threats. Our CFO provides periodic updates to the Board of Directors regarding our cybersecurity program, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company.

companyName: Harvard Apparatus Regenerative Technology, Inc.

ticker: HRGN


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, responses may include re-design, implementation, and maintenance of reasonable safeguards to minimize identified risks and address any identified gaps in existing safeguards and regularly monitoring of the effectiveness of our safeguards.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to " Cyber-attacks or other failures in telecommunications or information technology systems and deficiency in our, or those of third parties upon which we rely, cybersecurity could result in information theft, data corruption and significant disruption of our business operations. " under Item 1A, "Risk Factors," in this annual report on Form 10 -K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our full board of directors directly administers its cybersecurity risk oversight function and our audit committee provides additional oversight of maintaining and monitoring cybersecurity risks.


text: Our Chief Financial Officer is primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third -party service providers.


text: Our Chief Financial Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: Cybersecurity and risks associated with information security are operational risks included in the Company's Enterprise Risk Management ("ERM") Framework. Under the ERM Framework, the Company's Information Technology department and all employees are the first line of defense ("First Line"). Those in the First Line are each responsible for identifying and managing the information security risk associated with their activities. The Company's IT Steering Committee is part of the independent risk oversight of information security risk along with the Company's Compliance and ERM Committees, both of which are management risk oversight committees.

companyName: Oak Valley Bancorp

ticker: OVLY


text: The BOD and IT Steering committee are primarily responsible for monitoring management's implementation of operations and technology risk controls, including those relating to cyber security and information security. The Company maintains a data protection and information security program designed to ensure adequate governance and oversight is in place while evolving to meet changes in applicable laws and regulations, and best practices. The Company's information security controls and programs are designed to align with the National Institute of Standards and Technology ("NIST") standards for cybersecurity and the Federal Financial Institutions Examination Council ("FFIEC") examination guidelines, along with applicable privacy laws.


text: Information Security is the responsibility of the officers, employees, and agents of the Company with oversight by the Board of Directors ("BOD"). Our investment in people is critical to maintaining an effective cyber defense, which begins by developing and maintaining a robust Information Security function within the First Line. The Company's Chief Information Officer ("CIO") has over 25 years of network architecture, information technology and cybersecurity experience. Collectively, the Company's senior leadership in this area have nearly 80 years of experience. Each Company employee is responsible for an effective cybersecurity defense which is enforced with mandatory interactive cyber awareness training, periodic newsletters, executive security briefs and updates. Additionally, the BOD is informed about cybersecurity and the relevant risks posed to the Company via regular updates from the Company's CIO. The BOD is regularly informed and actively oversees the data security and privacy program and its policies. The BOD also receives regular education on innovative technology, cybersecurity, information systems/data management, fintech and privacy.


text: The Company engages external third parties to perform assessments on our adherence to the FFIEC's recommendations on cyber preparedness and NIST Cybersecurity Framework, as well as to review for best practices for the use of cloud services and FedLine requirements. To validate the effectiveness of the Company's overall information security controls, external third parties also perform full-scope external and internal penetration testing designed to mimic the tactics used by individual hackers or criminal hacking organizations. The Company also engages external third parties to perform ongoing adversarial simulation.


text: The Company conducts regular internal cybersecurity assessments intended to measure inherent risk and drive the adjustment of our security posture according to the latest threats. These assessments include alignment with the FFIEC's recommendations on cyber preparedness and GLBA Safeguards Rule to protect user data. The Company performs continuous internal and external vulnerability scanning to measure and react to new vulnerabilities and seeks conformance to industry best practices for both cloud-based and on-premises technology. The Company reviews vendor and partner security practices to ensure they maintain proper information security safeguards.


text: Cybersecurity operational measures Led by our CIO, the Company's data protection, information, cyber and technology services team collaborates with subject-matter experts throughout the business to identify, monitor and mitigate material risks, as well as to monitor compliance with the Company's security polices, applicable laws and regulations. The Company's security monitoring team manages the security of our systems through the ingestion of multiple external threat feeds and systems logs. Through the collection and integration of security-related IT infrastructure information, external threat intelligence and the expertise of trained security analysts, the Company works to identify and address potential indicators of compromise. Potential security events are identified and addressed through defined IT incident response activities and with support of the Company's Incident Response Plan. The Incident Response Plan is in place and updated regularly with the intent to reduce impacts to clients and the Company caused by a declared cyber incident, such as an event involving malicious code, unauthorized disclosure, loss of information or unauthorized use of information or systems. The Incident Response Plan organizes resources to manage and resolve events that harm or threaten the security of information assets. The Incident Response Plan includes involvement of the Company's Executive Leadership Team and BOD based on the severity of a cyber event, including the analysis of reporting requirements. The Incident Response Plan is tested annually and includes technical and executive management in simulated crisis management cybersecurity tabletop exercises.


