text: Our cybersecurity risk management program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to the other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; a security team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security procedures;

companyName: SERVOTRONICS INC /DE/

secItem: Item 1C


text: training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and procedures;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process for service providers, suppliers, and vendors. In the last three fiscal years, the Company has not experienced any material cybersecurity incidents.


text: The Board of Directors ("the Board") regularly receives reports from our executive officers and third parties on cybersecurity matters. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.


text: Management is responsible for developing cybersecurity programs, including as may be required by applicable law or regulation. These individuals' expertise in IT and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience. They are informed by their respective cybersecurity teams and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.


text: Cybersecurity threats continue to evolve as the threat landscape evolves. The Bank continuously works to evolve its cybersecurity practices with the changing landscape. Significant resources are devoted to protecting and enhancing the security of networks, computer systems, data storage devices, and other systems and technology. The Bank's security efforts and implemented controls are designed to protect against, among other things, cybersecurity attacks that can result in unauthorized access of confidential information, the destruction of data, disruptions to or degradations of service, the sabotaging of systems or other damage.

companyName: RBB Bancorp

ticker: RBB


text: Third parties with which the Bank does business, which facilitate the Bank's business activities, e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries are sources of cybersecurity risk to the Bank. Third-party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises could have a material adverse effect on the Bank, including in circumstances in which an affected third party is unable to deliver a product or service to the Bank or results in lost or compromised information of the Bank or its clients or customers.


text: Bank customers are also sources of cybersecurity risk to the Bank and its information assets, particularly when their activities and systems are beyond the Bank's own security and control systems. The Bank provides information to its customers and other external parties concerning cybersecurity risks including opportunities to reduce cybersecurity risk.


text: The security program is commensurate with the size and complexity of the Bank. Risks from cybersecurity threats, including any previous cybersecurity events, have not materially affected the Bank or its business strategy, results of operations or financial condition.


text: The Bank maintains an Information Security and Cybersecurity Program to support the management of cybersecurity risk as a component of the Bank's Enterprise Risk Management ("ERM") framework. The information security and cybersecurity program is designed to manage risks relating to cybersecurity threats and leverages controls, best practices recommendations, and standards from the Federal Financial Institutions Examination Council ("FFIEC") and the National institute of Standards and Technology ("NIST") Cybersecurity Framework, and standards set by relevant legal and regulatory authorities.


text: The Information Security Officer ("ISO") oversees the Bank's Information Security and Cybersecurity Program and leads the Information Security team. Reporting to the Chief Risk Officer ("CRO") and Chief Information Officer ("CIO"), the ISO and his team are responsible for identifying, assessing and managing information security and cybersecurity risks, and for implementing and maintaining controls to prevent, detect and respond to cybersecurity threats and incidents, safeguarding the confidentiality, integrity and availability of the Bank's information systems and data.


text: As part of the Information Security and Cybersecurity Program, the Bank conducts periodic employee training to educate employees on information and cybersecurity risks and to reinforce security management practices and compliance with the Bank's security policies and standards. Training is mandatory for all employees and is supplemented by testing initiatives, including periodic phishing tests.


text: The Bank's policies and procedures concerning cybersecurity matters include processes to safeguard its information systems, monitor these systems, protect the confidentiality and integrity of its data, detect intrusions into its systems, and respond to cybersecurity incidents. Extensive technical controls are in place for identifying and managing cybersecurity risks and safeguarding Bank information systems and information. The Bank uses sophisticated industry-recognized monitoring and threat detection technologies that continuously monitor its information systems and provide threat detection alerts. The Bank's strategy for assessing, identifying, and managing cybersecurity risks and for evaluating the effectiveness of its cybersecurity program includes periodic risk assessments and testing of its systems, processes and procedures through audits, penetration testing, vulnerability scans, tabletop exercises, and other related exercises.


text: The Bank has an incident response program designed to enable the Bank to respond to cybersecurity incidents, coordinate as appropriate with law enforcement and other government agencies, notify clients and customers, as applicable, and recover from such incidents. In addition, the Bank actively partners with appropriate government and law enforcement agencies and peer industry forums to participate in threat intelligence discussions and simulations to assist with understanding the full spectrum of cybersecurity risks and enhancing defenses and improving resiliency in the Bank's operating environment.


text: The Bank engages third parties on a regular basis to assess, test, audit or assist with the implementation of risk management strategies, policies, and procedures to enhance the detection and management of cybersecurity risks. Cybersecurity risk management strategies include, but are not limited to: consultants who assist with assessing risks, assessing systems alignment with NIST Cybersecurity Framework, and FFIEC, penetration testing, tabletop exercises and other regulatory agency requirements.


text: The Bank maintains a process to evaluate and manage risks associated with third-party service providers. We conduct a full vendor due diligence review before engagement, review specific security measures in our contracts, and maintain continued monitoring during the engagement including yearly due diligence reviews.


text: The IT Committee and Audit Committee are the principal board committees that oversee the Bank's assessment and management of cybersecurity risk, including oversight of the implementation and maintenance of appropriate controls in support of the Bank's Information Security and Cybersecurity Program. Both the IT and Audit Committees are comprised of professionals with risk management and information technology expertise to manage any material risk from a cybersecurity threat standpoint.


text: The membership of the IT Committee includes members of the executive management team as well as directors of the Bank. The CIO and ISO actively participate in all IT Committee meetings. The CIO has over 20 years of work experience in the development, operation and management of Information Technology at financial institutions. The ISO has over 10 years of work experience in building and overseeing cybersecurity programs at financial institutions. Both CIO and ISO have extensive experience and qualifications in various technology and information security disciplines, including relevant experience at the Bank. Additionally, the Audit Committee has oversight of the management of cybersecurity risk via validation and review of IT and cybersecurity risk assessments and audits. The ISO provides reporting metrics on cybersecurity risks to the IT Committee, which meets at least four times a year. The IT and Audit Committees assist the Board of Directors in its oversight.


