text: Our Director of Information Technology is principally responsible for overseeing our cybersecurity risk management program, in partnership with other members of our management team. The Director of Information Technology works in coordination with the other members of our cybersecurity committee, which includes our Chief Financial Officer, Chief Accounting Officer and In-house Counsel. Our Director of Information Technology has served in various roles in information technology and information security for over 26 years. Our Director of Information Technology, in coordination with our cybersecurity committee, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Through the ongoing communications with our organization, the Director of Information Technology and the cybersecurity committee monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: We maintain a process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We routinely assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: BioCardia, Inc.

ticker: BCDA

secItem: Item 1C


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Our information technology team consists of professionals with deep cybersecurity expertise across multiple industries. Our executive leadership team, along with input from the above professionals, are responsible for our overall enterprise risk management process and regularly consider cybersecurity risks in the context of other material risks to the Company.


text: As part of our risk management system, we track and log privacy and security incidents to remediate and resolve any such incidents. Any significant incidents are reviewed regularly with our Chief Financial Officer to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to our executive leadership team. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our executive leadership team makes the final materiality determinations and disclosure and other compliance decisions.


text: The Board of Directors has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Board of Directors.


text: To date, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including, confidential information that is proprietary, strategic or competitive in nature, and data related to financial and customer data ("Information Systems and Data").

companyName: BOSTON OMAHA Corp

ticker: BOC


text: While to date, we have not had a major cyber incident against our platforms, nor experienced significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "Disruptions to or any breach of our information technology systems could disrupt our business operations which could have a material adverse effect on our business, prospects, results of operations, financial condition and/or cash flows."


text: Our officers and employees and our IT vendors help identify, assess and manage our cybersecurity threats and risks and the unique needs of each of our billboard, surety insurance, broadband and other businesses and the various offices in which we operate. We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools, including but not limited to tools for monitoring, geolocation, remote wiping, threat detection, intrusion detection and prevention, patch management, distributed denial of service (DDoS) protection and forensics; conducting (directly or through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threats and actors; conducting vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile; and evaluating threats reported to us.


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plans and procedures, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, vendor risk management program, employee training and penetration testing.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program, and members of our management team and IT consultants work together to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and report regularly to our board of directors on cybersecurity matters.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers, threat intelligence service providers, dark web monitoring services, and other cybersecurity software providers.


text: We use third-party service providers to perform a variety of functions throughout our business, including but not limited to application providers, hosting companies, contract manufacturing organizations and contract research organizations. We have a vendor management program to oversee, identify and manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for vendors that may include, depending on the vendor and nature of services being performed, security questionnaires, review of the vendor's written security program, review of security assessments, audits and reports, vulnerability scans related to the vendor, security assessment calls with the vendor's security personnel, and the imposition of certain contractual obligations on the vendor, among other elements, in accordance with the processes outlined in our internal vendor selection, management, and oversight process policy and other internal guidelines. More specifically, the level of assessment may depend on the following: the nature of the services provided and the data the vendors may collect, retain, and utilize, the sensitivity of the Information Systems and Data at issue, and the identity of the provider. Our board of directors addresses our cybersecurity risk management as part of its general oversight function.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by various members of our management team and IT consultants, which includes individuals who have a diverse combination of relevant expertise, experience, education and training. Our team includes individuals with relevant experience in enterprise risk management and disclosure controls and procedures. Additionally, certain members of our team have experience managing cybersecurity programs and are specifically assigned cybersecurity oversight.


text: Certain members of our management team are responsible for hiring appropriate employees and consultants, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management. Our cybersecurity incident management team, and other individuals as needed, work to help us mitigate and remediate cybersecurity incidents of which we are notified. In addition, our incident response processes include a procedure for reporting certain cybersecurity incidents to the board of directors.


text: Commencing in 2024, our Audit and Risk Committee is taking the lead on behalf of the board of directors on oversight of our cybersecurity risk management program.


text: Like many companies, we face significant and persistent cybersecurity risks. The small size of our organization and limited resources could exacerbate these risks. However, we are committed to maintaining governance and oversight of these risks and to implementing standard operating procedures ("SOPs") and training to help us assess, identify, monitor and respond to these risks. Some examples of procedures implemented include an internal inventory of software and database exposures, a risk analysis of database vendors, review of vendor back-up, security and privacy measures. In addition, we are in the process of drafting an internal cybersecurity policy which will be the basis for SOPs and training. Our internal server includes a firewall and is scanned for malware several times a day and the data is backed up in the Cloud for ease of restoration as needed. Employees are trained to avoid phishing emails and our internal controls system is designed to mitigate the risk of payments of fraudulent invoices. While we have not, as of the date of this Form 10-K, experienced cybersecurity threats, including as a result of a prior incident, that resulted in, or that we believe is reasonably likely to result in, a material adverse impact to our business strategy, results of operations or financial condition, there can be no guarantee that we will not experience a material incident in the future. Such incidents, whether successful or not, could impair our access to critical information including confidential operational and patient records and have the potential to be costly to effect remedies. See "Risk Factors" for more information on our cybersecurity risks.

companyName: Monopar Therapeutics

ticker: MNPR


text: We aim to incorporate industry best practices for companies of our size and financial strength throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and training programs to assess, identify, and manage material cybersecurity risks. Our Board of Directors has ultimate oversight of cybersecurity risk and has established a Cybersecurity committee headed by our Chief Financial Officer. As a small organization with limited resources, we do not have a dedicated cybersecurity organization or employee personnel with specific cybersecurity expertise. Our Chief Financial Officer was chosen to head our Cybersecurity committee due to more generalized management experience with financial and operating systems and oversight of third-party providers. Our Management team and our Board of Directors regularly review our cybersecurity program which generally occurs at least annually, or more frequently as determined to be necessary or advisable.


