text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are fully integrated into the Company's overall risk management approach, and cybersecurity risks are subject to oversight by the Company's board of managers. The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with specific the goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: Consistent with overall Company policies and practices, the Company's cybersecurity program focuses on the following areas:

secItem: Item 1C


text: The Company uses a reputable third-party managed service provider ("MSP") for cybersecurity support, which has operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. The Company's MSP is staffed with several security personnel, many of which have Certified Information Systems Security Professional ("CISSP") certifications.


text: Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. In the event of a potential cybersecurity incident, the Company's MSP has the capability to take a number of immediate steps to isolate the potential threat.


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: The Company provides annual mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. The Company also conducts monthly "phishing" email testing for every employee and provides remedial follow-up training when necessary.


text: The Company has established and maintains comprehensive incident response and recovery plans, in coordination with the Company's MSP, that fully address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident.


text: Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's operations, risk management, internal audit and other key business functions, as well as the members of the board of managers in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.


text: The board of managers' oversight of cybersecurity risk management is supported by the Company's Incident Response Team (the "IRT"), which is made up of the Company's Co-Chief Information Officers, the Chief Operating Officer, and their designees. The IRT regularly interacts with the board of managers and members of management.


text: The IRT, in coordination with the board of managers, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. Any cybersecurity incidents that are detected by the Company's MSP are routed directly to the IRT. The board of managers receives reports on cybersecurity risks from management. The board of managers will be informed of any cybersecurity incident that is determined by the IRT to be material, and will receive ongoing updates regarding such material incident until it has been addressed. At least once each year, the board of managers and the IRT discuss the Company's approach to cybersecurity risk management with the Company's Co-Chief Information Officers.


text: The Company's Co-Chief Information Officers are the members of the Company's management principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Co-Chief Information Officers work in coordination with the other members of the IRT, which includes our Co-Chief Information Officers, our Chief Operating Officer, and their designees. The Company's Co-Chief Information Officers have each served in various roles in information technology and information security for over 30 years, including in leadership positions with both small and large companies. The Co-Chief Information Security Officers each have extensive knowledge in technology and cybersecurity. The Company's President, Chief Financial Officer, Chief Operating Officer, and Chief Compliance Officer each hold undergraduate, and, in some cases, graduate, degrees in their respective fields, and each have over 20 years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.


text: The Company's Co-Chief Information Officers, in coordination with the IRT, work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. The Co-Chief Information Officers and the rest of the IRT, in collaboration with the Company's MSP, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the board of managers when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company's business strategy, results of operations, or financial condition. See the "General Risk Factors" section in Part I, Item 1A, Risk Factors for more information about the Company's cybersecurity risks.


text: We recognize the paramount importance of cybersecurity in preserving the integrity, confidentiality, and availability of our systems, data, and operations. We are committed to maintaining a comprehensive cybersecurity posture that encompasses proactive risk management, robust defense mechanisms, and continuous monitoring. To this end, we employ a multifaceted approach to cybersecurity, which includes regular assessments of our infrastructure, applications, and processes to identify vulnerabilities and weaknesses. Furthermore, we prioritize ongoing employee education and awareness initiatives to cultivate a culture of security throughout our organization. Our workforce receives regular training on best practices, emerging threats, and incident response procedures to empower them to be active participants in our cybersecurity efforts. Additionally, we enforce strict access controls and data encryption protocols to safeguard sensitive information and mitigate the risk of unauthorized access or data breaches.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: While we have implemented extensive measures to fortify our defenses against cyber threats, it is important to acknowledge that the cybersecurity landscape is constantly evolving, with threat actors employing increasingly sophisticated tactics. Despite our best efforts, we cannot guarantee that our systems will be completely immune to cyber attacks. As such, we maintain a proactive stance in monitoring for emerging threats and vulnerabilities, leveraging threat intelligence sources and collaborating with industry partners to stay abreast of evolving risks.


text: In the event of a cybersecurity incident, we have established incident response protocols designed to facilitate swift and effective remediation efforts. These protocols outline clear escalation procedures, delineate responsibilities among key stakeholders, and emphasize transparency and communication with internal teams, regulatory authorities, and affected parties.


text: In summary, while we maintain confidence in the effectiveness of our cybersecurity measures, we acknowledge the dynamic nature of the cybersecurity landscape and remain vigilant in our efforts to adapt and respond to emerging threats. Our commitment to cybersecurity extends beyond mere compliance; it is a fundamental aspect of our corporate ethos and a cornerstone of our efforts to safeguard the interests of our shareholders, customers, and stakeholders.


text: We enlist the support of third-party providers to bolster our cybersecurity risk management. These providers offer ongoing assistance, such as threat monitoring, mitigation strategies, updates on emerging trends and developments, and policy guidance. Additionally, we engage specific providers for targeted assistance, such as security and forensic expertise, as the need arises. Before sharing any sensitive data or integrating with a third-party provider, we conduct a thorough assessment of their security capabilities in alignment with our risk posture and request modifications as deemed necessary.


text: Oversight for cybersecurity risk lies with the Audit Committee. Periodically the Audit Committee will work with our IT management to provide a full update to the board on continuous improvements made to our monitoring and preventative activities, as well as information on those monitoring activities itself such as attempts of unauthorized access to systems.


text: Our IT management team is directly responsible for cyber security and maintaining of protection, keeping abreast of latest cyber security issues and concerns, monitoring threats, and the design and updating of policies and procedures along with appropriate education for all company employees. Our IT staff and management team have been trained on current industry standards and best practices and hold degrees and have experience necessary to have the skills necessary to address such threats. IT management is also responsible for the appropriate communications regarding threats and breaches should they occur and appropriate shut down and recovery activities and have action plans in place.


text: As of December 31, 2023, we have not encountered any cybersecurity threats that have had a material impact on our operations, business strategy, financial results, or overall financial health.


text: We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. To this end, our processes are designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems (including such risks associated with the use of any third -party service providers) that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by third -party experts under supervision of management, and, where necessary or desired, include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. We may also consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: FITLIFE BRANDS, INC.

ticker: FTLF


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our processes and resources are also designed to help enable us to actively identify, protect, detect, respond to, and recover from risks and threats. Nevertheless, we face certain ongoing cybersecurity risk threats that, if realized, are reasonably likely to materially affect us. As of the date of this report, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition.


text: Third-party experts assist our senior management team in assessing and managing material risks from cybersecurity threats. All employees and consultants are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly discussions with our senior officers and independent registered accounting firm.