text: As part of its oversight of management's implementation and maintenance of the Bank's risk management framework, the Bank's Board of Directors receives regular updates directly from both IT and Audit Committees concerning cybersecurity matters. These updates generally include information regarding cybersecurity and technology developments, the Bank's Information Security Program and recommended changes to that program, cybersecurity policies and practices, and ongoing initiatives to improve information security, as well as any significant cybersecurity incidents and the Bank's efforts to address those incidents.


text: Notwithstanding the Bank's efforts at cybersecurity, the Bank cannot guarantee that those efforts will successfully prevent or mitigate a cybersecurity incident that could have a material adverse effect on it. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Bank, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A. Risk Factors– Risks Related to Our Business.


text: Risk Management & Strategy Rocky Brands recognizes the critical importance of developing, implementing, and maintaining a robust information security program to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have established information security programs and policies, including processes for identifying, assessing, and managing risks arising from cybersecurity threats. These processes involve regular assessments of our information systems and infrastructure to identify vulnerabilities and threats. We focus on executing a centralized information technology and cybersecurity program. Our Company-wide approach is to be positioned as one security program, one posture and one roadmap for the enterprise. This platform is administered across our departments by our cybersecurity team led by our Vice President of Information Technology. Our information security programs and policies are aligned with those of the Center for Internet Security (CIS), Control Objectives for Information Technologies (COBIT), and National Institute of Standards Technology (NIST).

companyName: ROCKY BRANDS, INC.

ticker: RCKY


text: We are integrating our information security programs and cybersecurity risk management processes into our overall enterprise risk management ("ERM") strategy. We are developing an entity-wide information technology ERM framework and will take steps to monitor, report on and communicate to stakeholders consistent with our ERM strategy. Recognizing the cybersecurity risk landscape is complex and ever evolving, we engage with a broad group of external experts and consultants, and auditors in evaluating and testing our information security programs. We leverage this specialized expertise to manage threat detection and response management, conduct regular audits and consult on our overall information security programs.


text: We are acutely aware of risks associated with third -party service providers and we incorporate cybersecurity into our third -party vendor management policy. We conduct thorough security assessment to determine the category of risk third parties pose to Rocky Brands, with a priority focus on vendors with products or services that will have access to private and sensitive information. Vendor assessments incorporate inputs, including for example, BitSight and Service Organization Control Type 2 ( "SOC2") information available for our third -party vendors. Our assessments and monitoring are designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Although no cybersecurity incidents during the year ended December 31, 2024 which had a material impact on our business strategy, results of operations or financial condition, the scope and impact of any future incident cannot be predicted. See Item 1A. - Risk Factors for more information about our information security and cybersecurity risks.


text: Our Board of Directors has established governance protocol over risk management, including general oversight of information technology security and cybersecurity risk. The Audit Committee is central to the Board's oversight of cybersecurity risks and is primarily responsible for this domain. The Audit Committee actively participates in discussions with management, external experts and amongst themselves regarding cybersecurity risks. The Audit Committee is comprised of Board members with broad expertise, including technology, risk management and finance, enabling them to effectively oversee and govern cybersecurity risks. One Audit Committee member is certified under the National Association of Corporate Directors Certificate in Cyber-Risk Oversight Program.


text: We have developed a robust organizational structure to manage and oversee our information technology and cybersecurity programs, including full-time information security associates dedicated to cybersecurity. These individuals possess relevant experience and expertise in cybersecurity and risk management. Our Director, IT Infrastructure & Security leads our information security, data privacy and protection, and information technology compliance programs. The Director stays current with security related topics by either webinars, training classes or cybersecurity conferences. Guided by management, our information technology teams maintain a detailed Cyber Incident Response Plan ("CIRP") and hold frequent meetings to ensure the proper communication and execution of our security controls and procedures. The Cybersecurity team has various expertise ranging in Associate of ISC2-CISSP certification and extensive training on current security products. The Director, IT Infrastructure & Security regularly reports to the Vice President of Information Technology and maintains ongoing dialog with the reporting structure to our CEO, CFO and COO, and Board of Directors regarding our information security programs. This reporting includes updates on matters evaluated under our CIRP, the current threat landscape, cybersecurity initiatives, and the effectiveness of our cybersecurity programs.


text: Our Vice President of Information Technology has more than 35 years working as an IT professional, 13 years of which has been at the Company in various roles such as, Programming, Business Analysis, Systems Analysis, Operations, EDI Manager, and Applications Director.


text: Cybersecurity is an area of increasing concern to the management of and investors in CPS. While CPS has been International Traffic in Arms Regulations (ITAR) compliant for many years, that in itself does not mitigate the risks of a cybersecurity incident. The Company is currently also working towards full compliance with NIST 800 - 171 as well as CMMC compliance. In working towards this goal, CPS has retained an outside consulting firm to help us implement the policies, processes and procedures to further mitigate cybersecurity risks.

companyName: CPS TECHNOLOGIES CORP/DE/

ticker: CPSH


text: CPS generally keeps all employee personally identifiable information with its payroll service provider. Each year the provider furnishes us with their Service Organization Controls ("SOC") report which includes their cybersecurity policies and procedures.


text: Management is not aware of any previous cybersecurity incidents of any significance. Nevertheless, there is always a risk that a phishing attempt, ransomware or other attack by a bad actor could be successful. Although CPS is generally down the supply chain from prime contractors, the fact that we do work in the aerospace and defense industries does make us a potential target. Please refer to the risk factors titled " Manufacturing interruptions or delays could affect our ability to meet customer demand and lead to higher costs " and " If we are subject to cyber-attacks, we could incur substantial costs and, if such attacks are successful, we could incur significant liabilities, reputational harm, and disruption to our operations " in "Risk Factors" in Part I, Item 1A of this Form 10 -K for more information on the risks posed to us by cybersecurity threats. Based on information currently available, management does not believe that there is a reasonably likely risk of these issues, nevertheless the possibility of one occurring cannot be completely ruled out.