text: As of the date of this report, other than the risks discussed in "Risk Factors," the Company knows of no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Omeros maintains a cybersecurity risk management program that is designed to assess, identify, manage and respond to risks from cybersecurity threats in a robust manner. This program shares certain common methodologies, reporting channels and governance processes applicable to our management of other risk areas, such as legal, compliance, strategic, operational and financial risk.

companyName: OMEROS CORP

ticker: OMER


text: We utilize a range of internal and external resources to assess and identify cybersecurity threats and vulnerabilities. We access and utilize information drawn from a variety of publications, reports and services to assess our cybersecurity risk profile, develop awareness of emerging cybersecurity threats and threat actors and identify risk factors that are particularly relevant to the biotechnology and pharmaceutical sector and to our company. We also work with third parties that assist us to identify, assess and manage cybersecurity risks, including external auditors, consulting firms, managed security service providers and penetration testing firms.


text: We have implemented and maintain various technical, physical and organizational measures, processes, standards and/or policies designed to manage and mitigate material risks from cybersecurity threats. These include data encryption, network security controls, access controls, physical security, asset management, system hardening, vulnerability management and patching and continuous monitoring of information technology systems and network telemetry data using a variety of manual and automated tools and systems designed to detect and respond to suspicious or unusual activity. We maintain systems and plans for business continuity and disaster recovery and have implemented tools and procedures for cybersecurity incident detection and response. We also operate a cybersecurity training program for employees that includes required webinars and deployment of simulated phishing and similar attacks in which threat actors utilize social engineering to gain access to company systems.


text: We take a risk-weighted approach to mitigation of cybersecurity risks associated with use of third-party service providers. Based on an assessment of the cybersecurity risks presented by a given third-party service provider, we seek to minimize third-party cybersecurity risk on a case-by-case basis, generally through a combination of due diligence in the selection of qualified vendors and the imposition of contractual terms requiring the vendor to maintain specified cybersecurity safeguards and/or to accept financial responsibility for security breaches occurring within the vendor's area of responsibility.


text: We are not aware of any specific risks from specific cybersecurity threats, and have not experienced any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition. While we continue to invest in the security and resiliency of our information technology systems and to enhance our cybersecurity controls and processes, we cannot provide assurance that a future cybersecurity incident will not occur or that it would not materially affect our company. Please see Item 1A of Part I of this Annual Report under the heading "Risk Factors" for additional discussion about risks related to cybersecurity.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Pursuant to its charter, the audit committee of our board of directors is responsible for the oversight of management's efforts to address cybersecurity risk. Management reports to the audit committee on cybersecurity risk matters periodically, typically twice annually. These reports normally address matters such as: the evolving cybersecurity risk environment and the emergence of new threats; outcomes and learnings from penetration testing, security audits or vulnerability assessments; evaluation of existing controls, tools and procedures and progress on implementation of any new initiatives to manage and mitigate cybersecurity risk. In addition, members of our board of directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management program is managed by our Director of Information Technology (the "IT Director"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The IT Director has been with the organization since 2007, has a post-graduate degree in Information Security, and is a member of InfraGard, a partnership between the Federal Bureau of Investigation and members of the private sector for the protection of U.S. critical infrastructure. The IT Director is informed about and monitors prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with dedicated internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our information technology environment. The IT Director provides periodic reports on cybersecurity risk to the audit committee of our board of directors, as well as our chief executive officer and other members of our senior management as appropriate.


text: We recognize the importance of cybersecurity risk management and have a defined strategy to support our business operations, platforms and information systems. We have implemented a comprehensive cybersecurity program to protect information systems and data. We have based our cybersecurity program on defined industry accepted frameworks with the goal of building enterprise resilience against an evolving cybersecurity threat landscape and to respond to cybersecurity threats as they materialize. Our program includes identification, assessment, monitoring, and management components, as well as informational and escalation components designed to inform management and the Board of prospective risks and developments.

companyName: Super League Enterprise, Inc.

ticker: SLE


text: Our cybersecurity program encompasses functions dedicated to both proactive and reactive management of cybersecurity threats. We implement our cybersecurity program internally through maintaining cybersecurity policies; deploying updated security technologies; and using third-party services and consultants to support and improve our cybersecurity program. Our proactive management of cybersecurity risks entails many actions, including actively monitoring our information technology systems; engaging service providers to monitor and, as appropriate, respond to cybersecurity threats; developing and updating incident response plans to address potential cybersecurity threats; and training our personnel on cybersecurity. We engage third-party auditors and consultants and leverage our internal information security, audit, and compliance functions to assess various facets of our cybersecurity program. We also maintain enterprise-wide processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.