text: We recognize the critical importance of maintaining the trust and confidence of our patients, employees, and business partners toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our audit committee of the board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. We have taken into account recognized frameworks established by the National Institute of Standards and Technology, or NIST, when developing cybersecurity policies, standards, processes and practices among other considerations. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: PALVELLA THERAPEUTICS, INC.

ticker: PVLA


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including phishing training, regular network and endpoint monitoring, audits, vulnerability assessments, to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance; Management" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by the General Counsel and third-party information technology and security providers who act as our information technology team.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care and enter into confidentiality agreements, and enter into data processing agreements with third parties that are processing personal data we control;


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including physical security measures to prevent access to data processing systems, firewalls, intrusion prevention and detection systems, email security controls, anti-malware functionality and access controls, endpoint detection and response systems, all of which are evaluated and improved through internal and external vulnerability assessments and cybersecurity threat intelligence;


text: provide mandatory training and notifications for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to understand, identify and address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: conduct mandatory annual phishing training and regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; utilize pseudonymized data for patients and use other encryption methods to ensure security of personal data;


text: leverage procedures informed by appropriate incident handling frameworks to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: As part of the above processes, we engage with third parties, including annually having a qualified third-party review our incident response plan and our cybersecurity measures to help identify areas for continued focus, improvement and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and assess cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, for example, by engaging with known, reputable vendors, and requiring they have industry standard safeguards and notification procedures. We may also ask vendors associated with increased cybersecurity risk to complete a periodic questionnaire regarding their security practices for ongoing vendor management purposes.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Significant disruptions of information technology systems or security breaches could adversely affect our business" in Item 1A, Risk Factors, which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. We also have not been subject to any penalties or settlements.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials that include discussions of current and emerging general material cybersecurity threat risks, including our particular cyber risk situation, and describing our ability and strategy to mitigate those risks and may discuss such matters with our Information Technology team or General Counsel. Our audit committee also receives prompt and timely information regarding any cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our external Information Technology team, an Information Technology council composed of various management and senior level employees, and the General Counsel. Such individuals have collectively over 10 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: We employ a risk management framework to identify, assess, monitor, and test cyber risk and controls, and perform comprehensive due diligence and ongoing oversight of third-party relationships, including vendors. We have made and will continue to make ongoing investments in developing and enhancing our security processes and controls and in maintaining our technology infrastructure, including the maintenance of a business continuity and disaster recovery program, which is tested on a regular basis. We have also implemented processes to help identify, assess and manage cybersecurity risks associated with our use of a third-party service provider. We also provide regular education and training to our employees and contractors on cybersecurity and the protection of our information systems in order to mitigate risk associated with protection against threats to the confidentiality, availability, and integrity of our information systems. We do not believe that risks from cybersecurity threats of which we are currently aware, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See Item 1A – Risk Factors above for additional information on risks related to cyber-attacks.

companyName: RiceBran Technologies

ticker: RIBT


text: Together with the Board's standing committees, the Company's Board of Directors is responsible for ensuring that material risks, including material cybersecurity risks, are identified and managed appropriately. The Board and its committees regularly review material operational, financial, cybersecurity, compensation and compliance risks with management. For example, the Audit Committee oversees the Company's consultation with outside parties with an expertise in cybersecurity that we engage and retain to review and assess our information security program. The Board also receives regular updates concerning our information security and cyber risk strategy, cyber defense initiatives, cyber event preparedness, and cybersecurity risk assessments.


text: Cyber Security Governance Oversight of cybersecurity infrastructure is managed by members of our management team, including our President & Chief Executive Officer. Management works in tandem with a third-party service provider (the "Service Provider"). The Service Provider periodically reviews and updates our antivirus and antimalware software, manages our Business Continuity and Disaster Recovery system, reviews our vulnerability management and ensures our system is Payment Card Industry (PCI) compliant. Given our overall risk profile, the Board has had limited involvement with our cybersecurity risk management. The management team, with support from the Service Provider, would raise any significant cybersecurity risks with the Board.

companyName: Saker Aviation Services, Inc.

ticker: SKAS


text: We believe we have implemented processes that are designed to effectively identify and manage risks from cybersecurity threats. Through our Service Provider, we receive Endpoint Detection and Response services ("EDR"). The EDR helps to ensure faster identification of a cybersecurity breach. Once a cyber incident is identified, our Service Provider will notify management and work to secure our systems and fix the vulnerability. An investigation will be conducted, with the assistance of the Service Provider if needed, to determine the root cause of the cyber incident, the materiality of the cyber incident, and any disclosure or legal obligations that will stem from the cyber incident.


text: We have not been the victim of a cyber incident in the past but may be the subject of cyber incidents in the future.


text: The Company recognizes the importance of securing its information, devices, and data and the IT systems it relies on to conduct its business. The Company has established its Network, Information, and Data Security Policy Guidelines (the "NIDSP Guidelines") designed to protect the integrity and confidentiality of data and information belonging to or being exchanged by the Company and its employees, partners, customers, service providers, and suppliers and to safeguard that information and the Company's IT infrastructure from unauthorized access, use, disclosure, alteration, and destruction.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: The protections, procedures, and controls set forth in the NIDSP Guidelines demonstrate the Company's attention to and prioritization of cybersecurity as a component of its overall strategy and system for managing risks. The NIDSP Guidelines include five policies described below, that together define the Company's strategy and practices for managing cybersecurity threats and mitigating cybersecurity risks.


text: Physical Security Policy (the "PSP"). The PSP establishes guidelines related to selecting IT operation sites, designating security zones, using, inspecting, and storing IT Assets, designing restricted-access and security controls, and monitoring compliance with safety and security standards. The goal of the PSP is to minimize risks of damage, destruction, unauthorized access, inadvertent disclosure, misuse, loss, or theft of the Company's IT Assets. In accordance with the PSP, the Company: (i) evaluates IT operation sites based on their susceptibility to natural disasters, crime and theft, and unauthorized access; (ii) requires the use of keycards or biometrics in order to enforce security zones and give users the least amount of access required to do their jobs; (iii) requires systems and devices that store confidential data to be maintained and protected in accordance with the Company's Confidential Data Policy; and (iv) requires visitors at the Company's office to complete a sign-in log, wear a visitor badge, and be escorted by a designated employee at all times.