text: Risk Management Strategy As a financial institution, cybersecurity presents significant risks that could materially impact the Company's operations, financial performance, and reputation. A successful cyberattack could result in operational disruptions, financial losses, regulatory scrutiny, legal liability, and reputational damage. Accordingly, the protection of customer and business information is a top priority. Cybersecurity risk management is a component of the Company's formal Information Security Program. The Information Security Program is incorporated into the Company's Enterprise Risk Management Program, ensuring a holistic approach to risk prevention, detection, mitigation, and remediation of cybersecurity threats.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: The Information Security Program is based on regulation and guidance established by agencies, including but not limited to, the Federal Financial Institutions Counsel ("FFIEC") and the FDIC. The Information Security Program begins with risk assessment. At least annually, the Company's Information Security team completes an information security risk assessment in accordance with regulatory guidance. While cyber threats are included in the overall information security risk assessment, a targeted cybersecurity risk assessment is also completed, utilizing the FFIEC Cybersecurity Assessment Tool ("FFIEC CAT"). The FFIEC CAT specifically assesses the maturity and effectiveness of the Bank's cybersecurity programs. In addition to the FFIEC CAT, the Bank partners with internal and external auditors to conduct various assessments throughout the year to identify, manage, and mitigate cybersecurity risks. The assessments conducted include but are not limited to: vulnerability assessments, penetration testing, social engineering, and onsite security assessments. Risk assessments consider size and complexity, are formally documented, and adapt to changes in the technology and organizational environment. Management and the Board of Directors use risk assessment data to make informed risk management decisions based on a full understanding of the risks. Management and the Board also consider the results of these assessments when overseeing operations. A strong, high-level risk assessment process provides the foundation for more detailed assessments within the functional risk management areas, as well as improves policy and internal control decisions across the organization.


text: Information Security Risk Assessment Information security controls result from an effective risk assessment process. The Company identifies, measures, controls, and monitors threats to avoid risks that threaten the safety and soundness of the organization. In accordance with the Gramm-Leach-Bliley Act (GLBA) and FDIC regulation 12 CFR Part 364 Appendix B III B, the objectives of the information security risk assessment include:


text: Identifying reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems. Assessing the likelihood and potential damage of these threats, taking into consideration the sensitivity of customer information. Assessing the sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risks.


text: Cybersecurity Risk Assessment Cybersecurity is an integral subset of information security and refers to anything intended to protect enterprises and individuals from intentional attacks, breaches, incidents, and consequences. The foundation of this protection begins with identifying the risk of these threats and assessing the controls in place to mitigate such risks. The Company has included cyber threats in its information security risk assessment in accordance with regulatory guidance and conducts a targeted cyber risk assessment using the FFIEC CAT. Utilizing the FFIEC CAT, the Company's inherent risk profile is documented along with its maturity level and effectiveness in managing cyber risk.


text: Both the Information Security Risk Assessment and the FFIEC CAT results are presented to, and approved by, the Audit Committee of the Board of Directors at least annually.


text: Risk Management Plan Once risk assessments are complete, a risk management plan is prepared to ensure controls are developed or enhanced to mitigate risks to acceptable levels. The Risk Management Plan is presented to, and approved by, the Audit Committee of the Board of Directors annually and progress on remediation activities is shared quarterly.


text: Information Security Program Vendor Management. The Company maintains a formally documented Vendor Management Program that includes an information security review of all new and existing third -party vendor relationships. The Vendor Management team ensures initial and ongoing due diligence is performed on all third -party relationships according to policy. Quarterly Vendor Management program updates are provided, and the policy is reviewed and approved annually by the Audit Committee of the Board of Directors.


text: Implementation of a multi-faceted threat intelligence gathering process. The Information Security and Information Technology teams subscribe to several threat intelligence news feeds and regularly attend cybersecurity threat intelligence webinars, trainings, and peer groups. Information on threat gathering is included in a quarterly report to the Board of Directors.


text: Implementation of a multi-layered defense strategy to fortify information protection. Technical, physical, and administrative control redundancies are deployed to ensure multiple layers of protection are in place against cyber threats. Control design and operating effectiveness is tested regularly by independent audit firms and reported to senior management and the Audit Committee of the Board of Directors.


text: Comprehensive security awareness training and testing for all bank employees. Various communication strategies to communicate new and existing cybersecurity threats are used. Employees receive regular virtual and in-person security awareness training through simulated tests, online training courses, company communications, and in-person training and testing events. Training and testing efforts are included in the quarterly update to the Board of Directors.


text: A comprehensive Incident Response Plan has been developed and tested. The Plan contains information for employees to ensure they can recognize, investigate, communicate, prevent, and document an incident that threatens the confidentiality, integrity, or availability of information or systems. All incidents are reported to, and the Plan is reviewed and approved by, the Audit Committee of the Board of Directors.


text: Independent Audit and Testing. The Company's Audit Department schedules and oversees a regular review of program design and effectiveness by independent third -party audit firms that specialize in technology and cybersecurity. Results are reported directly to senior management and the Audit Committee of the Board of Directors.


text: Remediation Tracking. Remediation and tracking sheets are developed for all audit and assessment results. Progress is monitored by the Audit Department and reported to the Audit Committee of the Board of Directors regularly.


text: Cyber Insurance Coverage. The Company maintains a cyber insurance policy as part of its overall risk management strategy to mitigate financial losses in the event of a cybersecurity incident.


text: The Company's Board of Directors provides active oversight of cybersecurity threats in accordance with the Board-approved Information Security Policy and Program. Direct oversight of the Program is delegated to the Audit Committee of the Board of Directors. The Audit Committee has an established risk appetite statement that defines the Company's risk acceptance tolerance. The Audit Committee reviews and approves the Risk Appetite statement annually. The Audit Committee also plays a critical role in overseeing the Bank's efforts to develop, implement, and maintain an effective Information Security Program. With direction and oversight by the Audit Committee, the Bank's Chief Risk Officer ("CRO") oversees the enterprise-wide risk management program, and the Chief Information Officer ("CIO") is the Board-appointed Information Security Officer, responsible for the Information Security Program, including cybersecurity. The CRO and CIO report cybersecurity related matters directly to the Audit Committee.