text: We are increasingly dependent on sophisticated software applications, computing, and cloud infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: Given the importance of cybersecurity to our business, we maintain a cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical and technical safeguards, including contracted 24/7/365 Security Operating Center monitoring services and alerting systems for internal and external threats; regular evaluations of our cybersecurity program, including periodic internal and external audits; and industry benchmarking. We also require cybersecurity trainings when onboarding new employees and conduct cybersecurity awareness testing for our employees. Our program leverages industry frameworks, including the National Institute of Standards and Technology Cybersecurity Framework to strengthen our program effectiveness and reduce cybersecurity risks.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers. We use various means to assess cyber risks related to our third-party service providers, including conducting due diligence in connection with onboarding new vendors and ongoing due diligence with key third-party vendors. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available where applicable as part of our oversight of third-party providers.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a regularly tested cybersecurity incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for handling and managing potential cybersecurity incidents. We have relationships with a number of third-party service providers to assist with cybersecurity incident containment and remediation efforts.


text: Management Oversigh t The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Chief Financial Officer ("CFO") in connection with our managed service provider. Our managed service provider is a System and Organization Controls ("SOC") 2 accredited IT services firm which completes required annual audits, providing evidence of ongoing compliance to maintain the SOC 2 designation. They have over a decade of experience delivering services and consulting for regulatory security requirements. Our managed service provider is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. The managed service provider provides regular briefings for our senior management team on cybersecurity matters, including threats, events and program enhancements.


text: The Board of Directors ("Board") has overall responsibility for risk oversight and oversees cybersecurity risk matters. The Board is responsible for reviewing, discussing with management and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures. On a regular basis, the CFO reports to the Board or the Audit Committee of the Board on information technology and cybersecurity matters, including key risks, the potential impact of those exposures on the Company's business, financial results, operations and reputation, the programs and steps implemented by management to monitor and mitigate exposures, the Company's information governance and cybersecurity policies and programs, and significant legal/regulatory developments that could materially impact the Company's cybersecurity risk exposure.


text: The CFO also apprises the Board of cybersecurity incidents promptly for more significant incidents and in the aggregate for less significant incidents.


text: Cybersecurity Risks Our senior management identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. Senior management is asked to consider the severity and likelihood of certain risk factors, drawing upon their company knowledge and past business experience.


text: We maintain specific coverage to mitigate losses associated with cybersecurity incidents that impact our or our third parties' systems, networks, and technology.


text: As of December 31, 2023, we are not aware of any material risks form cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. While we maintain a comprehensive cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see " Item 1A — Risk Factors. "


text: As part of our commitment to maintaining the integrity, confidentiality, and availability of our information assets, the Company places a significant emphasis on cybersecurity. The Company's risk management program is designed to comply with laws and regulations applicable to cybersecurity. The Board is responsible for overseeing the Company's risk management program and cybersecurity is a critical element of this program. The Company's management, including its Director of Information Technology, is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. Our Director of Information Technology has served in similar roles in information technology and information security for over 20 years. He holds an undergraduate degree in Management Information Systems. Our strategies, policies, and initiatives aimed at protecting our systems and data against potential threats are outlined below.

companyName: HG Holdings, Inc.

ticker: STLY


text: Regular risk assessments by management, including our Director of Information Technology, and audits to identify vulnerabilities and areas for improvement. The company performs annual financial and risk assessment audits aimed at identifying potential security threats. Clear delineation of roles and responsibilities within the organization for cybersecurity-related tasks.


text: The Company has implemented a comprehensive set of cybersecurity policies and procedures designed to mitigate risks and protect our information assets. These policies cover areas such as:


text: Access control: Ensuring that access to sensitive systems and data is granted only to authorized personnel and regularly reviewed and updated.


text: Establishing procedures for responding to cybersecurity incidents in a timely and effective manner. This includes notifying appropriate stakeholders, conducting a thorough investigation, and implementing remediation measures to prevent future occurrences.


text: Employee training: Providing ongoing cybersecurity awareness training to all employees to ensure they understand their role in protecting company assets.


text: The Company is committed to complying with all applicable cybersecurity regulations and standards. We regularly review our cybersecurity practices to ensure they align with industry best practices and regulatory requirements.


text: Cybersecurity is a top priority for us and we are dedicated to continuously improving our cybersecurity posture to protect our systems and data from evolving threats. By implementing robust governance, policies, technologies, and compliance measures, we strive to maintain the trust and confidence of our stakeholders in our ability to safeguard their information.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Item 1A. Risk Factors – Risks Related to the Company - Cybersecurity risks and cyber incidents may adversely affect our business in the event we or any other party that provides us with essential services experiences cyber incidents" in this Annual Report on Form 10-K.


text: Our information security program is managed through a dynamic enterprise-wide cybersecurity strategy, policies, standards, architecture, and processes. The Bank relies upon a formalized internal Information and Cybersecurity Program ("the Program") to safeguard confidential information, maintain the confidentiality of our customers' data and to ensure the integrity of financial transactions. The Program is approved by the Bank's Board of Directors or a Committee thereof annually, and is designed to identify reasonably foreseeable internal and external threats, assess the likelihood and potential damage these threats could cause, and assess the appropriateness of policies, standards and procedures used to identify and mitigate risks associated with a material Cybersecurity incident. The Program has been designed to align with industry best practices, as well as Regulatory guidelines and laws; and leverages the National Institute of Standards and Technology Cybersecurity framework ("NIST CSF") as its baseline. We are dedicated to cybersecurity and maintaining the trust and confidence of our customers and stockholders.

companyName: Bogota Financial Corp.

ticker: BSBK


text: Additionally, we maintain an Incident Response Plan that provides established procedures for timely reporting and escalation of significant cybersecurity incidents; our commitment involves promptly notifying regulatory authorities, customers, and other stakeholders in the event of any material cyber incidents that may impact our operations or the security of sensitive information. The Incident Response Plan is coordinated through the Director of Information Technology ("Director of IT") and key members of executive management who are responsible for escalation as part of the Plan.


text: We use a layered defense management approach to managing cybersecurity. The Bank's cybersecurity operations function is headed by the Director of IT who is responsible for managing information security risks by developing and implementing information security strategies, architecture, and procedures and acts as the first line of defense. The Director of IT oversees a team of internal and external security professionals in safeguarding our critical data, systems, and assets against threats, breaches, and attacks. The Director of IT is also responsible for ensuring the confidentiality, integrity, and availability of information assets.