text: Network Security Policy (the "NSP"). The NSP aims to protect the integrity of the Company's data by securing the systems and devices that make up the Company's network infrastructure. Pursuant to the NSP, the Company: (i) enforces strict password-construction criteria for network devices; (ii) requires employees to verify their identities using multi-factor authentication to access internal resources; (iii) maintains and reviews logs from application services, network devices, and critical devices and requires the retention of logs in accordance with the Company's Retention Policy; (iv) implements and configures firewall technology to filter both inbound and outbound network connections; (v) authorizes the IT Manager to determine the extent and scope of external security testing to be performed; (vi) establishes a software-use policy; and (vii) requires antivirus and anti-malware software to be used and timely patched and updated on any Company-provided devices.


text: Backup Policy. The Company's Backup Policy applies to all data stored on Company systems. The Backup Policy specifies the types of data and information considered to be critical to the Company's operations and thus required to be backed up, establishes a backup schedule that is necessary for successful data recovery, and implements procedures for the off-site rotation, storage, and retention of backups. The Backup Policy also establishes the Company's data-restoration procedures and mandates the periodic testing of those procedures.


text: Remote Access Policy (the "RAP"). The RAP defines the Company's standards for accessing IT resources from outside the Company's network, such as when an employee is working remotely. Pursuant to the RAP, remote access is only permitted if accomplished through secure, Company-provided means. The Company's uses remote-access software designed to guard against unauthorized access using traffic encryption during transmission and firewall protections.


text: Confidential Data Policy (the "CDP"). The CDP governs the handling, storage, transmission, destruction, and protection of confidential data. Pursuant to the CDP, confidential data must be securely stored, removed from common areas, properly marked as confidential data, protected with strong encryption if being transmitted, and destroyed by means that make recovery impossible. Employees who are given access to confidential data are required to immediately notify their supervisor if they suspect any misuse or unauthorized disclosure of confidential information.


text: The Company's NIDSP Guidelines and policies apply not only to the Company's employees and consultants but also to any third parties that access or utilize the Company's information and systems. Such third parties may include the Company's service providers, customers, suppliers, contractors, consultants, and any other individuals the Company conducts business with. The IT infrastructure that the Company has developed in accordance with the NIDSP Guidelines is designed to monitor both internal and external cybersecurity risks. The NIDSP Guidelines equip the Company with the tools and systems necessary to recognize, address, and protect against risks associated with its third-party interactions.


text: The Company's IT Manager and executive team is responsible for the day-to-day management of cybersecurity risks, while the Company's Board of Directors has responsibility for oversight of risk management.


text: As part of the Company's framework for cybersecurity risk oversight and governance, the Company's network, information, and data-security policies set forth in the NIDSP Guidelines are enforced by the Company's IT Manager and/or its executive team. The IT Manager is an employee designated by the Company to manage the Company's security policies and program. The IT Manager is tasked with ensuring that the Company maintains compliance with the Company's security policies and any applicable security regulations. The IT Manager is responsible for: (i) implementing the Company's security policies; (ii) disseminating the Company's security policies to all employees; (iii) establishing a training program for all employees and users covered by the Company's IT security policy to notify them of the Company's security policies, train and re-train them to comply with the Company's IT security program, and educate them on the importance of data security; (iv) performing any ongoing testing or analysis of the Company's security infrastructure, policies, and procedures; and (v) updating the NSP and any other policies and guidelines as needed to comply with applicable regulations and to stay up to date with the changing IT security landscape.


text: The IT Manager works closely with the Company's management and executive team to determine the Company's IT-related needs, to evaluate the sufficiency of the Company's data-governance policies and practices, to keep the Company's management informed of notable cybersecurity-related updates, to review its security-related policies, and to identify ways to strengthen the systems and procedures implemented by the Company to detect, assess, and manage data risks.


text: In the event of the detection of an actual or suspected cybersecurity incident, the Company's IT Team, lead by the IT Manager, assesses the incident as "minimal", "low", "moderate" or "high". Incidents assessed at a minimal or low risk are reported to Company's management and the Executive Chairman of the Board and the Executive Chairman of the Board may share this information with the Board. Incidents assessed at a moderate or high risk are reported to Company's management, the Executive Chairman of the Board, and the Company's Board of Directors.


text: Notwithstanding the Company's cybersecurity-related policies, procedures, and governance framework, the ever-present threat of a cyber-attack, data breach, or other security incident is pervasive. The increasingly sophisticated nature of the tactics used to circumvent IT security safeguards makes cybersecurity threats increasingly difficult to detect and respond to. While the Company does not believe its business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity threats or incidents, there is no assurance that the Company will not be materially affected by such threats or incidents in the future. Accordingly, the Company will continue to monitor cybersecurity risks and strive to invest in and strengthen its cybersecurity infrastructure.


text: Risk management is an essential component of our culture and business model. Guarding against the specific risks posed by cybersecurity threats has been and will continue to be very dynamic in nature, requiring that we remain agile and aware of internal and external changes. We recognize that cybersecurity threats can be among the most critical risks facing large companies. As a result, cybersecurity is treated as a Board-level matter and overseen by the Board. However, both the Board and management have an integral role in the identification, assessment and management of cybersecurity risk.

companyName: US Alliance Corp


text: Management engages third parties with relevant expertise in assessing and managing cybersecurity threats. As a general matter, we take a proactive approach to assessing and monitoring cybersecurity-specific risks that is oriented around monitoring emerging external threats, ensuring controls are in place to identify and manage risk within our technology environment and creating a culture of vigilance across the organization. Annually we hire a third party to test for and resolve weaknesses and vulnerabilities within our systems and applications by using network and infrastructure vulnerability testing.


text: Our awareness and training program creates a risk-aware culture to ensure employees understand cybersecurity threats and are accountable for completing required training. We have an enterprise incident management plan that provides a framework for preparing for, managing and responding to cybersecurity incidents that may arise.


text: No risks from any known cybersecurity incidents have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further discussion related to how cybersecurity risks may impact our performance in the future, see Item 1A. "Risk Factors."


text: Our business heavily relies on various IT and application systems, which contain proprietary and confidential information about our operations, employees, customers, and our customers' customers, including personally identifiable information. These systems are connected to and/or accessed from the Internet and, as a result, are susceptible to cyber-attacks. We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. Our process is supported by both management and our Board of Directors. Organizationally, our businesses are structured as three operating and reportable segments: Ting, Wavelo and Tucows Domains. These segments are decentralized; management and cybersecurity resources are organized both at the parent company level and within each decentralized segment. Each segment has dedicated liaisons for cybersecurity, compliance, and risk management activities.