text: The Information Security team, engaged in enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes, ensures a complete approach to safeguarding the confidentiality, integrity, and availability of sensitive information. The Information Security team consists of experienced information security professionals and is led by the CIO. The CIO has more than 25 years of information technology and banking leadership experience and holds a Certified Information Systems Security Professional ("CISSP") designation. Reporting to the CIO is the Information Security Manager who has more than 10 years of cybersecurity experience in the Financial Institution industry and possesses a master's degree in information systems management with an emphasis in cybersecurity. Complementing the independent Information Security team, is the Information Technology (IT) team. The IT System Administration & Engineering Manager has over eight years financial institution technology experience and a master's degree in information systems management with a cybersecurity management specialization and the Systems Support Manager has over 20 years of financial institution technology experience, ensuring technology operations occur with a security-focused mindset. In addition to experienced information security and information technology teams, the Company engages with industry experts for managed security services. This collaborative effort includes threat intelligence gathering, firewall management, intrusion detection system monitoring, intrusion prevention services, and security information and event management monitoring, ensuring round-the-clock protection.


text: The Vendor Management team ensures compliance with the organization's Vendor Management Policy, including initial and ongoing due diligence of all third -party providers.


text: Risk assessments and risk management plans are developed, communicated, and tracked. Annually, the CIO presents the Information Security Risk Assessment to the IT Steering Committee and to the Audit Committee of the Board of Directors for review and approval. Quarterly, the CIO provides an Information Security Risk Management Plan status report to the Audit Committee and an Information/Cybersecurity Status report to the full Board of Directors. Reports encompass internal information and cybersecurity assessments, business continuity plans, disaster recovery measures, incident response planning and testing, patch management and vendor management program statuses, as well as internal self-audit results. The information security risk assessment and updates on projects aimed at fortifying information security systems and emerging cybersecurity threat insights are communicated to the Audit Committee, maintaining transparency, and ensuring informed decision-making. Annual review and approval of information security-related policies by the Audit Committee underscore our commitment to governance and regulatory compliance.


text: Audits and testing of program effectiveness are coordinated by the Company's Senior Vice President of Audit who oversees the Audit Department and reports to the Audit Committee of the Board of Directors, independent of the technology and cybersecurity functions. The Audit Department utilizes independent third -party audit firms with technology and cybersecurity expertise. Results of all audits and independent assessments are delivered directly to senior management and the Audit Committee of the Board of Directors by the SVP of Audit.


text: The Information Security team serves as the Bank's dedicated cybersecurity incident response team. Cybersecurity incident response is a sub-section of the Bank's Incident Response Plan. The Information Security team handles the technical aspects of the Bank's response to a cybersecurity incident. Escalation instructions are included in the Plan for engaging resources outside the Information Security team. The Board is notified immediately of cybersecurity incidents, as per the incident response instructions.


text: Cybersecurity Incidents As of the reporting period, the Company has not experienced any material cybersecurity incidents that have had a significant impact on operations, data integrity, or financial performance. However, the Company continuously monitors and evaluates cybersecurity threats, including those affecting third -party service providers. While some third -party vendors have reported cybersecurity events, none have materially impacted the Company's systems, computing environments, or customer data. The Company remains committed to enhancing its cybersecurity defenses through ongoing risk assessments, investment in technology, and adherence to industry best practices.


text: Risk management is an essential component of our culture and business model. Guarding against the specific risks posed by cybersecurity threats has been and will continue to be very dynamic in nature, requiring that we remain agile and aware of internal and external changes. We recognize that cybersecurity threats can be among the most critical risks facing large companies. As a result, cybersecurity is treated as a Board-level matter and overseen by the Board. However, both the Board and management have an integral role in the identification, assessment and management of cybersecurity risk.

companyName: US Alliance Corp


text: Management engages third parties with relevant expertise in assessing and managing cybersecurity threats. As a general matter, we take a proactive approach to assessing and monitoring cybersecurity-specific risks that is oriented around monitoring emerging external threats, ensuring controls are in place to identify and manage risk within our technology environment and creating a culture of vigilance across the organization. Annually we hire a third party to test for and resolve weaknesses and vulnerabilities within our systems and applications by using network and infrastructure vulnerability testing.


text: Our awareness and training program creates a risk-aware culture to ensure employees understand cybersecurity threats and are accountable for completing required training. We have an enterprise incident management plan that provides a framework for preparing for, managing and responding to cybersecurity incidents that may arise.


text: No risks from any known cybersecurity incidents have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For further discussion related to how cybersecurity risks may impact our performance in the future, see Item 1A. "Risk Factors."


text: Managing cybersecurity risk is critical to supporting our vision, enabling our strategy, and safely operating our business. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process which covers all Company risks. As part of this process, appropriate personnel collaborate with third-party subject matter experts to gather insights for identifying and assessing material risks associated with cybersecurity threats, their severity, and potential mitigations. Further, we provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity event. Compare our processes to benchmark standards, such as those set by the National Institute of Standards and Technology ("NIST"). Closely monitor emerging data protection laws and implement changes to our processes as needed. Conduct annual cybersecurity management and incident training for employees involved in our systems that contain sensitive data.

companyName: Eton Pharmaceuticals, Inc.

ticker: ETON


text: Run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies as needed. Carry cybersecurity risk insurance that provides protection against potential losses arising from a cybersecurity incident.


text: As part of the above process, we engage third -party services to provide 24 -hour, 365 -day monitoring, escalation, and response to cyber events. In addition to consulting on best practices, we leverage a third -party expert security firm for independent evaluations of our security controls through penetration testing. These evaluations test both the design and the operational effectives of security controls.


text: Our process also addresses material risks from cybersecurity threats associated with our use of third -party service providers, including those in our supply chain, our product development partners, or those who have access to sensitive data or our systems. Third-party risks are included within our broader overall risk assessment process, and cybersecurity considerations are considered during the selection and oversight of our third -party service providers.


text: Our board of directors, in coordination with the Audit Committee, oversees our risk management program, including the management of risks associated with cybersecurity threats. Our board of directors and Audit Committee receive periodic updates on developments in our cybersecurity risk management practices, evolving standards, third-party vulnerability assessments, and information security issues. On an annual basis, our board of directors and the Audit Committee discuss our approach to overseeing cybersecurity threats with senior management, including our Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO").