text: We assess cybersecurity contingencies within our overall business continuity risk management planning process. Our information technology and information security teams utilize various technology tools to prevent, monitor, detect, and respond to cybersecurity threats. Our incident response policy outlines processes, roles, responsibilities, notifications, and other communications applicable to the assessment, mitigation, and remediation of realized cybersecurity events. The nature and scope of assessed risk of a realized cybersecurity event dictates the pace and extent of relevant processes, and communications, including an evaluation of any necessary or required disclosure. Depending on its nature and scope, a cybersecurity threat may be managed within our IT Department, responsible for day-to-day management of cybersecurity risks, and escalated to our executive management team, the Board, and the Audit Committee, as appropriate.


text: We have not historically been materially impacted by risks from cybersecurity threats and, as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, the breadth and scope of cybersecurity threats have grown over time and our systems and networks may be the target of increasingly sophisticated cyberattacks. For more information on our cybersecurity risks and their potential impact to our business, see Item 1A, " Risk Factors-Risks related to Our Business and Industry - We may experience security breaches and cyber threats " and Item 1A, " Risk Factors-Risks related to Our Business and Industry - Our business could be adversely affected if our data privacy and security practices are not adequate, or perceived as being inadequate, to prevent data breaches, or by the application of data privacy and security laws generally."


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the " Committee ") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: Our IT Department updates management on cybersecurity matters, including risk assessments, security controls, incident response procedures, employee training and Third-Party Risk Management.


text: The Committee oversees the Company's cybersecurity risk management and strategy, while management is responsible for implementing the Company's cybersecurity program. This approach ensures that cybersecurity risks are appropriately prioritized and managed throughout the organization.


text: Our Corporate Counsel has 20 years of experience in information technology, including cybersecurity, audit, compliance, and cybersecurity. In addition, we have an Enterprise IT Operations Engineer ("Ops Engineer") with requisite knowledge and experience in information technology and cybersecurity, and maintains IT and Ops professional certifications.


text: The Ops Engineer may call upon other business and legal stakeholders across our company to help manage cybersecurity threats and incidents. Our Audit Committee is responsible for oversight of our programs, policies, procedures, and risk management activities related to information security and data protection. The Audit Committee meets periodically with our Corporate Counsel and executive management to discuss threats, risks, and ongoing efforts to enhance cyber resiliency, as well as changes to the broader cybersecurity landscape. Our Board periodically participates in presentations on cybersecurity and information technology from internal leadership. In addition to periodic presentations, management promptly updates our Board and Audit Committee regarding significant threats and incidents as they arise.


text: As part of our overall Enterprise Risk Management strategy, we maintain a robust Information Technology and Security Management Program ("ITSM"), which includes processes to assess, identify, monitor and manage cybersecurity risks. The program includes provisions for annual cybersecurity risk assessments, ongoing monitoring and testing, as well as annual training for employees, executives, and Board Members. We use the Federal Financial Institutions Examination Council's ("FFIEC") cybersecurity assessment tool to identify risks and ascertain cybersecurity preparedness and the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework to benchmark our internal policies and procedures against best practices. We engage consultants and auditors to assist in the completion of our annual risk assessment and review of controls related to the ITSM.

companyName: Provident Bancorp, Inc. /MD/


text: The Company also maintains a robust Vendor Risk Management program to manage risks related to third -party relationships in a manner that is consistent with the Company's strategic goals, organizational objectives, and risk appetite. This includes comprehensive risk and control assessments with respect to the appropriate safeguarding of sensitive information.


text: We maintain cybersecurity insurance coverage to mitigate potential financial impacts from cyber incidents, such as data breaches and system disruptions. However, such insurance may not cover all types of damages, and we cannot guarantee that our coverage will be sufficient to fully protect us from the financial consequences of a cyberattack.


text: To date, there have been no cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, the Bank, our business strategy, results of operations, or financial condition.


text: The Board of Directors is responsible for overseeing the development, approval, implementation and maintenance of the ITSM, including overseeing the program's execution in accordance with the overall strategic goals of the Bank. The Board conducts oversight, in part, through the use of committees. The Risk Management Committee ("RMC") of the Board of Directors is charged with monitoring and reviewing risk assessments, assurance, testing, and training as well as overseeing the correction of identified deficiencies as they relate to the ITSM. The Company's Information Security Team is comprised of the information security officer ("ISO") and a cyber-risk analyst. With input from the Information Technology and Risk departments, the Information Security Team is responsible for incident management, disaster recovery, business continuity and cybersecurity programs and policies. The Bank's Incident Response Manual and Cyber Incident Policy outline how potential cybersecurity threats or incidents are communicated to the RMC. The RMC is responsible for determining if cybersecurity incidents or threats should be escalated to the Board of Directors. The Information Security Team and the RMC work together to mitigate cybersecurity threats or incidents.