companyName: TUCOWS INC /PA/

ticker: TCX


text: We maintain and continue to expand our investment in the development of our information security management system ("ISMS"). Our ISMS leverages a risk-based approach and is informed by industry standard guidance, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization for Standardization ("ISO") 27001 Information Security Management System Requirements. A material cyber-attack on Company systems, distribution partners and their key operating systems, or any other third-party partners or vendors and their key operating systems may interrupt the ability to operate the Company's business, damage the Company's reputation, or result in monetary damages. The development of the ISMS is focused on the protections of the confidentiality, integrity, and availability of the Company's information system infrastructure as well as the data in the Company's care, custody and control. The Company engages third parties to evaluate certain aspects of the ISMS, provide threat intelligence, and perform vulnerability assessments and other services as needed.


text: The Company follows an established process to identify and evaluate risks from cyber security threats that may arise internally or through the introduction of third parties to the ISMS. This evaluation is part of the Company's risk management process. The process may include, but is not limited to, evaluating the third party's cybersecurity maturity and/or imposing certain contractual conditions.


text: Operationally, the Company maintains Security and Network Operations Centers, which provide 24/7 coverage and support of on-call cybersecurity and network professionals to triage and respond to immediate cybersecurity threats and outages. The Company also assesses cybersecurity risks on a quarterly basis and ranks them according to their risk profile. These risks are communicated to management and to the Board of Directors as part of the normal course of operations.


text: Cybersecurity incidents are responded to in accordance with the Company's established Cybersecurity Incident Response Plan ("IRP"). In the event of an incident, we follow our IRP, which includes evaluation of the severity of the incident based on factors such as the number of assets affected, the extent of the incident, the likelihood of inappropriate data exposure, operational impact and/or reliability impact. Dependent upon the severity of an incident, the incident is escalated to the senior leadership, including the CEO and CISO. Senior leadership then determines whether, based on various factors, the incident requires immediate escalation to the Board of Directors and to third-party incident response organizations and notification to functional areas, such as legal and finance, as well as senior leadership and the Board, and external entities, as appropriate and required. We maintain relationships with third-party Digital Forensics and Incident Response ("DFIR") service providers to strengthen our incident response capabilities in the event that we determine the need to augment our effort during an incident and to provide us additional assurance that our responses to complex incidents or highly sophisticated threat actors have been effective and complete.


text: Although the risks from cyber threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future and we continue to closely monitor cyber risk. For a detailed description of the risks related to cybersecurity, see Item 1A. "Risk Factors." of this Form 10-K, which should be read in conjunction with this Item 1C.


text: Board Governance and Management The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our corporate information security function, led by our Chief Information Security Officer ("CISO"), is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The current CISO has an extensive information technology and cybersecurity background gained through years of industry experience and leadership. The corporate information security function is responsible for managing and continually enhancing our information security posture and information security infrastructure with the ultimate goal of preventing cybersecurity incidents and reducing their severity to the extent feasible, while simultaneously increasing our resilience in an effort to minimize the business impact should an incident occur.


text: Senior leadership, including our CEO, who also has relevant experience in cybersecurity matters, and our CISO, regularly brief the Board of Directors on our cybersecurity and information security initiatives, and the Board of Directors is apprised of cybersecurity incidents deemed to have a material business impact.


text: Disclosure of Risk Management, Strategy, and Governance Regarding Cybersecurity Risks Our Board of Directors engages in regular discussions to address our Company's principal risks, including those related to cybersecurity, ensuring comprehensive management and oversight. In alignment with this commitment, our cybersecurity leadership, comprising the Chief Operating Officer, Senior Systems Architect, DevOps Engineer, and Senior Technical Project Manager, forms a core committee dedicated to the review and strategic planning of our cybersecurity initiatives. This team's collaborative efforts are instrumental in steering our Company's approach to identifying, evaluating, and mitigating cybersecurity risks.

companyName: PAID INC

ticker: PAYD


text: The designated committee oversees our cybersecurity risk assessment and mitigation strategies through various means, including but not limited to: Conducting internal evaluations and leveraging technological tools to fortify our cybersecurity posture. Implementing rigorous cybersecurity training for all employees to heighten awareness and preparedness against cyber threats. Ensuring the robustness of our cyber defenses with comprehensive antivirus solutions and adherence to cybersecurity best practices.


text: Our reliance on third-party service providers, such as Google Cloud for server hosting and Stripe for payment processing, incorporates a level of inherited security measures. Nonetheless, our commitment extends to continuously assessing and enhancing our cybersecurity frameworks to align with evolving industry standards and best practices.


text: Our Board is advised of key cybersecurity matters through high-level briefings, ensuring strategic alignment and informed oversight of our cybersecurity endeavors. The Company's officers, along with the executive team, play a pivotal role in the dynamic landscape of cybersecurity risk management. This committee is not only responsible for the ongoing assessment and management of cybersecurity risks but also ensures that strategic cybersecurity initiatives are integrated within the broader operational framework of our Company.


text: Incident Response and Readiness Although our Company has not experienced cybersecurity incidents, we maintain a proactive stance through the implementation of an Incident Response Plan. This plan encompasses detailed procedures for addressing potential cybersecurity incidents, including scenario-based drills to test our preparedness. The escalation processes within the plan ensure swift communication to the executive leadership and, if necessary, to the Board of Directors, facilitating an agile and informed response to emerging cybersecurity threats.


text: Engagement with Third Parties Our engagement with third-party service providers incorporates a thorough consideration of cybersecurity risks. Through our diligent evaluation process, we ensure that our partners adhere to stringent cybersecurity standards, safeguarding our data and systems against potential threats. This collaborative approach towards cybersecurity underscores our commitment to maintaining a secure operational environment for our stakeholders.


text: Cybersecurity and risks associated with information security are operational risks included in the Company's Enterprise Risk Management ("ERM") Framework. Under the ERM Framework, the Company's Information Technology department and all employees are the first line of defense ("First Line"). Those in the First Line are each responsible for identifying and managing the information security risk associated with their activities. The Company's IT Steering Committee is part of the independent risk oversight of information security risk along with the Company's Compliance and ERM Committees, both of which are management risk oversight committees.

companyName: Oak Valley Bancorp

ticker: OVLY


text: The BOD and IT Steering committee are primarily responsible for monitoring management's implementation of operations and technology risk controls, including those relating to cyber security and information security. The Company maintains a data protection and information security program designed to ensure adequate governance and oversight is in place while evolving to meet changes in applicable laws and regulations, and best practices. The Company's information security controls and programs are designed to align with the National Institute of Standards and Technology ("NIST") standards for cybersecurity and the Federal Financial Institutions Examination Council ("FFIEC") examination guidelines, along with applicable privacy laws.