text: The information security program, policies, and standards are managed by the Vice President of Information Security Systems ("VP, ISS"), who leads the enterprise wide technology risk management function. The VP, ISS acts as the second line of defense and provides risk oversight for the Bank's technology operating infrastructure and operations. The VP, ISS function manages testing of technology controls, technology risk assessments, risk reporting, information security third-party due diligence, monitoring the implementation of risk mitigation actions, and tracking their effectiveness over time. The Bank's internal auditors and Board of Directors act as the third line of defense, providing the independent assurance function. In addition to the above risk management framework, we engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. Additionally, we actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections for any portion of our workforce that has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to opine on their design and operating effectiveness and make recommendations to strengthen our risk management program.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Our Operations" in Item 1A. Risk Factors.


text: As part of our governance structure, the Board of Directors, Chief Executive Officer and Director of IT play an active role in overseeing our cybersecurity program. Regular briefings on cyber risk management and incident response activities are conducted, ensuring a high level of governance and accountability in addressing cybersecurity concerns. The Bank and its vendors provide periodic reports to our Board of Directors, or Committee thereof, as well as to our senior management team as appropriate. These reports include updates on the Bank's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: We are steadfast in our commitment to collaborate with regulatory authorities to enhance industry-wide cybersecurity standards. Given the ongoing and changing cyber threat landscape, we are committed to invest in, improve and update our cybersecurity practices on an ongoing basis. Regular assessments, testing, audits, and training of all employees are conducted to adapt to emerging threats and enhance our ability to safeguard the interests of our customers.


text: To combat ever-present cyber risks, the Company maintains a comprehensive cybersecurity program, which includes employee training, annual risk assessments and a comprehensive cybersecurity environment meant to detect, prevent, and limit unauthorized or harmful actions across our information technology environment. However, we operate in the medical device sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to patients, customers, and employees; violation of privacy laws and other litigation and legal risk; and reputational risk.

companyName: PULSE BIOSCIENCES, INC.

ticker: PLSE


text: We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We use recognized commercially reasonable measures, tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture on an ongoing basis through regular vulnerability scans, penetration tests and third-party reviews. Other key components of our cybersecurity program include, but are not limited to, asset management, encryption, data loss prevention technology, access controls, identity and access management (IAM), such as multi-factor authentication (MFA), vulnerability management, endpoint threat detection and response (EDR), logging and monitoring involving the use of security information and event management (SIEM), privileged access management (PAM), email and web gateway protection, multi-faceted backup and data recovery solutions, anti-malware, firewalls, IDS and IPS, auditing and monitoring, regular policy updates, security awareness training, anti-phishing campaigns, intrusion detection and prevention, vulnerability and patch management, and third-party risk management. We also subscribe to third-party threat intelligence tools and services that support monitoring, analyzing, and responding to emerging risks and threats. We require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards, although currently we do not audit this. While we believe our cybersecurity practices are comparable to those of similarly situated companies, the Company does not currently audit its third-party service providers' cybersecurity practices, except through annual SOC-1 reviews and its regulatory and quality control auditing of vendors engaged in clinical trials or the manufacture of products used in the assembly of our medical devices. We also rely on industry leading third party service providers to provide the systems required to effectively run our clinical trials and require that these third-party service providers implement and maintain standard cybersecurity practices. We have business continuity plans that we regularly review and update in line with our evolving applications architecture. We believe our cybersecurity practices comply with applicable legal requirements, including those established by the FDA.


text: To date, we have not experienced any material security incidents or data breaches as a result of a compromise of our information systems and are not aware of any cybersecurity incidents that have had a material impact or are reasonably likely to materially affect our business strategy, operating results, or financial condition.


text: One of the key functions of our board of directors is informed oversight of our compliance program, including the processes used to mitigate risks associated with cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure generally, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its enterprise-level oversight of risks associated with cybersecurity threats directly as a whole, as well as through delegation of responsibility to our Audit Committee, which serves and functions as the Board's primary oversight body to monitor the Company's cybersecurity and related information technology risk. The Audit Committee receives periodic reports from management personnel responsible for enterprise risk management, which also evaluates cybersecurity among other enterprise level risks on an annual basis. It also assesses the experience of management personnel responsible for preventing, mitigating, detecting, and remediating any cyber incidents, including applicable third-party providers. The Audit Committee also oversees the Company's disclosure of any cybersecurity incident deemed material as required by the SEC or any other governmental authority, as applicable.


text: At the operational level, the Company has established an information security team, including a Privacy and Security Council ("PSC"), consisting of representatives from IT, Legal, HR, and Finance, to help provide governance and strategic direction for managing cyber risks, maintaining IT regulatory compliance, and optimizing technology initiatives for alignment with our company goals and objectives. Pursuant to various policies adopted by the Company since 2021, including the Company's Privacy Policy, the Company's senior most IT employee, our Information Security Coordinator (our "ISC"), is a member of the PSC and has frontline responsibility for assessing, identifying and managing material risks from cybersecurity threats. The PSC convenes not less than annually, and meetings include updates on cybersecurity matters provided by the information security team.


text: Our ISC has expertise in the following areas which assist in assessing and managing applicable cybersecurity risk: 27 years of IT experience including endpoint detection, security, incident management and response, vulnerability management and response, event management and response, and network security segmentation. The ISC provides regular reports on ongoing risk and mitigation practices, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company, to our Chief Executive Officer, Chief Technology Officer, and General Counsel, who then report to the Audit Committee and the Board.


text: Our incident response plan designates our ISC as primarily responsible for identifying and evaluating any cybersecurity incident or suspected incident and reporting any such incidents to our General Counsel in order for management to evaluate materiality, and to report to our Audit Committee, our Board and make public disclosures, as applicable. Our General Counsel is responsible for routinely updating both the Board and the Audit Committee on the Company's cybersecurity personnel, practices and processes and, pursuant to our data breach response policy, which is updated from time to time, he must report to the Board in the event of any detected material incident and regularly update the Board on any mitigation and remediation steps being taken in connection with the Company's response. The Company has, from time to time, engaged external experts, including cybersecurity assessors, consultants, auditors, and legal counsel, in evaluating and testing our risk management systems and on a project-specific basis to assist us with projects that will improve our IT infrastructure, strengthen our products' security posture, and improve our cyber readiness. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.


text: Our risk management strategy comprises of ensuring access controls are in place to prevent unauthorized users from accessing our systems. Our systems are completely cloud-based and our providers have their own security protocols to assist us. We retain audit logs and login records for review, and we use multifactor authentication and username/password management for all of our systems.