text: The ISO is responsible for cybersecurity under the ITSM and holds a Certified Information Security Manager certification and was a former Chief Information Security Officer ("CISO") for the United States segment of a multi-national bank. The ISO reports directly to the Executive Vice President, Chief Risk Officer of the Bank who is a member of the executive team. The Chief Operating Officer, who is a member of the executive team, is a former CISO and holds both a Certified Fraud Examiner and Certified Information Security Manager certification. The Chair of the RMC of the Board also has multiple certifications in information and cybersecurity, including a Certified Information Systems Security Professional certification.


text: Cybersecurity Risk Management We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

companyName: Genprex, Inc.

ticker: GNPX


text: In the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program, which is comprised of a wide array of policies, standards, architecture, and processes. The cyber risk management program falls under the responsibility of our Chief Financial Officer, who has more than 15 years of experience, including cross-functional expertise in business operations and technology strategy. Under the guidance of our Chief Financial Officer, we develop, maintain, and evidence the policies, standards, and processes in a manner consistent with applicable legal requirements. We also utilize a variety of cybersecurity software from reputable vendors in cybersecurity.


text: We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems and ensure the effectiveness of our security controls. Our cybersecurity risk management program is Systems and Organization Controls (SOC)-certified and incorporates a number of components, including information security program assessments, continuous monitoring of critical risks from cybersecurity threats using automated tools, internal audits, and employee training. We deploy a wide range of security tools across the environment, require multifactor authentication, hold client data on a separate virtual private cloud (VPC), and implement access control policies that further limit access to data within the systems.


text: We periodically conduct internal audits and are consistently evaluating our cyber readiness. As a result, we have not identified any material cybersecurity risks and are continuously hardening our environment, systems and infrastructure to reduce our vulnerability to attack. Additionally, our program includes regular cybersecurity training for all employees.


text: For further information regarding cybersecurity risks, please refer to "Risk Factors – Risks Related to Development and Commercialization of Our Current and Future Product Candidates" and other risks described in the "Risk Factors" section of this Annual Report on Form 10 -K.


text: Our board of directors is responsible for the oversight of cybersecurity risk management. The board of directors delegates oversight of the cybersecurity risk management program to the audit committee of the board of directors (the "Audit Committee"). Our Chief Financial Officer reports to the Audit Committee. The Audit Committee updates the board of directors on our cybersecurity risk management program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards on an annual and as-needed basis.


text: Securing the Company's IT systems is integral and foundational to its everyday operations. The Company's Security Steering Committee is comprised of cross-functional executive management team members that collectively possess a high level of cybersecurity and technology operations expertise. The mission of our Security Steering Committee is to focus on defining and deploying its information security strategy, sustaining a robust employee cybersecurity awareness and training program, executing security engineering, providing continuous monitoring of the Company's information security strategy, responding and coordinating the response and investigation of cyber threats, building and testing its disaster recovery plans in support of its businesses' continuity plan requirements, and developing its cyber and information security policies.

companyName: ULTRALIFE CORP

ticker: ULBI


text: The Company's cybersecurity strategy is based on recognized best practices, standards, and frameworks for cybersecurity and information technology, including the Center for Information Security ("CIS") Controls and National Institute of Standards and Technology ("NIST"). The strategy focuses on implementing technologies, controls, and processes to constantly monitor, identify, assess, and manage cybersecurity risks.


text: The Company's cybersecurity program includes exercises and trainings designed to sustain a high level of cybersecurity awareness and readiness across our employee base. The Company also has a cybersecurity incident response plan that is designed to provide a framework across all functions for a coordinated identification and response to security incidents.


text: The Company engages leading cybersecurity firms to assist with its security engineering and operations; provide independent evaluations of its security posture through regular assessments; and to audit and provide advice on how to make its security processes and controls more effective.


text: The Company utilizes third-party service providers to perform a variety of functions to assist in operating its business. The cybersecurity risks associated with the use of certain providers are covered under a vendor management process. Depending on the nature of the services provided and the sensitivity and/or quantity of information processed, the vendor management process may include reviewing cybersecurity practices of these providers, contractually imposing obligations on the provider, inspecting independently audited reports, and/or conducting its own security assessments of their services.


text: The Company's Board of Directors has ultimate oversight of the Company's cybersecurity risk. Management updates the Board of Directors on the Company's cybersecurity and information security posture at least quarterly at the Company's board meetings, or more frequently as determined to be necessary or advisable. These updates include a review of cybersecurity incidents determined to have a moderate to high business impact, even if immaterial to the Company as a whole. The Audit Committee has responsibility for assisting the Board in the review and oversight of risks affecting the Company, and oversees the enterprise risk management process, which includes, with the assistance of senior management, assessing the Company's exposure to cybersecurity risk and the effectiveness of the Company's processes and controls to address and respond to those risks. Management is responsible for hiring appropriate personnel, integrating cybersecurity considerations into the Company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Notwithstanding the focus and emphasis on cybersecurity, the Company has experienced and will continue to experience cybersecurity incidents, and there can be no guarantee that future incidents will not have a material adverse effect on its business. See Risk Factor " Breaches in security, whether cyber or physical, and related disruptions and/or our inability to prevent or respond to such breaches, has previously, and in the future could diminish our ability to generate revenues or contain costs, compromise our assets, and negatively impact our business in other ways " for more information on the Company's cybersecurity risks.