text: Information Security is the responsibility of the officers, employees, and agents of the Company with oversight by the Board of Directors ("BOD"). Our investment in people is critical to maintaining an effective cyber defense, which begins by developing and maintaining a robust Information Security function within the First Line. The Company's Chief Information Officer ("CIO") has over 25 years of network architecture, information technology and cybersecurity experience. Collectively, the Company's senior leadership in this area have nearly 80 years of experience. Each Company employee is responsible for an effective cybersecurity defense which is enforced with mandatory interactive cyber awareness training, periodic newsletters, executive security briefs and updates. Additionally, the BOD is informed about cybersecurity and the relevant risks posed to the Company via regular updates from the Company's CIO. The BOD is regularly informed and actively oversees the data security and privacy program and its policies. The BOD also receives regular education on innovative technology, cybersecurity, information systems/data management, fintech and privacy.


text: The Company engages external third parties to perform assessments on our adherence to the FFIEC's recommendations on cyber preparedness and NIST Cybersecurity Framework, as well as to review for best practices for the use of cloud services and FedLine requirements. To validate the effectiveness of the Company's overall information security controls, external third parties also perform full-scope external and internal penetration testing designed to mimic the tactics used by individual hackers or criminal hacking organizations. The Company also engages external third parties to perform ongoing adversarial simulation.


text: The Company conducts regular internal cybersecurity assessments intended to measure inherent risk and drive the adjustment of our security posture according to the latest threats. These assessments include alignment with the FFIEC's recommendations on cyber preparedness and GLBA Safeguards Rule to protect user data. The Company performs continuous internal and external vulnerability scanning to measure and react to new vulnerabilities and seeks conformance to industry best practices for both cloud-based and on-premises technology. The Company reviews vendor and partner security practices to ensure they maintain proper information security safeguards.


text: Cybersecurity operational measures Led by our CIO, the Company's data protection, information, cyber and technology services team collaborates with subject-matter experts throughout the business to identify, monitor and mitigate material risks, as well as to monitor compliance with the Company's security polices, applicable laws and regulations. The Company's security monitoring team manages the security of our systems through the ingestion of multiple external threat feeds and systems logs. Through the collection and integration of security-related IT infrastructure information, external threat intelligence and the expertise of trained security analysts, the Company works to identify and address potential indicators of compromise. Potential security events are identified and addressed through defined IT incident response activities and with support of the Company's Incident Response Plan. The Incident Response Plan is in place and updated regularly with the intent to reduce impacts to clients and the Company caused by a declared cyber incident, such as an event involving malicious code, unauthorized disclosure, loss of information or unauthorized use of information or systems. The Incident Response Plan organizes resources to manage and resolve events that harm or threaten the security of information assets. The Incident Response Plan includes involvement of the Company's Executive Leadership Team and BOD based on the severity of a cyber event, including the analysis of reporting requirements. The Incident Response Plan is tested annually and includes technical and executive management in simulated crisis management cybersecurity tabletop exercises.


text: As of the date of this report, other than the risks discussed in "Risk Factors," the Company knows of no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: SPAR Group Inc. recognizes the increased global cybersecurity threats and sophisticated, targeted computer crime and the risk it poses to our operations. We rely on information technology and data to operate our business and develop, market and deliver our products and services to our customers.

companyName: SPAR Group, Inc.

ticker: SGRP


text: Our cybersecurity risk management program is led by our Chief Information Officer ("CIO"), who is directly responsible for establishing cybersecurity strategies and structures and managing ongoing cybersecurity risk management activities. Our CIO is part of the executive management team, and updates our CEO and executive management on a monthly, or even more frequent, basis on cybersecurity enhancement and the development and implementation of our roadmap.


text: We have strategically embedded cybersecurity risk management within an enterprise-wide framework, ensuring that it permeates across various facets of our operations. This integrated approach encompasses administrative protocols, operational strategies, organizational structures, physical safeguards, and technical measures, all tailored to align with the scope and nature of our business.


text: We believe this integrated approach allows cybersecurity considerations to be an integral part of our decision-making processes. Our day-to-day cybersecurity work is led by our CIO and Head of Infrastructure. Both are highly experienced professionals. This group works closely with our executive management to continuously evaluate and address cybersecurity risks in alignment with our business and operational needs.


text: Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third-party assessments, internal audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things:


text: Proactively review threat intelligence and other information obtained from governmental, public or private sources Perform network vulnerability scans, cyber-hygiene assessments, and continually evaluate and address perceived gaps. Conduct companywide cyber awareness training and on-going new employee cyber training. Deploy a wide array of industry leading 3rd party solutions to continuously monitor network and endpoints. On-going testing and evaluation of backup processes. Perform disaster recovery tabletop exercises to assess readiness for possible events.


text: As noted, to operate our business, we utilize certain third-party service providers to perform a variety of functions and provide certain security-related services, such as outsourced business critical functions, professional services, SaaS platforms, managed services, cloud-based infrastructure, data center facilities, content delivery to customers, encryption and authentication technology, corporate productivity services, and other functions; as well as third parties that assist us to identify, assess and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity software providers, penetration testing firms and other vendors that help to identify, assess or manage cybersecurity risks. Response, eradication and recovery, Post-incident analysis and future preparations.


text: The plan also provides the process and workflow of communication for escalation of incidents to executive leadership to determine incident classification, impact severity, and if and what further actions are warranted. Incident responses are overseen by leaders from our Software, Infrastructure Engineering, and Executive team.


text: Cybersecurity holds a significant role within our risk management procedures and remains a focal point for our Board and management. Under the Board's oversight of general risk identification and management activities, the Audit Committee specifically monitors cybersecurity risks. Committee members engage in comprehensive discussions with management regarding these risks, as well as the measures taken to safeguard the company's information systems and security, along with reviewing management's steps towards data privacy protection. Additionally, the Audit Committee receives annual cybersecurity updates from senior management, covering both existing and emerging risks, management's responses and mitigation efforts, any cybersecurity or data privacy incidents, and the status of key information security initiatives. Furthermore, our Board members regularly hold informal discussions with management about cybersecurity news events and any updates to our cybersecurity risk management and strategy programs.


text: The leadership of our cybersecurity risk management and strategy is guided by experts from our Software, Infrastructure Engineering, and Executive teams. With backgrounds spanning: information technology, security, systems, programming, and corporate strategy, these individuals are equipped to oversee prevention, detection, mitigation, and remediation of cybersecurity incidents. They actively engage in managing our cybersecurity risk processes, including executing our incident response plan, and regularly report relevant matters to the executive management and the Audit Committee.


text: We carry insurance that provides protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover, or be sufficient to cover, all losses or claims that may result from a cybersecurity incident.


text: During the last fiscal year, 2023, the Company did not encounter any material cybersecurity incidents, nor did it incur any notable expenses as a result.