companyName: Envirotech Vehicles, Inc.

ticker: EVTV


text: Our cybersecurity program is overseen by our Executive team comprising of the Executive Vice President and the Chief Financial Officer. An experienced information technology personnel identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. In the event of a cybersecurity threat, the IT personnel assesses the threat and determines the course of action to eliminate the threat. Depending on the circumstances, such threat is communicated to the executive team and if warranted to the Audit Committee for further action.


text: The Company manages risks through a multi-faceted approach. Steps include outlining guidelines for data access, usage, and protection, ongoing security training and awareness programs for employees, implementation of strong authentication techniques including multi-issue authentication (MFA), regularly updating and patching software and structures facilitates to mitigate vulnerabilities, conducting cybersecurity audits, and closely working with cybersecurity specialists to staying informed about emerging threats and trends and to implement multi-layered protections.

companyName: ICC Holdings, Inc.


text: The Company assesses and reports on any findings quarterly at both an internal and external Enterprise Risk Management (ERM) meeting. Our approach to managing cybersecurity risk aligns with the five key functions contained within the COBIT Framework: meeting stakeholder needs; covering the enterprise end to end; applying a single integrated network; enabling a holistic approach; and separating governance from management.


text: Currently, the Company has not been materially impacted from an operational or financial perspective from cybersecurity threats. Cybersecurity is a rapidly evolving area that the Company takes great efforts to mitigate any adverse impacts; however, the Company cannot guarantee that it will not be subject to cybersecurity attacks. See Item 1A, Risk Factors, for more information.


text: Our Board provides oversight for cybersecurity risks primarily through its ERM committee. The Company's Chief Information Officer (CIO) provides information quarterly to the ERM committee on cybersecurity risks. The CIO has 30 years of experience in technology both on the company and consulting sides and a B.A. in Economics.


text: Management oversight of cybersecurity risks is provided through the Company's internal ERM committee, which is comprised of executive management and our Director of Actuarial Services. The ERM committee has identified numerous risk attributes and developed risk control reports that identify drivers, characteristics, stress testing levels, potential mitigation efforts, or risk appetite, and any reaction in response to a breach. The ERM committee meets quarterly to review and update risk limit grids, current estimates relative to pre-defined acceptable levels, and make adjustments as needed.


text: The Company's Networking department, which reports up to the CIO, is responsible for the day-to-day monitoring of cybersecurity risks. Mitigation efforts are executed, if necessary, to cope with the impact of a cybersecurity incident. The Company is finalizing its Cybersecurity Incident Response Plan and anticipates it being available in early April 2024. We anticipate it will provide a framework for the identification, evaluation, and escalation of potential cybersecurity events.


text: The CIO routinely engages third-party cybersecurity consultants to conduct network security audits. The Company also engages other their-party consultants in a number of areas to support the assessment, identification, and management of cybersecurity risks, including risk assessments, log monitoring, threat intelligence, system penetration testing, and incident response, among others.


text: The Company performs cybersecurity due diligence and monitoring of third-party vendors, which includes a security questionnaire to identify the cybersecurity controls and protections maintained by a third party. Lasty, the Company requires that all employees participate in monthly training videos that are geared toward identifying potential cybersecurity threats.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information from cybersecurity threats.

companyName: CADIZ INC

ticker: CDZI


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; offsite backup storage of critical systems and information; Cadiz Inc. the use of external service providers to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process to identify and mitigate risks from third parties, such as service providers, suppliers, and vendors.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats, see Item 1A, "Risk Factors", above.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit & Risk Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program as part of our overall enterprise risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management promptly updates the Committee regarding any material cybersecurity incidents, and as necessary as to any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team, with the assistance of our external service providers, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises the cybersecurity activities of both our internal personnel and our retained external cybersecurity consultants.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, the risk of intellectual property theft, fraud, harm to employees or third parties with which we conduct business and violation of data privacy or security laws.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We have established policies and controls for assessing, identifying and managing material cybersecurity risks and responding to material cybersecurity incidents.


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments when there is a material change in our business practices that we believe could affect information systems that are vulnerable to cybersecurity threats. These risk assessments include identifying reasonably foreseeable internal and external risks and the potential harm if the risks were to materialize. We conduct these risk assessments directly and also periodically engage third-party providers to support these processes.


text: Following these risk assessments, we evaluate how to appropriately implement and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We have implemented cybersecurity tools, conducted employee training, and monitored emerging laws and regulations related to data protection and information security. We may also [obligate] certain third-party business partners to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect the Company.


text: Cybersecurity events and data incidents are evaluated, assessed based on severity and prioritized for response and remediation. Under our incident response policies, incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.


text: We have not, to date, experienced a cybersecurity incident that was determined to be material, although, like any technology provider, we have experienced incidents in the past. Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management team. Our board of directors has delegated responsibility to the Audit Committee for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive regular updates from senior management, including leaders from our information technology, legal and compliance teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, information on how management is addressing and/or mitigating those risks, cybersecurity incidents (if any) and the status on key information security initiatives.


text: Our Chief Executive Officer and Chief Financial Officer are principally responsible for overseeing the cybersecurity risk management program, in partnership with outside consultants, as well as managing and responding to material cyber incidents if any occur. They will provide periodic briefings to the Audit Committee and to the Board of Directors about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, our policies for managing and responding to cybersecurity incidents include procedures for appropriate escalations to our Audit Committee Chair.


text: We have developed a comprehensive Information Security Program ("ISP") that was designed as the guiding policy to establish standards designed to protect the confidentiality of nonpublic, sensitive personal and business information, protect against potential threats to the security or integrity of such information, and protect against unauthorized access to or use of such information. The ISP applies to all Company employees, contractors, consultants, and third-party vendors as well as all technology owned and operated by the Bank. The scope of the ISP covers customer data as well as the Company's strategic and proprietary information. The Board of Directors approves the ISP annually. Additionally, the Information Technology Steering Committee ("ITSC") must approve significant modifications to the ISP prior to review and approval by the Board of Directors. The Chief Information Officer ("CIO") is responsible for the implementation and maintenance of the ISP.