text: We depend on information technology and systems for various operations (including refinery processes and refined product loading) and for capturing accounting, technical, and regulatory data for reporting, analysis, and archiving. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. As of the filing date of this report, our risk monitoring process related to cybersecurity includes conducting periodic vulnerability assessments using a combination of internal and third-party capabilities to perform technical assessments, vulnerability scanning, and incident and event monitoring. We are working to: (i) identify and assess threats and (ii) establish a thorough, risk-based cybersecurity program, including the potential adoption of a formal cybersecurity policy if deemed necessary by the Board, aimed at safeguarding our data, along with the data of our customers and partners. We anticipate that such a program will follow well-organized cybersecurity frameworks and be managed by a central control figure with Board oversight.

companyName: BLUE DOLPHIN ENERGY CO

ticker: BDCO


text: We did not experience a significant cybersecurity breach or associated expenses, penalties, or settlements for the twelve months ended December 31, 2024 and 2023.


text: Cybersecurity Risk Management, Governance And Risk Assessment The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. The Company intends to establish a cybersecurity program (the "Program") that will be designed to assess, identify, manage, and mitigate material cybersecurity threats, as well as to respond to and recover from cybersecurity incidents.

companyName: Elite Health Systems Inc.

ticker: EHSI


text: The Program will be based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), NIST Special Publication 800-53, and the Payment Card Industry standards, as applicable, and designed to comply with applicable laws and regulations, including HIPAA and the New York Department of Financial Services Cybersecurity Regulation, as applicable. This does not imply that we will meet any particular technical standards, specifications, or requirements. The Program will be aligned with the Company's overall enterprise risk management system and processes and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Control procedures are assessed regularly to confirm their effectiveness.


text: The Company will designate a Chief Information Security Officer (the "CISO"). The Program will be implemented and managed by the Company's executive management under the leadership of the CISO. The Company will contract with third-party service providers to support aspects of the Program implementation, operations, and review of information technology operations and cybersecurity technologies.


text: The Company's cybersecurity policies and procedures will be reviewed by the CISO and updated at least annually and will include an incident response plan ("IRP") for detecting, responding to and limiting the effects of a cyber security event. In addition, under the IRP, following the resolution of a cybersecurity incident, the Company will generally consider the effectiveness of the Program and the IRP, make adjustments as appropriate, and report to senior management and the Audit Committee as appropriate on these matters. Cybersecurity policies and procedures will also be subject to periodic review and audits by internal and external parties, such as the internal audit function, external auditors, regulators, or independent assessors. The Company will require employees to undergo cybersecurity-related training, including phishing prevention training, and employees are tested regularly through phishing exercises.


text: The CISO will be responsible for developing, maintaining, and enforcing the Program's policies and procedures, as well as reporting on the Program's performance and material cybersecurity risks to the Audit Committee. The CISO will have the relevant expertise and authority to carry out the Program's objectives and to coordinate with other key stakeholders within and outside the Company. The Program will be overseen by the Company's Board of Directors.


text: Cybersecurity Risk Assessment The CISO will be responsible for assessing and managing the Company's material risks from cybersecurity threats. The Company will conduct regular risk assessments to identify, evaluate, and prioritize material cybersecurity risks to the Company, including its health plans and state contracts, shared services and IT operations, or business strategy. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have developed the following processes as part of our strategy for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: FIREFLY NEUROSCIENCE, INC.

ticker: AIFF


text: Managing Material Risks and Integrated Overall Risk Management We have integrated cybersecurity risk management into our risk management processes. This integration is intended to ensure that cybersecurity considerations are part of our decision-making processes. We continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engaging Third Parties on Risk Management We engage a range of external experts, including consultants, auditors, and cybersecurity assessors, who assist us in evaluating and testing our cybersecurity systems and processes. These partnerships are intended to give us access to specialized knowledge and insights that can inform our cybersecurity strategies and processes, including as to industry-standard control frameworks and applicable regulations, laws, and standards.


text: Overseeing Third-Party Risk As part of our evolving cybersecurity roadmap, we plan to implement and conduct security assessments of all third -party service providers before engagement and maintain ongoing monitoring to ensure compliance with relevant cybersecurity standards.


text: Risks from Cybersecurity Threats We have not experienced any material cybersecurity incidents. As a result, we do not believe that risks from cybersecurity threats, have materially affected us, our results of operations and financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple and potentially material risks to us, including potentially to our results of operations and financial condition. See also "Risk Factors — Failure to protect our information technology infrastructure against cyber-based attacks, network security breaches, service interruptions, or data corruption could significantly disrupt our operations and adversely affect our business strategy and operating results." As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we may expend greater resources to continue to modify and enhance protective measures against such security risks Governance Board of Directors Oversight Our board of directors oversees the management of risks associated with cybersecurity threats.