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's chief executive officer and board of directors. The Company engages information technology "managed service providers" (MSPs) to manage the Company's computer and information systems at its three office locations and remote locations. The MSPs are responsible for evaluating and testing the Company's risk management systems and assessing and remediating potential cybersecurity incidents as appropriate.

companyName: BIOLARGO, INC.

ticker: BLGO


text: The executives in charge of each physical office location are responsible for assessing and managing cybersecurity risks for their locations, and the Company's chief executive officer is responsible for assessing and managing cybersecurity risks to the Company as a whole. Because none of these individuals has specific training or experience in managing cybersecurity risks, MSPs that have expertise and experience in doing so are retained and relied upon. Our chief executive officer is responsible for escalating any cybersecurity matters as appropriate, in consultation with our legal counsel. Our board of directors is ultimately responsible for oversight of cybersecurity risk management and receives regular reports from Company management.


text: Omeros maintains a cybersecurity risk management program that is designed to assess, identify, manage and respond to risks from cybersecurity threats in a robust manner. This program shares certain common methodologies, reporting channels and governance processes applicable to our management of other risk areas, such as legal, compliance, strategic, operational and financial risk.

companyName: OMEROS CORP

ticker: OMER


text: We utilize a range of internal and external resources to assess and identify cybersecurity threats and vulnerabilities. We access and utilize information drawn from a range of publications, reports and services to assess our cybersecurity risk profile, develop awareness of emerging cybersecurity threats and threat actors and identify risk factors that are particularly relevant to the biotechnology and pharmaceutical sector and to our company. We also work with third parties that assist us to identify, assess and manage cybersecurity risks, including external auditors, consulting firms, managed security service providers and penetration testing firms.


text: We have implemented and maintain various technical, physical and organizational measures, processes, standards and/or policies designed to manage and mitigate material risks from cybersecurity threats. These include data encryption, network security controls, access controls, physical security, asset management, system hardening, vulnerability management and patching and continuous monitoring of information technology systems and network telemetry data using a variety of manual and automated tools and systems designed to detect and respond to suspicious or unusual activity. We maintain systems and plans for business continuity and disaster recovery and have implemented tools and procedures for cybersecurity incident detection and response. We also operate a cybersecurity training program for employees that includes required webinars and deployment of simulated phishing and similar attacks in which threat actors utilize social engineering to gain access to company systems.


text: We take a risk-weighted approach to mitigation of cybersecurity risks associated with use of third-party service providers. Based on an assessment of the cybersecurity risks presented by a given third-party service provider, we seek to minimize third-party cybersecurity risk on a case-by-case basis, generally through a combination of due diligence in the selection of qualified vendors and the imposition of contractual terms requiring the vendor to maintain specified cybersecurity safeguards and/or to accept financial responsibility for security breaches occurring within the vendor's area of responsibility.


text: We are not aware of any specific risks from specific cybersecurity threats, and have not experienced any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition. While we continue to invest in the security and resiliency of our information technology systems and to enhance our cybersecurity controls and processes, we cannot provide assurance that a future cybersecurity incident will not occur or that it would not materially affect our company. Please see Item 1A of Part I of this Annual Report under the heading "Risk Factors" for additional discussion about risks related to cybersecurity.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Pursuant to its charter, the audit committee of our board of directors is responsible for the oversight of management's efforts to address cybersecurity risk. Management reports to the audit committee on cybersecurity risk matters periodically, typically twice annually. These reports normally address matters such as: the evolving cybersecurity risk environment and the emergence of new threats; outcomes and learnings from penetration testing, security audits or vulnerability assessments; evaluation of existing controls, tools and procedures and progress on implementation of any new initiatives to manage and mitigate cybersecurity risk. In addition, members of our board of directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management program is managed by our Director of Information Technology (the "IT Director"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The IT Director has been with the organization since 2007, has a post-graduate degree in Information Security, and is a member of InfraGard, a partnership between the Federal Bureau of Investigation and members of the private sector for the protection of U.S. critical infrastructure. The IT Director is informed about and monitors prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with dedicated internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our information technology environment. The IT Director provides periodic reports on cybersecurity risk to the audit committee of our board of directors, as well as our chief executive officer and other members of our senior management as appropriate.


text: The Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. At the management level, our Chief Executive Officer and Interim Chief Financial Officer are responsible for addressing cybersecurity incidents, while our full board of directors has oversight responsibility for the Company's overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. In the event a cybersecurity incident occurs, the Company's Chief Executive Officer and the Interim Financial Officer are expected to inform our board of directors of the details of such incident as well as the measures taken in response to such incident. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: JONES SODA CO.

ticker: JSDA


text: Cybersecurity Risk Management We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

companyName: Genprex, Inc.

ticker: GNPX


text: In the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program, which is comprised of a wide array of policies, standards, architecture, and processes. The cyber risk management program falls under the responsibility of our Director of IT & GxP Quality Systems, who has more than 15 years of experience, including cross-functional expertise in IT compliance and GXP systems. Under the guidance of our Director of IT & GxP Quality Systems, reporting up to our Chief Financial Officer, we develop, maintain, and evidence the policies, standards, and processes in a manner consistent with applicable legal requirements. We also utilize a variety of cybersecurity software from reputable vendors in cybersecurity.


text: We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems and ensure the effectiveness of our security controls. Our cybersecurity risk management program is Systems and Organization Controls (SOC)-certified and incorporates a number of components, including information security program assessments, continuous monitoring of critical risks from cybersecurity threats using automated tools, internal audits, and employee training. We deploy a wide range of security tools across the environment, require multifactor authentication, hold client data on a separate virtual private cloud (VPC), and implement access control policies that further limit access to data within the systems.


text: We periodically conduct internal audits and are consistently evaluating our cyber readiness. As a result, we have not identified any material cybersecurity risks and are continuously hardening our environment, systems and infrastructure to reduce our vulnerability to attack. Additionally, our program includes regular cybersecurity training for all employees.


text: For further information regarding cybersecurity risks, please refer to "Risk Factors – Risks Related to Development and Commercialization of Our Current and Future Product Candidates" and other risks described in the "Risk Factors" section of this Annual Report on Form 10-K.