text: Senior management works collaboratively across the organization to implement a program designed to protect our information systems from cybersecurity threats and to respond to any cybersecurity incidents in accordance with our incident response and recovery plans. A cross-functional team addresses cybersecurity threats and responds to cybersecurity incidents through communications within the team and with third-party experts to stay informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents and report such incidents to the board of directors and the Audit Committee when appropriate.


text: As of the date of this Form 10-K, we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business, strategy, results of operations, or financial condition at this time. For further discussion of the risks associated with cybersecurity incidents, see Part I, Item 1A of this Form 10-K under the risk factor entitled "We rely significantly on information technology and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively."


text: We have a multilayered framework for detecting and responding to reasonably foreseeable cybersecurity risks and threats. To protect our information technology ("IT") systems from cybersecurity threats, we use various tools that help prevent, detect, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. In the event of a material change to our systems or operations, we would assess the internal and external threats to the security, confidentiality, integrity, and availability of our data and systems, along with other material risks to our operations. We leverage technical safeguards intended to protect the Company's information systems from cybersecurity threats, including firewalls, threat monitoring, intrusion prevention and detection systems, anti-malware, access controls, privilege management, asset and endpoint management, and ongoing system security assessments. We oversee third -party service providers by conducting vendor diligence and reviews on a regular basis. We monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular network scans, system audits, and intelligence feeds. The results of these assessments are used to improve our security posture through remediation efforts.

companyName: TaoWeave, Inc.

ticker: TWAV


text: We have developed an incident management process designed to coordinate the activities to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate any reputational damage.


text: Our business strategy, results of operations, and financial condition have not been materially affected as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see "Item 1A, Risk Factors" in this Annual Report.


text: Oblong's Director of IT is responsible for assessing and managing cybersecurity risks. It has extensive experience focused on increasing the organization's resilience to security threats and staying current on new developments by monitoring the cybersecurity landscape. The team monitors Oblong's IT environment for potential security threats, investigating and acting on security events to minimize potential risks to the environment.


text: Oblong's Audit Committee engages in oversight of Oblong's cybersecurity risks and receives regular updates from management on technology and security updates and Oblong's assessment of cybersecurity threats and mitigation plans. The Audit Committee oversees the processes over internal controls and financial reporting, including controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. In the event of a material cybersecurity incident affecting our IT systems or data management, the Audit Committee would promptly work to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity incidents.


text: Plumas Bancorp maintains a cyber risk management program that is designed to prevent, detect, and respond to information security threats. The Board of Directors is responsible for oversight of the Company's information security program, which is designed and implemented by management under the direction of the Chief Information Officer. In addition, the Internal Auditor and Risk Management Officer consider cybersecurity threat risks alongside other company risks as part of our overall risk assessment and management process.

companyName: PLUMAS BANCORP

ticker: PLBC


text: The Chief Information Officer supervises the information security team, which is responsible for maintaining and implementing our enterprise-wide cybersecurity strategy, policy, standards, and architecture processes. The Information Security Officer, in coordination with compliance and human resources, conducts annual and ongoing company-wide information security awareness training. The Chief Information Officer and Information Security Officer have combined over 35 years of IT management experience. We have developed processes to identify and oversee risks from cybersecurity threats associated with third-party service providers, which include the information security team assessing cybersecurity robustness during third-party vendor onboarding, the inclusion of protective provisions in third-party vendor agreements, and risk-based monitoring of third-party vendors on an ongoing basis.


text: The Board of Directors receives regular reports from the Chief Information Officer and the Information Security Officer on Plumas Bancorp's cyber risks and threats, the status of projects to strengthen Plumas Bancorp's information security systems, assessments of Plumas Bancorp's security program, and the emerging threat landscape. Additionally, the Chief Information Officer chairs the Technology Steering Committee, which drives awareness, ownership, and alignment across all business functions for effective cybersecurity risk management and reporting. In addition to conducting internal audits, Plumas Bancorp annually engages third parties to audit its information security programs, whose findings are reported to the Audit and Executive Committees of the Board. The Company also engages with key third-party vendors, industry participants, government agencies, and intelligence and law enforcement communities as part of our efforts, which are reported to the Technology Steering Committee and Board of Directors.


text: The Company has experienced and expects that it will continue to experience cyber-based attempts to compromise its information systems, although none, to its knowledge, has had a material adverse effect on its business, financial condition, or results of operations. Like all financial institutions, the Company faces the risks of such threats, the consequences of which could be material. See Item 1A – Risk Factors – "Cybersecurity breaches and technological discussions could damage our reputation and profitability," above. In addition, given the constant and evolving threat of cyber-based attacks, the Company incurs significant costs in its efforts to detect and prevent security breaches and incidents, and these costs may increase in the future.


text: We have implemented cybersecu rity and data protection policies and procedures to assess, identify and manage risks from cybersecurity threats. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees receive awareness notices and are informed about new email threats and recent phishing attempts and email frauds. We have capable employees with significant expertise in cybersecurity related to our industry. We evaluate, create and deploy advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks. We also engage third -party service providers and consults to support our cyber risk management efforts, including through periodic security testing.

companyName: TABLE TRAC INC

ticker: TBTC


text: Our Information Technology General Controls are firmly established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery.


text: To date, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For additional information about our cybersecurity risks, see "Any disruption in our software and related information technology systems due to a cyber incident could adversely affect our business, operating results and financial condition" under the heading "Risk Factors Relating To Our Business" in Item 1A. of this Annual Report.


text: The Board of Directors has oversight of the cyber security risk management and strategy. The senior leadership, including our Chief Executive Officer and Chief Financial Officer, regularly meets with and provides periodic briefings to our Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our Chief Executive Officer and Chief Financial Officer are responsible for implementing and maintaining our cybersecurity risk assessment and management processes.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Associated Capital Group, Inc.

ticker: ACGP


text: Our cybersecurity risk management program is aligned with the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;


text: a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: training and risk awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process for service providers, suppliers, and vendors.


text: In the last three years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial.