text: Management ' s Role Managing Risk The Company's management is primarily responsible for assessing, monitoring and managing our cybersecurity risks. Management must ensure that all industry standard cybersecurity measures are functioning as required to prevent or detect cybersecurity threats and related risks. Management oversees and tests our compliance with standards, remediates known risks, and leads our employee training program.


text: Monitoring Cybersecurity Incidents The Company's management is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Management implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of industry-standard security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, management will implement an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors Significant cybersecurity matters, and strategic risk management decisions, will be escalated to the board of directors.


text: The Company recognizes the importance of securing its information, devices, and data and the IT systems it relies on to conduct its business. The Company has established its Network, Information, and Data Security Policy Guidelines (the "NIDSP Guidelines") designed to protect the integrity and confidentiality of data and information belonging to or being exchanged by the Company and its employees, partners, customers, service providers, and suppliers and to safeguard that information and the Company's IT infrastructure from unauthorized access, use, disclosure, alteration, and destruction.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: The protections, procedures, and controls set forth in the NIDSP Guidelines demonstrate the Company's attention to and prioritization of cybersecurity as a component of its overall strategy and system for managing risks. The NIDSP Guidelines include five policies described below, that together define the Company's strategy and practices for managing cybersecurity threats and mitigating cybersecurity risks.


text: Physical Security Policy (the "PSP"). The PSP establishes guidelines related to selecting IT operation sites, designating security zones, using, inspecting, and storing IT Assets, designing restricted-access and security controls, and monitoring compliance with safety and security standards. The goal of the PSP is to minimize risks of damage, destruction, unauthorized access, inadvertent disclosure, misuse, loss, or theft of the Company's IT Assets. In accordance with the PSP, the Company: (i) evaluates IT operation sites based on their susceptibility to natural disasters, crime and theft, and unauthorized access; (ii) requires the use of keycards or biometrics in order to enforce security zones and give users the least amount of access required to do their jobs; (iii) requires systems and devices that store confidential data to be maintained and protected in accordance with the Company's Confidential Data Policy; and (iv) requires visitors at the Company's office to complete a sign-in log, wear a visitor badge, and be escorted by a designated employee at all times.


text: Network Security Policy (the "NSP"). The NSP aims to protect the integrity of the Company's data by securing the systems and devices that make up the Company's network infrastructure. Pursuant to the NSP, the Company: (i) enforces strict password-construction criteria for network devices; (ii) requires employees to verify their identities using multi-factor authentication to access internal resources; (iii) maintains and reviews logs from application services, network devices, and critical devices and requires the retention of logs in accordance with the Company's Retention Policy; (iv) implements and configures firewall technology to filter both inbound and outbound network connections; (v) authorizes the IT Manager to determine the extent and scope of external security testing to be performed; (vi) establishes a software-use policy; and (vii) requires antivirus and anti-malware software to be used and timely patched and updated on any Company-provided devices.


text: Backup Policy. The Company's Backup Policy applies to all data stored on Company systems. The Backup Policy specifies the types of data and information considered to be critical to the Company's operations and thus required to be backed up, establishes a backup schedule that is necessary for successful data recovery, and implements procedures for the off-site rotation, storage, and retention of backups. The Backup Policy also establishes the Company's data-restoration procedures and mandates the periodic testing of those procedures.


text: Remote Access Policy (the "RAP"). The RAP defines the Company's standards for accessing IT resources from outside the Company's network, such as when an employee is working remotely. Pursuant to the RAP, remote access is only permitted if accomplished through secure, Company-provided means. The Company's uses remote-access software designed to guard against unauthorized access using traffic encryption during transmission and firewall protections.


text: Confidential Data Policy (the "CDP"). The CDP governs the handling, storage, transmission, destruction, and protection of confidential data. Pursuant to the CDP, confidential data must be securely stored, removed from common areas, properly marked as confidential data, protected with strong encryption if being transmitted, and destroyed by means that make recovery impossible. Employees who are given access to confidential data are required to immediately notify their supervisor if they suspect any misuse or unauthorized disclosure of confidential information.


text: The Company's NIDSP Guidelines and policies apply not only to the Company's employees and consultants but also to any third parties that access or utilize the Company's information and systems. Such third parties may include the Company's service providers, customers, suppliers, contractors, consultants, and any other individuals the Company conducts business with. The IT infrastructure that the Company has developed in accordance with the NIDSP Guidelines is designed to monitor both internal and external cybersecurity risks. The NIDSP Guidelines equip the Company with the tools and systems necessary to recognize, address, and protect against risks associated with its third -party interactions.