text: Our board of directors is responsible for the oversight of cybersecurity risk management. The board of directors delegates oversight of the cybersecurity risk management program to the audit committee of the board of directors (the "Audit Committee"). Our Chief Financial Officer reports to the Audit Committee. The Audit Committee updates the board of directors on our cybersecurity risk management program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards on an annual and as-needed basis.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: ZEVRA THERAPEUTICS, INC.

ticker: ZVRA


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Our management team, including R. LaDuane Clifto n, Chief Financial Officer, Secretary and Treasurer, i s responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our r etained external cybersecurity consultants. Our management team includes IT staff with more than 40 years of combined experience in various roles involving managing information security, managing privacy and data protection, evaluating cybersecurity risks, developing cybersecurity strategy, and implementing cybersecurity programs.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: We depend on information technology and systems for various operations (including refinery processes and refined product loading) and for capturing accounting, technical and regulatory data for reporting, analysis, and archiving. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. As of the filing date of this report, our risk assessment process related to cybersecurity includes conducting vulnerability assessments using a combination of internal and third-party capabilities to perform technical assessments, vulnerability scanning, and incident and event monitoring. We are working to establish a thorough, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners, and we anticipate that such a program will follow well-organized cybersecurity frameworks under a central control figure.

companyName: BLUE DOLPHIN ENERGY CO

ticker: BDCO


text: We did not experience a significant cybersecurity breach or associated expenses, penalties, or settlements for the twelve months ended December 31, 2023 and 2022.


text: We have made cybersecurity and the protection of our customer's data a top priority. The critical areas that we consider for our evolving cybersecurity program include access control; data encryption; SSDLC/change management; BCP/DRP; endpoint security; patch management; vulnerability assessments; compliance management; data privacy; incident response; monitoring, alerting, and lodging; employee training; and cyber insurance.

companyName: Fluent, Inc.

ticker: FLNT


text: Risk Management & Strategy Our cyber risk management program is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. To help protect our company from a major cybersecurity incident that could have a material impact on operations or our financial results, we have implemented policies, procedures, programs and controls, including investments in technology that focus on cybersecurity incident prevention, identification and mitigation. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST"). We execute an NIST 800 - 53 review annually and use the results of existing cyber risks to prioritize projects designed to address these gaps and create a go-forward strategy. Our internal and external auditors review our IT and cybersecurity controls annually for design and operating effectiveness.


text: Our Cybersecurity Program is governed by the Company's IT and Legal and Compliance teams. Our Chief Technology Officer ("CTO") has over 20 years of experience in marketing technology and analytics. Our Vice President of IT Governance, Risk and Compliance ("VP of IT") has over 20 years of experience in IT internal and external audits, IT consulting, and governance, risk, and compliance. Our General Counsels regularly coordinates with the IT team on data security and compliance issues. The CTO and General Counsels report directly to the Chief Executive Officer ("CEO"), so any material issues are raised to CEO, and a status of key cybersecurity projects and any material breaches is provided quarterly to the Board's Audit Committee, which includes both an internal and external audit.


text: Incident Disclosure and Materiality Our incident management procedures include identification, evaluation, definition, and escalation based on the determination of materiality. This determination involves the Company's IT and Legal and Compliance teams, executive officers, and cyber insurance provider. Breach notifications and escalation to the Audit Committee would also be based on the materiality determination. Each quarter, the VP of IT provides an update on key cybersecurity projects and any material breaches at the quarterly Audit Committee meeting, at which both the internal and external auditors are present.


text: While we did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition. See Item 1A. "Risk Factors" for more information on our cybersecurity-related risks.


text: Risk oversight and management is a key role for the Board and its committees. The Board is responsible for identifying and understanding the Company's principal risks and ensuring that appropriate systems are implemented to monitor, manage and mitigate those risks. The committees of the Board have oversight over risks within their respective mandates.

companyName: Progressive Care Inc.


text: Oversight of cybersecurity is integrated into the responsibilities of the Board. The Nominating and Governance Committee (the "NGC") has been assigned oversight of cybersecurity matters, particularly as they relate to financial risk and controls, integrity of financial data and public disclosures, and security of overall digital data.


text: Management is responsible for the implementation of risk management strategies and for the operational oversight of company-wide cybersecurity strategy, policy, and standards to assess and prepare us to address cybersecurity risks. We have evolving processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from cyber threats, protect employee and corporate information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, and routine review of our policies and procedures to identify risks and refine our practices. We engage independent third parties to assess and implement our cybersecurity procedures and enhance our oversight.


text: The NGC receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We are not aware of any cybersecurity incidents that could have a material impact on our business strategy, results of operations, or financial condition.


text: NextPlat uses, stores, and processes data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems, and our business operations.

companyName: NextPlat Corp

ticker: NXPL


text: Cyber Risk Management and Strategy Our cybersecurity risk management processes are being integrated into our overall risk management processes. We are making efforts to incorporate cybersecurity considerations as a part of our business processes. We engage with external cybersecurity experts, including assessors, consultants, and auditors, to enhance our cybersecurity measures and ensure compliance with industry best practices. We have established processes to oversee and manage cybersecurity risks associated with our use of third-party service providers, ensuring they adhere to our security standards. We review third-party service provider contracts to ensure they contain data privacy and security provisions, aligning with our standards and regulatory requirements. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks.


text: Oversight and Governance The Board of Directors has oversight of the Company's cybersecurity program. Our management team, in consultation with the Board of Directors, is responsible for monitoring, preventing, detecting, mitigating and remediating cybersecurity incidents.


text: Our Board of Directors (the "Board") is responsible for overseeing our risk management program, and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. In general, the Adviser seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Adviser's information systems or the information that the Adviser collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Firsthand Technology Value Fund, Inc.

ticker: SVVC


text: The Adviser has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Adviser's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner.


text: Technical Safeguards: The Adviser implements technical safeguards that are designed to protect the Adviser's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary.


text: The Adviser has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Adviser's response to a cybersecurity incident. The Adviser conducts occasional tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.


text: The Adviser maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors and service providers Education and Awareness: The Adviser provides periodic training for all levels of personnel regarding cybersecurity threats as a means to equip the Adviser's personnel with effective tools to address cybersecurity threats, and to communicate the Adviser's evolving information security policies, standards, processes, and practices.


text: The Adviser conducts periodic assessment and testing of its policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events The results of such assessments and reviews are evaluated by management and reported to the Board, and the Adviser adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.