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: Identification of sources and types of technology threats Tools and processes to manage technology security, such as change control approval, employing a Unified Threat Management System, and usage of anti-virus and anti-spam hardware Ongoing security assessments conducted by third-party vendors, such as vulnerability assessments and penetration testing, and mitigation of any findings Continuous firewall monitoring provided by a third-party vendor Information security training for employees provided by a third-party vendor Annual security audits of third-party vendors Our Information Security Governance Plan ("InfoSec") is a component of the ISP and provides for strategic oversight of critical aspects of the Bank's information security. The objective of InfoSec is to provide a framework for decision-making and accountability for information security issues to ensure that the ISP is actively monitored and information security permeates through all areas and initiatives across the organization.


text: Security assessments are an ongoing activity within the Bank, and the Security Assessment Policy identifies security assessment requirements and those individuals accountable for ensuring the assessments comply with the requirements. All assessment activities must be approved by the Chief Risk Officer. The coverage of assessments includes, but is not limited to, physical security assessment, information technology general controls audit, vulnerability assessment, penetration testing, and social engineering testing. Results are shared with the ITSC, executive management and the Board of Directors.


text: There is an established Incident Response Program ("IRP") that provides a framework for us to respond quickly, decisively, and appropriately to limit the impact of an adverse event, such as a cybersecurity incident, on customers and information resources. Procedures have been developed that outline the necessary steps should an incident occur, such as incident identification, classification, and escalation. We use a Cybersecurity Assessment Tool to assess our cybersecurity preparedness on a periodic basis. A Cybersecurity Incident Response Team, which is part of our general Incident Response Team, will take the appropriate actions as outlined in the IRP in the event a cybersecurity situation occurs.


text: We do not believe that risks from cybersecurity threats, including the previously disclosed cyber-attack that occurred in April 2023, have materially impacted or are reasonably likely to materially impact our overall business strategy, results of operations, or financial condition. We maintain cybersecurity insurance to cover the costs resulting from cyber-attacks; however, the policy may not cover all losses from cybersecurity incidents. Refer to the discussion on the April 2023 incident in Note 23 of our financial statements and the discussion of cybersecurity risk in Part I, Item 1A, "Risk Factors".


text: Board of Directors The Board of Directors, in coordination with the Audit Committee, oversees the Company's management of cybersecurity risk. The Board receives monthly reports from the CIO, focusing on cybersecurity and information technology updates. The reports include key insights regarding our security risk score, areas of focus, and metrics from our third-party provider regarding security investigations and incidents as well as the results of training and phishing simulations. The Audit Committee receives periodic updates on information security risk and maturity of our ISP. The Audit Committee also receives reports with the results of security assessments conducted by third-parties.


text: Under the leadership of the CIO, the Information Technology Steering Committee ("ITSC") serves to improve the effectiveness of information technology at the Bank and ensure alignment with the Bank's strategic business plan and statement of risk appetite. Composition of the ITSC will consist of senior management from the business areas. Meetings occur at least bi-annually. The ITSC is tasked with reviewing the Bank's technology, information security, business continuity, digital initiatives, vendor management, and data management strategic direction and providing feedback to management.


text: The Information Security Governance Council ("ISGC") acts on the behalf of and to assist the Board of Directors and executive management in fulfilling its oversight responsibilities regarding the Bank's information security programs and risks. The ISGC is comprised of members from Risk, Information Technology, and other strategic areas within the Bank, including the CIO, and meets at least quarterly. The responsibilities of the ISGC include providing strategic oversight and implementation guidance for the ISP, aligning cybersecurity and business objectives, monitoring and reporting on cybersecurity and information security incidents, and promoting a strong culture around information security.


text: As stated above, the CIO is a member of the ISGC, chairs the ISTC, and reports to the Chief Strategy and Innovation Officer. The CIO has over 40 years of business experience in information technology and cybersecurity. We outsource the position of Chief Information Security Officer "(CISO") to a third-party vendor that specializes in partnering with organizations to enhance cybersecurity management.


text: Information security is an important part of the Company's culture and foundational to its management. This philosophy is emphasized throughout the organization by the Board of Directors, senior leadership, and team members to help promote a Company-wide culture of cybersecurity risk management.

companyName: FOOT LOCKER, INC.


text: We use information technology and third-party service providers to support our global business processes and activities, which exposes us to cybersecurity risks. We have from time-to-time experienced cybersecurity incidents. In the event of a cybersecurity incident, we respond in accordance with our policies, processes, applicable laws, and regulations. When necessary, we also engage third parties, such as cybersecurity advisors, to assist in investigating and remediating incidents. To date, the cybersecurity incidents have not had a material effect on our business strategy, results of operations, or financial condition.


text: Key Program Components We take cybersecurity seriously, and our cybersecurity program is aligned to well-known and established cybersecurity frameworks. We use, and continue to improve, our cyber defense-in-depth strategy, which uses multiple layers of security for holistic protection.


text: Our cybersecurity governance program is strategically integrated into our enterprise risk management and is periodically presented to the audit committee, which is responsible for oversight of the enterprise risk management framework associated with technology, security, data, and privacy, and the Board of Directors. These procedures include regular risk monitoring by management to update current risks and identify potential new and emerging risks. The Technology Committee receives regular briefings from our Chief Operations Officer, Chief Technology Officer, Chief Information Security Officer, and outside experts on cybersecurity risks and cyber risk oversight. During these meetings, the Technology Committee and management discuss these risks, risk management activities and efforts, best practices, lessons learned from incidents at other companies, the effectiveness of our security measures, and other related matters. The Technology Committee Chair reports on the committee's meetings, considerations, and actions to the Board at the next Board meeting following each Technology Committee meeting. The Audit Committee also discusses and receives updates on cybersecurity matters in connection with its oversight of enterprise risk management.


text: We also maintain a variety of incident response plans that are utilized when incidents are detected. We conduct periodic tabletop exercises, in which different internal and external stakeholders, including from time to time our CEO, Non-Executive Chair, or Board of Directors, participate in a simulated cyber scenario. The purpose of these exercises is to test our cyber incident response plan, identify weaknesses or gaps, and ensure that all participants are aware of, and familiar with, their roles and responsibilities.


text: We require employees with access to information systems to undertake data protection and cybersecurity training. In addition, certain individuals with privileged access, such as system administrators and developers, are subject to additional controls and monitoring activities. We also conduct periodic phishing campaigns to train users to better identify, report, and avoid malicious content.