text: The Company's IT Manager and executive team is responsible for the day-to-day management of cybersecurity risks, while the Company's Board of Directors has responsibility for oversight of risk management.


text: As part of the Company's framework for cybersecurity risk oversight and governance, the Company's network, information, and data-security policies set forth in the NIDSP Guidelines are enforced by the Company's IT Manager and/or its executive team. The IT Manager is an employee designated by the Company to manage the Company's security policies and program. The IT Manager is tasked with ensuring that the Company maintains compliance with the Company's security policies and any applicable security regulations. The IT Manager is responsible for: (i) implementing the Company's security policies; (ii) disseminating the Company's security policies to all employees; (iii) establishing a training program for all employees and users covered by the Company's IT security policy to notify them of the Company's security policies, train and re-train them to comply with the Company's IT security program, and educate them on the importance of data security; (iv) performing any ongoing testing or analysis of the Company's security infrastructure, policies, and procedures; and (v) updating the NSP and any other policies and guidelines as needed to comply with applicable regulations and to stay up to date with the changing IT security landscape.


text: The IT Manager works closely with the Company's management and executive team to determine the Company's IT-related needs, to evaluate the sufficiency of the Company's data-governance policies and practices, to keep the Company's management informed of notable cybersecurity-related updates, to review its security-related policies, and to identify ways to strengthen the systems and procedures implemented by the Company to detect, assess, and manage data risks.


text: In the event of the detection of an actual or suspected cybersecurity incident, the Company's IT Team, lead by the IT Manager, assesses the incident as "minimal", "low", "moderate" or "high". Incidents assessed at a minimal or low risk are reported to Company's management and the Executive Chairman of the Board and the Executive Chairman of the Board may share this information with the Board. Incidents assessed at a moderate or high risk are reported to Company's management, the Executive Chairman of the Board, and the Company's Board of Directors.


text: Notwithstanding the Company's cybersecurity-related policies, procedures, and governance framework, the ever-present threat of a cyber-attack, data breach, or other security incident is pervasive. The increasingly sophisticated nature of the tactics used to circumvent IT security safeguards makes cybersecurity threats increasingly difficult to detect and respond to. While the Company does not believe its business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity threats or incidents, there is no assurance that the Company will not be materially affected by such threats or incidents in the future. Accordingly, the Company will continue to monitor cybersecurity risks and strive to invest in and strengthen its cybersecurity infrastructure.


text: We have implemented an enterprise-wide information security program designed to identify, protect, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our primary objectives are to safeguard information assets, prevent their misuse or loss, and minimize business disruptions, through a comprehensive cybersecurity program intended to detect, analyze, contain and address cybersecurity risk exposures, threats and incidents. Our program utilizes various security tools to safeguard our information systems, aiding in prevention, identification, escalation, investigation, resolution, and recovery from vulnerabilities and security incidents. Examples of such security tools include internal reporting systems, monitoring and detection tools, third-party penetration testing and security assessments and a bug bounty program engaging security researchers. In addition, we have adopted a comprehensive incident response plan and process for detecting, mitigating, and investigating cybersecurity incidents, which employees, under the leadership of the Company's Chief Information Security Officer ("CISO"), regularly test through table-top exercises, testing of our security protocols through additional techniques such as penetration testing, debriefing after security incidents to improve our security and responses, and regular briefing to our directors and officers on our cybersecurity risks and preparedness.

companyName: Skillsoft Corp.

ticker: SKIL


text: Our Board has oversight of our strategic and business risk management, including cybersecurity risk management, with support from our Audit Committee as described under "Governance" below. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Our global information security program is led by our CISO, who brings over 20 years of industry experience.


text: Additionally, we maintain a third -party security program to assess, prioritize, and mitigate risks associated with our vendors and partners. We also rely on third parties to implement appropriate security measures.


text: Regular risk assessments evaluate cybersecurity and technology threats, employing a widely adopted risk management model to prioritize risks and develop corresponding security controls. Our information security program undergoes regular reviews, audits, tests, and exercises to ensure effectiveness and enhance security measures.


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. Despite our continuing efforts, however, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive, or business harm or damage to our Company, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "We are regularly subject to cybersecurity and other similar attacks. If our security measures are breached or unauthorized access to customer data is otherwise obtained, our platforms may be perceived as insecure, we may lose existing customers or fail to attract new customers, our reputation may be harmed, and we may incur significant liabilities."


text: As part of its oversight responsibilities, which include the identification of the principal risks of the business and ensuring the implementation of appropriate systems to manage such risks, the Board devotes significant time and attention to information security and risk management, including cybersecurity, and regulatory compliance, supported by the Audit Committee.