text: The operations of the Company are dependent on technology information and communications systems. A failure of any such system, or a security breach or cyberattack related thereto, could significantly disrupt the Company's operations. The service providers of the Company are also subject to cybersecurity threats. If the Company and/or any service provider of the Company fails to adopt, implement or adhere to adequate cybersecurity measures, or in the event of a breach of any network, information relating to the Company or the Company's operations, as well as personal information relating to the Company's clients, may be lost, damaged or corrupted, or improperly accessed, used or disclosed.


text: Any system failure, security breach or cyberattack on the Company and/or any service provider of the Company could cause the Company to suffer financial loss, disruption to its business, including its trading capabilities and its ability to transfer payments, increased operating costs, liability to third parties, regulatory intervention and reputational damage, among other things, any one or all of which could have a material adverse effect on the Company.


text: Our Board of Directors is responsible for overseeing cybersecurity threats, among other things. Our Chief Technology Officer, who reports to our Chief Executive Officer and President, provides our senior management and our Board of Directors periodic reports on our cybersecurity risks and any material cybersecurity incidents.


text: Our cybersecurity risk management team, in conjunction with various information technology, internal audit, legal and compliance personnel, has primary responsibility for our overall cybersecurity risk management program.


text: Our team of cybersecurity professionals, led by our Chief Technology Officer, who has over 20 years of experience in the cybersecurity space and advanced training in the field of cybersecurity and technology, has primary responsibility for our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our information technology team also monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: The Company has processes, policies and procedures for identifying, assessing, managing, and responding to cybersecurity threats and incidents. These are integrated into our overall risk management systems, as overseen by the Board, primarily through the Audit Committee. Our policies and procedures include protocols for assessing potential material impacts from cybersecurity threats, escalating to management and the Board of Directors, engaging external stakeholders, and reporting incidents based on applicable legal requirements.

companyName: OCULUS INC.

ticker: OVTZ


text: We use specialized IT tools and services, including with the support of third -party service providers, to understand, manage, mitigate and continually remediate identified threats. The Company logs identified cybersecurity threats and tracks corresponding risk management activities. Identified cybersecurity threats are discussed with management for resolution planning and escalation. Testing of our security controls in connection with the auditing of our financial systems is completed annually.


text: We regularly evaluate the cybersecurity threats associated with third -party suppliers and service providers that have access to the Company's networks, confidential information, and information systems. We provide third -party vendors, consultants, and partners with detailed security requirements for securing their connections to our IT networks. In addition, we seek to make third -party service providers contractually responsible for identifying and remediating security issues within their technology and service environment.


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. While we have implemented a cybersecurity program, the techniques used to compromise IT systems continue to evolve. Accordingly, we may not be able to timely detect cybersecurity threats or anticipate and implement adequate security measures. For additional information regarding risks relating to privacy and cybersecurity, see "Item 1A – Risk Factors."


text: The Board is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Company. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. The CEO and CFO report on cybersecurity matters, including material threats, to the Audit Committee at regularly scheduled Audit Committee meetings, which is then discussed with the Board of Directors.


text: It is management's responsibility to manage cybersecurity threats, as described above, and bring to the Board's attention any material threats. Under the oversight of the Audit Committee, the Company's CEO is primarily responsible for the assessment and management of cybersecurity threats and utilizes third-party consultants retained by the Company for advice.


text: The Company maintains general cybersecurity policies and procedures to assess, identify, and manage cyber threats, and has designated personnel to implement and maintain these policies and procedures, subject to oversight by our management and board of directors.

companyName: Vaxart, Inc.

ticker: VXRT


text: The Company has implemented various technical, physical and administrative security controls to account for these and other cybersecurity threats. For example, we have implemented technical security controls focused on ensuring the security and protection of computer systems and networks; all pertinent domestic operating entities of the Company are required to adhere to a standardized "Company Confidentiality System," which is centrally overseen and enforced, subject to oversight by our management and board of directors. This Company Confidentiality System includes specific provisions for information pertaining to network security, data security, and information that, if compromised, could have detrimental effects on the public interest and the Company. The Company and its employees are also required to sign confidentiality agreements for purposes including helping to ensure cybersecurity. The Company has taken measures to better ensure that key employees are aware of data security threats (including cybersecurity threats), and Company security policies and procedures, as appropriate. Improper or illegitimate use of the Company's information system resources or violation of the Company's information security policies and procedures may result in disciplinary action.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have in the reporting calendar year materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: The Company relies on third-party service providers for critical or key infrastructure and solutions across various Company operations. Cybersecurity incidents that impact third-party service providers have significantly increased in recent years and represent a continuing risk to the Company. The Company has sought to mitigate this risk through specific cybersecurity controls, designed to assess the business and security controls implemented by key information services to the Company, which are annually audited and subject to oversight by management and the board of directors.


text: Avalon faces various cyber risks, including, but not limited to, risks related to the storage of members' information, and security breaches could expose us to a risk of loss or misuse of this information, litigation and potential liability. We utilize a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cyber and information security. Additionally, we devote significant resources to protecting the security of our computer systems, software, networks and other technology assets. Our efforts are designed to adapt with the evolution of information security risks and appropriate best practices and include physical, administrative and technical safeguards. The risk assessment is discussed with the audit committee and board of directors on at least an annual basis. Our practices are generally developed from, and benchmarked against, recognized cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework. Our management team also engages certain outside advisors and consultants to assist in the identification, oversight, evaluation and management of cybersecurity risks on a regular basis, as well as to advise on specific topics. We have not experienced a material cybersecurity incident and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected the Company.

companyName: AVALON HOLDINGS CORP

ticker: AWX


text: Cybersecurity Risk Management and Processes The Company is actively working towards the integration of a cybersecurity risk management program into its comprehensive risk management framework to protect the confidentiality, integrity, and availability of its critical systems and information.

companyName: High Roller Technologies, Inc.