text: We recognize that third-party service providers may introduce cybersecurity risks to our organization. In an effort to mitigate these risks, we have implemented a process before engaging with third-party service providers which are designed to assess their cybersecurity practices. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers, requiring them to adhere to certain cybersecurity standards and protocols.


text: Our Chief Information Security Officer, with oversight from the Chief Technology Officer and Chief Operations Officer, is primarily responsible for assessing and managing cybersecurity risks. Our Chief Information Security Officer has extensive cybersecurity knowledge and skills gained from over 25 years' experience in the field. Our Chief Information Security Officer is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Several experienced information security professionals report to our Chief Information Security Officer and he is supported by a team of trained cybersecurity team members. In addition to our extensive in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: Notwithstanding the breadth of the Company's information security program, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse impact. For a discussion of whether and how any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, see Item 1A. "Risk Factors," which is incorporated by reference into this Item 1C.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: TSS, Inc.

ticker: TSSI


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: As part of our cybersecurity risk management system, our IT management team tracks and logs privacy and security incidents across our OEM partners, Microsoft and Oracle and other IT system providers, our vendors, and other third-party service providers to remediate and resolve any such incidents. Any significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We would consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosures and other compliance decisions. Our management is tasked with apprising TSS's independent public accounting firm of matters and any relevant developments.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee. The Company's IT department regularly uses specialist firms to independently test our cybersecurity controls. The IT management team is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with security personnel, threat intelligence and other information obtained from government, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions. See " Risk Factors - Security breaches and attacks on our computer systems could lead to significant costs and disruptions that could harm our business, financial results and reputation ".


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Gyrodyne, LLC

ticker: GYRO


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT service provider to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes that isolate the Company's financial and operating records from any other systems including email and other internet applications.


text: Our cybersecurity strategy prioritizes detection, analysis, and response to mitigate unknown and unexpected threats and security risks. Our cybersecurity risk management processes include technical security controls, monitoring systems, employee training, and management oversight to assess, identify, and manage risks from cybersecurity threats. We have implemented a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security and mobile device usage. We have mandatory training in the areas of cybersecurity, privacy, and confidential information handling. To date, we have not experienced any cybersecurity threats or incidents which have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, but we cannot provide assurance that they will not have a material impact in the future. See "Risk Factors" in Item 1A of this Annual Report for additional information about our cybersecurity risks.

companyName: Enservco Corp

ticker: ENSV


text: Also as part of our cybersecurity program, we partner with a third-party information technology firm to support and evaluate our cybersecurity and informational security program. This third-party service includes product and software security for data protection and cyber defense, to monitor, detect, prevent, and protect our Company against potential cybersecurity threats.


text: Our Board of Directors has overall responsibility for risk oversight in performing this function. Our Board of Directors assesses cybersecurity and information technology risks and the controls implemented to monitor and mitigate these risks. Our cybersecurity program is overseen by our Health, Safety, and Environmental Director, who has been a Heat Waves employee for over five years and has been in charge of our data protection and product and software security and compliance initiatives for the past several years. Our HSE Director meets regularly with the Board of Directors to share information about potential cybersecurity events and monitor, prevent, and detect potential cybersecurity incidents. The Board of Directors is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. The Board of Directors also discusses relevant incidents in the industry and the evolving threat landscape.


text: Risk Management and Strategy Aemetis' cybersecurity and information security framework includes physical, administrative and technical safeguards, as well as plans and procedures we believe are reasonable to help Aemetis prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact our operations, facilities and employees. These plans are based upon our assessment of risk considering our industry, specific operations, cyber perimeter, social exposure, information confidentiality and tertiary stakeholders.

companyName: AEMETIS, INC

ticker: AMTX


text: Our efforts focus on protecting and enhancing the security of our information systems, software, networks, and other assets. These efforts are designed to protect against, and mitigate the effects of, among other things, cybersecurity incidents where unauthorized parties attempt to access confidential, sensitive, or personal information; potentially hold such information for ransom; destroy data; disrupt or degrade service or our operations; sabotage systems; or otherwise cause harm to Aemetis, our customers, suppliers, or other key stakeholders. We employ capabilities, processes, and other security measures we believe are designed to reduce and mitigate these risks.


text: Aemetis contracts with a primary Managed Security Provider (MSP) to provide services that assist us with assessing, enhancing, implementing and monitoring our cybersecurity risk management programs and responding to incidents. Aemetis maintains cyber recovery plans as well as a cybersecurity insurance policy.


text: Aemetis utilizes a third-party cybersecurity and information security awareness training programs. Training is administered and tracked through online learning modules and ongoing phishing simulations. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe our controls are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.


text: Role of Management Aemetis' cybersecurity initiative is led by its Chief Financial Officer, who is in the unique position of being able to integrate cybersecurity with the financial internal control framework. He is responsible for administration of the cybersecurity and information security program and risk management, using his experience working with information technology and financial control system during a majority of his career, including over 10 years of overseeing the Aemetis information technology and security program.


text: We utilize a Managed Security Provider (MSP) who serves as the central point for identifying all cybersecurity incidents and reporting, including incidents that directly target company network, internal information systems and incidents originating from third parties. The MSP provides end-to-end operations for the purpose of monitoring, detecting, alerting and responding to cyber incidents. The MSP is also responsible for activating the containment and resolution efforts where appropriate to support Aemetis through the resolution of the incident.


text: The MSP escalates incidents with significant impact and pervasiveness to Aemetis' Chief Financial Officer, who evaluates each incident in terms of its impact on Aemetis and operations, ability to conduct business with customers and suppliers, brand reputation and health, safety or the environment, and the speed and degree to which the incident has been contained. Our Chief Financial Officer, working with the executive management team, also manages the communication with our Board and outside parties. After initial identification, evaluation and escalation for material events, the MSP monitors all cybersecurity incidents for changes in degree of impact or pervasiveness.


text: Role of the Board The Board of Directors ("Board") recognizes the importance of cybersecurity in safeguarding the sensitive data and protecting the perimeter of the computer network. The Board is responsible for overseeing overall risk management for the Corporation, including review of the cybersecurity program. As part of its oversight responsibilities, the Board receives an annual cybersecurity update from the Chief Financial Officer. The annual review includes oversight of cyber exposure, risk assessment, incident response, integration with other control activities, internal monitoring, and risk management processes, such as updates to Aemetis' cybersecurity programs and mitigation strategies, and other cybersecurity developments.