text: The Audit Committee is responsible for evaluating the Company's major financial risk exposures and the steps management has taken to monitor and control such exposures. The Audit Committee's charter also requires it to discuss guidelines, policies and steps to govern the process by which risk assessment and management is undertaken (including risks related to information security, cybersecurity and data protection) and the establishment and management of appropriate systems to manage such risks. The Audit Committee reviews cybersecurity risks through quarterly reports from the CISO, and monitors the status of existing information security controls and practices to mitigate the potential risk from evolving cybersecurity threats. Regular reports on cybersecurity threats, assessments, and findings are also provided by the CISO to senior management and relevant teams.


text: Related to Cybersecurity Risks Our board of directors, as a whole and through its committees, holds overall oversight responsibility for our risk management processes, including in relation to risks from cybersecurity threats. Our board of directors exercises its oversight function through the audit committee, which oversees the management of risk exposure across various areas, including cybersecurity risks, in accordance with its charter. The audit committee receives quarterly reports from our Management on the status of our cybersecurity program. The Chair of the audit committee provides a quarterly report to the board of directors, which includes any key updates on cybersecurity matters, as applicable.

companyName: MILESTONE SCIENTIFIC INC.

ticker: MLSS


text: Our management team is responsible for the day-to-day administration and management of our cybersecurity program, under the direct supervision of our Chief Executive Officer currently we also work with external security service providers to support our security monitoring and threat detection capabilities and have implemented a process to report relevant findings to the Chair of audit committee where appropriate.


text: We maintain a cybersecurity program, which includes processes for identification, assessment, and management of cybersecurity risks. We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify potential areas of enhancement, and develop strategies for the mitigation of cyber risks. We have implemented a process to periodically conduct security awareness training for employees.


text: Our team is informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third -party security software and technology services. In addition, we use third -party security solutions, monitoring, and alerting tools and resources, designed to monitor, identify, and address risks from cybersecurity threats. We also have implemented processes and technologies for network monitoring and data loss prevention procedures, and from time to time review such processes and technologies.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10 K for more information.


text: Cyber Security Governance Oversight of cybersecurity infrastructure is managed by members of our management team, including our President & Chief Executive Officer. Management works in tandem with a third-party service provider (the "Service Provider"). The Service Provider periodically reviews and updates our antivirus and antimalware software, manages our Business Continuity and Disaster Recovery system, reviews our vulnerability management and ensures our system is Payment Card Industry (PCI) compliant. Given our overall risk profile, the Board has had limited involvement with our cybersecurity risk management. The management team, with support from the Service Provider, would raise any significant cybersecurity risks with the Board.

companyName: Saker Aviation Services, Inc.

ticker: SKAS


text: We believe we have implemented processes that are designed to effectively identify and manage risks from cybersecurity threats. Through our Service Provider, we receive Endpoint Detection and Response services ("EDR"). The EDR helps to ensure faster identification of a cybersecurity breach. Once a cyber incident is identified, our Service Provider will notify management and work to secure our systems and fix the vulnerability. An investigation will be conducted, with the assistance of the Service Provider if needed, to determine the root cause of the cyber incident, the materiality of the cyber incident, and any disclosure or legal obligations that will stem from the cyber incident.


text: We have not been the victim of a cyber incident in the past but may be the subject of cyber incidents in the future.


text: Disclosure of Risk Management, Strategy, and Governance Regarding Cybersecurity Risks Our Board of Directors engages in regular discussions to address our Company's principal risks, including those related to cybersecurity, ensuring comprehensive management and oversight. In alignment with this commitment, our cybersecurity leadership, comprising the Chief Operating Officer, DevOps Resource Manager of Security, Senior Systems Architect, DevOps Engineer, and Senior Technical Project Manager, forms a core committee dedicated to the review and strategic planning of our cybersecurity initiatives. This team's collaborative efforts are instrumental in steering our Company's approach to identifying, evaluating, and mitigating cybersecurity risks.

companyName: PAID INC

ticker: PAYD


text: The designated committee oversees our cybersecurity risk assessment and mitigation strategies through various means, including but not limited to: Conducting internal evaluations and leveraging technological tools to fortify our cybersecurity posture. Implementing rigorous cybersecurity training for all employees to heighten awareness and preparedness against cyber threats. Ensuring the robustness of our cyber defenses with comprehensive antivirus solutions and adherence to cybersecurity best practices.


text: Our reliance on third-party service providers, such as Google Cloud for server hosting and Stripe for payment processing, incorporates a level of inherited security measures. Nonetheless, our commitment extends to continuously assessing and enhancing our cybersecurity frameworks to align with evolving industry standards and best practices.


text: Our Board is advised of key cybersecurity matters through high-level briefings, ensuring strategic alignment and informed oversight of our cybersecurity endeavors. The Company's officers, along with the executive team, play a pivotal role in the dynamic landscape of cybersecurity risk management. This committee is not only responsible for the ongoing assessment and management of cybersecurity risks but also ensures that strategic cybersecurity initiatives are integrated within the broader operational framework of our Company.