ticker: ROLR


text: Our cybersecurity risk management program is being designed based on various cybersecurity frameworks, including National Institute of Standards and Technology and the Center for Internet Security, as well as information security standards issued by the International Organization for Standardization, including ISO 27001 and ISO 27002. The Company uses these frameworks and information security standards as a guide to identify, assess, and management cybersecurity risks relevant to the business. Formalization and implementation of robust IT security policies; Conducting vulnerability assessments; Revision of user access request documentation to clearly define the roles and permissions assigned to users; Thorough review of the accuracy and completeness of user listings and access;


text: Preservation of evidence related to system modifications; and Continued collaboration with external specialists to aid in the ongoing evaluation of existing policies and procedures. Establishment of a dedicated cybersecurity governance committee; Standardization of cybersecurity incident response procedures and formats; Conducting penetration tests on a quarterly basis; Enhancement of segregation of duties to mitigate the risk of self-review of transactions within the system;


text: The Company has not identified any risks from known cybersecurity threats and did not have any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company.


text: The Board of Directors actively collaborates with management to supervise cybersecurity risks. In its risk oversight role, our Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Management considers cybersecurity risk as part of its risk oversight function and is in the process of establishing a cybersecurity governance committee. Once established, the cybersecurity governance committee will oversee the management's implementation of the cybersecurity risk management program.


text: We have established policies and procedures for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We monitor cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that we use through third party providers that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Moleculin Biotech, Inc.

ticker: MBRX


text: We conduct annual risk assessments and perform as needed updates to our risks to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. We engage consultants, third parties and auditors in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as monitoring and testing our safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic training and communications.


text: As of December 31, 2024, and through the date of the filing of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual report on Form 10-K.


text: One of the key responsibilities of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function through the audit committee, which provides oversight of our cybersecurity program as part of its periodic review of overall risk management program.


text: Our Chief Financial Officer and Head of IT and Cybersecurity, a consultant, are primarily responsible for assessing and managing our material risks from cybersecurity threats. In this regard, our Chief Executive Officer and Head of IT and Cybersecurity have assistance from service providers, other consultants and third parties. Our Chief Financial Officer has served as an executive officer for over twenty-five years, including over fifteen years as an executive officer of public companies. Our Head of IT and Cybersecurity has served as an information technology professional for over nine years and has held senior IT positions at multiple companies, where his primary responsibilities included maintaining direct oversight over his companies' cybersecurity risks.


text: Our Chief Financial Officer and Head of IT and Cybersecurity oversee our cybersecurity policies and procedures, including those described in "Risk Management and Strategy" above. Under such policies and procedures, our Chief Financial Officer and Head of IT and Cybersecurity are responsible for reporting to our audit committee regarding any cybersecurity incidents. The audit committee, in turn, provides periodic reports to our board of directors regarding our cybersecurity processes, including the results of cybersecurity risk assessments.


text: NextPlat uses, stores, and processes data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems, and our business operations.

companyName: NextPlat Corp

ticker: NXPL


text: Cyber Risk Management and Strategy Our cybersecurity risk management processes are integrated into our overall risk management processes. Our strategy consists of utilizing a combination of employee education, preventative controls, detective controls, and periodic third-party cybersecurity testing. We engage with external cybersecurity experts, including assessors, consultants, and auditors, to enhance our cybersecurity measures and ensure compliance with industry best practices. We have established processes to oversee and manage cybersecurity risks associated with our use of third-party service providers, ensuring they adhere to our security standards. We review third-party service provider contracts to ensure they contain data privacy and security provisions, aligning with our standards and regulatory requirements. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks.


text: Oversight and Governance Our Chief Compliance Officer and the Chief Financial Officer lead the oversight of company-wide cybersecurity strategy, policy, standards and processes. We utilize third-party IT consultants to help manage cybersecurity risks. Our Chief Compliance Officer and Chief Financial Officer have the requisite experience in risk assessment and a strong understanding of business operations, including experience with security frameworks, compliance regulations, and the ability to communicate effectively with both technical and non-technical stakeholders. Our consultants have the requisite combination of technical experience in network security, system administration, and incident response.


text: Our Audit Committee liaises with our management team to communicate with and monitor management's mitigation efforts to reduce cybersecurity risks by monitoring incident response, discussing and assisting with identifying potential cyber threats, analyzing vulnerabilities, and prioritizing risks.


text: The goal of the Company's cybersecurity risk management strategy is to mitigate cybersecurity risks. Cybersecurity risks include the potential misappropriation of assets or confidential information, corruption of data, disruptions to operations, or regulatory developments that could materially impact the Company's privacy and cybersecurity risk exposure, and similar threats that could have a material impact to the Company's business, reputation, results of operations and financial condition. To this end, management has implemented processes which seek to identify, assess, and manage material cybersecurity risks, and which include (i) monitoring of cybersecurity threats in the current environment, (ii) training employees on a regular basis in cybersecurity prevention, including social engineering and phishing techniques used by hackers, (iii) requiring multifactor authentication to access the Company's networks, (iv) updating applications on an on-going basis to patch or remediate security vulnerabilities, and (v) the encryption of confidential data and critical servers. The Company has in-place security information and event management tools for the purpose of detecting, analyzing, and responding to security threats in an effort to prevent or reduce potential harm to business operations. These tools include: (i) antivirus applications to detect threats, (ii) end point detection and response applications to record and store on-line user behavior for the purpose of detecting, investigating, and blocking suspicious activities, and (iii) third party monitoring applications. The Company has also adopted a network segmentation strategy intended to divide networks into smaller parts to improve security and efficiency, and the Company also maintains redundant back-up copies of its networks that are stored in multiple locations, including cloud-based backups that are performed daily. Further, on an annual basis, the Company hires a consultant to perform penetration tests against the Company's security infrastructure with the goal of identifying security vulnerabilities and making recommendations for security improvements. The Company also has business continuity and incident response programs in place to respond to and mitigate cybersecurity attacks. The Company conducts periodic exercises in an effort to improve its cybersecurity business continuity and incident response plans and updates the plans if new threats are identified or ongoing reviews of the plans suggest an update is needed.

companyName: BBX Capital, Inc.