text: The operation of our business is dependent on the secure functioning our computer infrastructure. This infrastructure is used to maintain key processes including management of sensitive company information and operation of sales, record-keeping, and accounting functions.

companyName: RADNOSTIX INC

ticker: INIS


text: We employ a specialized third-party information technology ("IT") management firm to monitor and manage our cybersecurity functions. Processes employed include real-time monitoring of company communications and IT activities and consultation and risk assessment of company procedures. Additionally, our third-party IT firm provides education to management and employees regarding our specific IT risks. All our employees receive information security training (including data protection and fraud awareness) on an annual basis. Department managers are given additional risk management training as part of periodic management meetings. Our activities are monitored at all times by our IT firm; we regularly meet with our them to review our cybersecurity response plans, discuss any needed updates, and identify risk management actions to be taken. The IT firm reports all matters of cybersecurity including any threats, breaches, or risks directly to our Chief Financial Officer who reports directly to the Chief Executive Officer. Updates regarding cybersecurity are provided to our directors at least annually and as needed for any important developments including cybersecurity breaches and risks.


text: We carry a cybersecurity insurance policy to help cover any costs that may occur from a cybersecurity incident. Although risks from cybersecurity threats and implementation of our cybersecurity program have not materially affected our business strategy, business operations or our financial condition, a cybersecurity incident could have a material adverse effect in the future if it were to cause business disruption or data loss.


text: Related to Cybersecurity Risks Our board of directors, as a whole and through its committees, holds overall oversight responsibility for our risk management processes, including in relation to risks from cybersecurity threats. Our board of directors exercises its oversight function through the audit committee, which oversees the management of risk exposure across various areas, including cybersecurity risks, in accordance with its charter. The audit committee receives quarterly reports from our Management on the status of our cybersecurity program. The Chair of the audit committee provides a quarterly report to the board of directors, which includes any key updates on cybersecurity matters, as applicable.

companyName: MILESTONE SCIENTIFIC INC.

ticker: MLSS


text: Our management team is responsible for the day-to-day administration and management of our cybersecurity program, under the direct supervision of our Chief Executive Officer currently we also work with external security service providers to support our security monitoring and threat detection capabilities and have implemented a process to report relevant findings to the Chair of audit committee where appropriate.


text: We maintain a cybersecurity program, which includes processes for identification, assessment, and management of cybersecurity risks. We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify potential areas of enhancement, and develop strategies for the mitigation of cyber risks. We have implemented a process to periodically conduct security awareness training for employees.


text: Our team is informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third-party security software and technology services. In addition, we use third-party security solutions, monitoring, and alerting tools and resources, designed to monitor, identify, and address risks from cybersecurity threats. We also have implemented processes and technologies for network monitoring and data loss prevention procedures, and from time to time review such processes and technologies.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10 K for more information.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to cyber risk management ("CRM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's CRM program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: UNIVERSAL STAINLESS & ALLOY PRODUCTS INC


text: As one of the critical elements of the Company's overall CRM approach, the Company's cybersecurity program is focused on the following key areas:


text: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management includes interaction with the Company's Chief Information Officer ("CIO") at least quarterly and similar interaction on this topic with other members of management.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the CIO and the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: The Board, in coordination with the CIO and Company management, oversees the Company's CRM process, including the management of risks arising from cybersecurity threats. The Board receives at least a quarterly update on cybersecurity risks, which addresses a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Board, the CIO and other members of the Company's management team will discuss, at least annually, the Company's approach to cybersecurity risk management.


text: The CIO, in coordination with our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and General Counsel ("GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, members of the CIO's team are deployed to address cybersecurity threats and to respond to cybersecurity incidents. The Company's management team, through ongoing communications with CIO's team, monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.


text: The CIO holds a B.S.B.A. degree in Management Information Systems and has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Officer for the Company. The Company's CEO, CFO and GC each hold undergraduate degrees in their respective fields, and collectively have over 50 years of experience managing risks at the Company and at similar companies.


text: Cybersecurity threats, including all previous cybersecurity incidents, have not materially affected, or currently are believed by the Company to not materially affect the Company, including its business strategy, results of operations or financial condition. While these risks have yet to materially affect the Company, the Company cannot guarantee that its ongoing and robust approach towards cybersecurity will be able to prevent all cybersecurity incidents that could have a material effect on the Company. For more information about cybersecurity risks that the Company faces, see "If we are unable to protect our information technology infrastructure against service interruptions, data corruption, cyber-based attacks or network security breaches, our operations could be disrupted" in Item 1A, Risk Factors.


text: Cybersecurity Risk Management Program Overview We recognize the critical role that properly managing cybersecurity risk plays in maintaining the trust and confidence of our stockholders, the patients in our clinical trials, our employees, our business partners and our other stakeholders. Accordingly, our cybersecurity program is designed to identify, assess, manage and mitigate material risks from cybersecurity threats through a variety measures, including risk assessments, implementation of security measures, and ongoing monitoring of systems and networks. In collaboration with our third-party information technology service providers, a cross-functional team comprised of representatives from our administrative, finance and legal functions actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We also engage external experts, including information technology experts, other consultants, and auditors to evaluate our cybersecurity measures and risk management processes.

companyName: CervoMed Inc.

ticker: CRVO


text: We also identify our cybersecurity threat risks by comparing our processes to industry standards and best practices as well as by engaging experts to manage our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and other evaluations on a routine basis;


text: provide training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: leverage threat intelligence available to us and our third party IT service provider to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Board Oversight of Cybersecurity Risk Management and Governance Our Board is responsible for general oversight of our risk environment and associated management policies and practices and has delegated to its Audit Committee the responsibility for oversight of our certain major risk categories and exposures, including with respect to cybersecurity and management's processes to monitor and control them. The Audit Committee meets regularly throughout the year and, on no less than a quarterly basis, receives and reviews a report from management, including the Company's General Counsel, regarding the Company's IT, cybersecurity, data security, and physical security risk, including any suspected material or immaterial cybersecurity incidents during the preceding quarter, if any, and discusses such matters with appropriate management and other personnel. In addition, on a semi-annual basis, the Audit Committee receives a report from the Company's primary third-party information technology and cybersecurity regarding the Company's IT environment, overall cybersecurity risk management program and strategy and education regarding emerging trends and threats.