text: The Board, in coordination with the Adviser, oversees the Company's risk management program, including the management of cybersecurity threats. The Board receives regular updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company. The Board also receives prompt and timely information regarding any material cybersecurity risk, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: We recognize the importance of cybersecurity risk management and have a defined strategy to support our business operations, platforms and information systems. We have implemented a comprehensive cybersecurity program to protect information systems and data. We have based our cybersecurity program on defined industry accepted frameworks with the goal of building enterprise resilience against an evolving cybersecurity threat landscape and to respond to cybersecurity threats as they materialize. Our program includes identification, assessment, monitoring, and management components, as well as informational and escalation components designed to inform management and the Board of prospective risks and developments.

companyName: Super League Enterprise, Inc.

ticker: SLE


text: Our cybersecurity program encompasses functions dedicated to both proactive and reactive management of cybersecurity threats. We implement our cybersecurity program internally through maintaining cybersecurity policies; deploying updated security technologies; and using third-party services and consultants to support and improve our cybersecurity program. Our proactive management of cybersecurity risks entails many actions, including actively monitoring our information technology systems; engaging service providers to monitor and, as appropriate, respond to cybersecurity threats; developing and updating incident response plans to address potential cybersecurity threats; and training our personnel on cybersecurity. We engage third-party auditors and consultants and leverage our internal information security, audit, and compliance functions to assess various facets of our cybersecurity program. We also maintain enterprise-wide processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.


text: We assess cybersecurity contingencies within our overall business continuity risk management planning process. Our information technology and information security teams utilize various technology tools to prevent, monitor, detect, and respond to cybersecurity threats. Our incident response policy outlines processes, roles, responsibilities, notifications, and other communications applicable to the assessment, mitigation, and remediation of realized cybersecurity events. The nature and scope of assessed risk of a realized cybersecurity event dictates the pace and extent of relevant processes, and communications, including an evaluation of any necessary or required disclosure. Depending on its nature and scope, a cybersecurity threat may be managed within our IT Department, responsible for day-to-day management of cybersecurity risks, and escalated to our executive management team, the Board, and the Audit Committee, as appropriate.


text: We have not historically been materially impacted by risks from cybersecurity threats and, as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, the breadth and scope of cybersecurity threats have grown over time and our systems and networks may be the target of increasingly sophisticated cyberattacks. For more information on our cybersecurity risks and their potential impact to our business, see Item 1A, " Risk Factors-Risks related to Our Business and Industry - We may experience security breaches and cyber threats " and Item 1A, " Risk Factors-Risks related to Our Business and Industry - Our business could be adversely affected if our data privacy and security practices are not adequate, or perceived as being inadequate, to prevent data breaches, or by the application of data privacy and security laws generally."


text: Our board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the " Committee ") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: Our IT Department updates management on cybersecurity matters, including risk assessments, security controls, incident response procedures, employee training and Third-Party Risk Management.


text: The Committee oversees the Company's cybersecurity risk management and strategy, while management is responsible for implementing the Company's cybersecurity program. This approach ensures that cybersecurity risks are appropriately prioritized and managed throughout the organization.


text: Our Chief Platform Officer has 25 years of experience in information technology, including cybersecurity, and is supplemented by our VP of Devops, who also has over 15 years of experience in audit, compliance, and cybersecurity, and maintains IT and Ops professional certifications. In addition to the IT Department, the VP of Devops may call upon other business and legal stakeholders across our company to help manage cybersecurity threats and incidents. Our Audit Committee is responsible for oversight of our programs, policies, procedures, and risk management activities related to information security and data protection. The Audit Committee meets periodically with the Chief Platform Officer to discuss threats, risks, and ongoing efforts to enhance cyber resiliency, as well as changes to the broader cybersecurity landscape. Our Board also periodically participates in presentations on cybersecurity and information technology from internal leadership. In addition to periodic presentations, management promptly updates our Board and Audit Committee regarding significant threats and incidents as they arise.


text: We have implemented an enterprise-wide information security program designed to identify, protect, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our program utilizes various security tools to safeguard our information systems, aiding in prevention, identification, escalation, investigation, resolution, and recovery from vulnerabilities and security incidents. Examples of such security tools include internal reporting systems, monitoring and detection tools, third -party penetration testing and security assessments and a bug bounty program engaging security researchers. In addition, we have adopted a comprehensive incident response plan and process for detecting, mitigating, and investigating cybersecurity incidents, which employees, under the leadership of the Company's Chief Information Security Officer ("CISO"), regularly test through table-top exercises, testing of our security protocols through additional techniques such as penetration testing, debriefing after security incidents to improve our security and responses, and regular briefing to our directors and officers on our cybersecurity risks and preparedness.

companyName: Skillsoft Corp.

ticker: SKIL


text: Our global information security program is led by our CISO, who brings over 20 years of industry experience. Regular reports on cybersecurity threats, assessments, and findings are provided by the CISO to senior management and relevant teams. In addition, the CISO provides quarterly updates to the Board Audit Committee. The Board oversees annual enterprise risk assessments, with the Audit Committee specifically tasked with overseeing cybersecurity risks.


text: Additionally, we maintain a third -party security program to assess, prioritize, and mitigate risks associated with our vendors and partners. We also rely on third parties to implement appropriate security measures.


text: Regular risk assessments evaluate cybersecurity and technology threats, employing a widely adopted risk management model to prioritize risks and develop corresponding security controls. Our information security program undergoes regular reviews, audits, tests, and exercises to ensure effectiveness and enhance security measures.


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, we have not experienced any cybersecurity incidents that resulted in a material effect on our business, results of operations, or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third -party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our Company, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "We are regularly subject to cybersecurity and other similar attacks. If our security measures are breached or unauthorized access to customer data is otherwise obtained, our platforms may be perceived as insecure, we may lose existing customers or fail to attract new customers, our reputation may be harmed, and we may incur significant liabilities."


text: The Company's Board of Directors (the " Board ") recognizes the importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is responsible for overseeing the Company's risk management process, and cybersecurity represents a component of the Company's overall approach to enterprise risk management (" ERM "). In general, the Company seeks to address cybersecurity risks through an approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Charlie's Holdings, Inc.

ticker: CHUC


text: Collaborative Approach: The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident.


text: The Company engages in the occasional assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. The results of such assessments, audits and reviews are reported to management and the Board when necessary, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Board, in coordination with management, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. Key members of the management team monitor and assess a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and key executives discuss the Company's approach to cybersecurity risk management.