text: Management's Role in Cybersecurity Risk Management and Governance Our executive management team is responsible for assessing and managing material risks from cybersecurity threats and possess relevant experience and expertise in various disciplines that are key to effectively managing such risks. The experience and expertise of our executive management team is also supplemented by our external IT service providers that collectively have extensive, broad experience and expertise in these areas. Our executive management team reports information about such risks to the Audit Committee of the Board on at least a quarterly basis.


text: We depend on and engage various other third parties, including suppliers, vendors, and service providers, to support key elements of our business including our information technology infrastructure. Our processes address cybersecurity threat risks associated with our use of such third-party service providers. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel.


text: In response to an identified cybersecurity incident, a group comprised of appropriate management personnel, our third-party information technology service provider and, depending on the scope and severity of the incident, additional third-party subject matters experts, will be assembled to develop and implement a response strategy to contain, control, and remediate the cybersecurity incident, including securing our affected systems and/or information, mitigating harmful effects of the incident, preventing further compromises, and communicating information to affected parties, regulatory agencies and law enforcement, as necessary. This group will also report any such cybersecurity incident to the Audit Committee of the Board.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis by both management and the Board, including how such risks could materially affect our business strategy, operational results, and financial condition.


text: As of the date of this Annual Report, we have not experienced a cybersecurity incident that results in a material effect on our business strategy, results of operations or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such an incident or risks related thereto.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading Item 1A. Risk Factors – General Risks Related to the Company's Business and Operations," which disclosures are incorporated by reference herein.


text: As a company committed to safeguarding our operations, assets and stakeholders against cyber threats, we recognize the critical importance of the need for cybersecurity risk management and strategy. In today's digital landscape, where cyber threats continue to evolve and proliferate, it is imperative that we remain vigilant and proactive in our approach to cybersecurity.

companyName: ESCALADE INC

ticker: ESCA


text: In this section, we outline our cybersecurity risk management strategies and initiatives aimed at mitigating cyber risks and ensuring the resilience of our organization. From risk assessment and threat detection and continuous improvement, our approach to cybersecurity reflects our resolve to maintain the confidentiality, integrity and availability of our systems and data.


text: Risk Assessment – We regularly conduct risk assessments to identify and evaluate potential cybersecurity threats and vulnerabilities. These assessments consider factors such as our current IT infrastructure, the sensitivity of our data, industry best practices, and emerging cybersecurity trends.


text: Threat Detection and Prevention – Given our limited resources, we prioritize the deployment of cost-effective tools and technologies for threat detection and prevention. This includes the use of firewalls, intrusion detection systems, antivirus software, and security information and event management (SIEM) solutions to monitor and mitigate potential security incidents.


text: Employee Training and Awareness – We understand that employees play a crucial role in maintaining cybersecurity. Therefore, we provide regular training and awareness programs to educate our staff about cybersecurity best practices, common threats and how to recognize and report suspicious activities.


text: Engagement of Third-Party Consultants and Assessors – In addition to our internal efforts to manage cybersecurity risks, we recognize the value of engaging third-party consultants, firms or assessors to provide specialized expertise and support in enhancing our cybersecurity posture, policies and procedures. While our internal IT staff possess valuable skills and knowledge, leveraging external resources can provide additional insights, validation and assurance in our cybersecurity initiatives.


text: Continuous Improvement – We are committed to continuously improving our cybersecurity posture in line with industry standards and best practices. This includes staying informed about emerging threats and vulnerabilities, conducting regular security audits and assessments and investing in cybersecurity technologies and training as resources allow.


text: Currently, we have not identified any risks stemming from known cybersecurity threats, including those resulting from previous cybersecurity incidents, which have significantly impacted our operations, business strategy, financial condition or results of operations. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company's business. See " Risk Factors – Operational Risks to the Company and Our Business. "


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other threats or risks. The Audit Committee is primarily responsible for overseeing the Company's risk management processes, which include cybersecurity, global operations, product compliance and other regulatory risks.


text: The Audit Committee receives reports from management regarding the Company's assessment of the cybersecurity risks, and other risks, on an annual basis. In addition, management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents. The Audit Committee reports regularly to the full Board regarding its activities, including those related to cybersecurity.


text: Management of the Company is responsible for the day to day risk management process, specifically the Director of IT, who reports and operates under the direction of the Chief Financial Officer (CFO), who then reports directly to the Audit Committee regarding such risks. The CFO provides updates to the Audit Committee on cybersecurity risks and threats annually, but the Director of IT attends both the Audit Committee meetings and the Board meetings to provide further updates on cybersecurity and other IT related matters. At a minimum, the Audit Committee is given updates on a quarterly basis, but if a situation were to arise, the Audit Committee would be notified once the Company was aware of the issue.


text: Our management team, led by our CFO, is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity risks and incidents through updates by our Director of IT. This management team is responsible for assessing and managing risks that may arise from cybersecurity threats. Our CFO has over 10 years of experience managing IT operations including strategy, infrastructure and execution. Our Director of IT has over 20 years of experience in information technology including roles managing operations, compliance, development, applications, information security, support and execution.


text: As of December 31, 2023, cybersecurity and data protection policies and procedures have been implemented. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees receive awareness notices and are informed about new email threats and recent phishing attempts and email frauds. We have capable employees with significant expertise in cybersecurity related to our industry. We evaluate, create and deploy advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.

companyName: TABLE TRAC INC

ticker: TBTC


text: Our Information Technology General Controls are firmly established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery.


text: To date, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For additional information about our cybersecurity risks, see "Any disruption in our software and related information technology systems due to a cyber incident could adversely affect our business, operating results and financial condition" under the heading "Risk Factors Relating To Our Business" in Item 1A. of this Annual Report.


text: The Board of Directors has oversight of the cyber security risk management and strategy. The senior leadership, including our Chief Executive Officer and Chief Financial Officer, regularly meets with and provides periodic briefings to our Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our Chief Executive Officer and Chief Financial Officer are responsible for implementing and maintaining our cybersecurity risk assessment and management processes.