ticker: BBXIA


text: During the period covered by this report, the Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: The Company's Board of Directors is responsible for the oversight of management's efforts to address cybersecurity risks. The Board of Directors has designated the Audit Committee with the responsibility of overseeing and reporting to the Board on management's handling of cybersecurity risk management and on the adequacy and effectiveness of the Company's cybersecurity risk management strategy. Management also updates the Board on an on-going basis concerning any significant cybersecurity incidents or risk exposures that have come to management's attention during the conduct of their assessments, the steps management has taken to mitigate such exposures, and any changes to the processes of identifying, assessing, and monitoring cybersecurity threats. The Company's information security team is led by Dustin Woods, who has over 10 years of experience managing risks and advising on cybersecurity matters.


text: Our cybersecurity policies and procedures have been developed to ensure an adequate and consistent approach to the management, control, and protection of our information ("Information Assets"). Our Information Assets include business information, customer information and external business partner information, including, without limitation, classified information, information relating to research, intellectual property, personally identifiable information, business and product development, clinical test and evaluation data, and business plans, customer and supplier information, supply chain, manufacturing, distribution, finance, human resources, consulting, partnerships, contracts, and corporate transactions, maintained in any form or format or location, including audio, video, paper, magnetic, electronic and optical.

companyName: Clene Inc.

ticker: CLNN


text: Device and Network Security Our device and network security policies and procedures are designed to mitigate risk by ensuring our network and computing devices ("Computer Equipment"), electronic systems, and resources used in our business ("Information Systems"), whether owned or leased by us, our employees, or third parties, and the Information Assets contained therein, are protected from security threats.


text: To mitigate risk, we utilize (i) firewalls to protect our network and Computing Equipment, (ii) anti-malware software to protect our Computer Equipment, (iii) device monitoring, (iv) physical security, (v) security and application lifecycle security, (vi) security updates and backups, and (vii) vulnerability and risk assessments.


text: Firewalls. Our network and Computer Equipment is protected by one or more authorized firewalls, with any changes requiring approval from authorized personnel including the review and approval of an information technology ("IT") change control document. Administration of firewalls is restricted to a minimum number of authorized personnel as necessary. We also employ intrusion detection at critical points of our network. All external access to our network, or to any computing resource on our network connected to a non-Clene network (including, but not limited to the internet) must pass through a hardware firewall, appliance, or equivalent device, where all traffic between our network and external networks can be continuously controlled, monitored, and examined for any access violations.


text: Anti-Malware Software. Our Computer Equipment is protected by anti-malware software. The management and administration of anti-malware software is restricted to a minimum number of authorized personnel as necessary.


text: Real-Time Monitoring. We engage a third -party security operations center that actively monitors our environment and detects and remediates security threats in real-time.


text: Device Scanning, Alerts, and Reporting. We reserve the right to monitor, scan, screen, and quarantine/confiscate all Computer Equipment that accesses our network, in compliance with applicable laws and government regulations. We also reserve the right to scan information systems, monitor or screen content and traffic patterns, block e-mail, quarantine and/or confiscate any Information Systems that may post a threat to us, and if such activities reveal possible evidence of criminal activity, to take any appropriate action which may include providing evidence to law enforcement officials.


text: Physical Security. We control physical access to our facilities, areas within our facilities, data centers, server rooms, and equipment. Installation, maintenance, and repair of equipment is restricted to authorized personnel. We protect our Computer Equipment from power failure, surges, and other electrical anomalies, and cabling is protected from unauthorized access or damage. Access to our network services is restricted to authorized individuals and granted only following individual identification and authentication. Local wireless access is limited to authorized entry points, with various forms of authentication required before access is granted to authorized individuals.


text: We perform analysis of security requirements for all systems and applications throughout their lifecycle, including for new systems and applications and significant upgrades to existing systems and applications. All new or upgraded systems and applications are tested for stability, compatibility, and security integrity in a separate environment prior to introduction into our production environment.


text: Security Updates and Backups. We monitor security bulletins, software updates/patches, and functional software updates/patches and apply them in accordance with the timeline prescribed in our policies and based upon recommendations from third -party vendors, as applicable. Systems that no longer provide security updates/patches are discontinued. We research, test, and verify functional software updates/patches before installation. We perform data backups periodically based on business requirements to maximize data availability and prevent information loss, including before any system upgrade or maintenance. Encrypted data remains encrypted throughout our backup processes. Data backups are stored in geographically separate facilities.


text: Vulnerability Assessments. We conduct assessments over potential vulnerabilities for all new and existing network-connected assets on an annual basis. Any potential vulnerabilities that we identify are remediated. We rate vulnerabilities based on the following criteria: (i) High: A vulnerability exists that could potentially allow an attacker to gain elevated access of the host, divulge system information, and/or lead to system or network compromise; (ii) Medium: A vulnerability exists that could potentially allow an attacker limited access to file contents, security settings or ability to conduct a denial-of-service attack; (iii) Low: A vulnerability exists that could potentially allow an attacker limited access to sensitive host system data, such as installed software version giving the ability to exploit application vulnerabilities; and (iv) Info: An attacker could collect basic host information such as open ports and services.


text: Security Incident Reporting Our security incident reporting policy and procedures enable the identification, monitoring, reporting, and response capabilities to known or suspected security incidents in our network and all IT-managed services and Information Systems. Security identification begins with a broad range of potential risks, including, but not limited to, theft or unauthorized disclosure of Information Assets, unexpected modification of Company Information Assets, disruptions of service that can result in Information Assets being unavailable for an unacceptable amount of time, and suspicious behavior and/or unauthorized activity by any individual or organization that can potentially compromise Information Assets or Information Systems.


text: Our process to monitor, report, and respond to identified or suspected security incidents includes (i) collection of relevant information about an incident, including (a) impacted systems, (b) impacted entities, (c) protection mechanisms that were in place and active at the time of the security incident, (d) audit logs, and (e) the risk classification of the Information Assets that were potentially impacted; (ii) reporting to a centralized ticketing system; (iii) reporting to management and other authorities, such as legal, human resources, IT, and local and/or state law enforcement, etc.; (iv) escalation, if the incident is considered to be critical based upon our assessment of its potential impact, to appropriate management and directors and other authorities; and (v) documentation of the incident and our response actions taken.


text: Change and Configuration Management Our change and configuration management policy and procedures enable the effective management of changes to Information Systems ("Changes") to ensure the confidentiality and integrity of Information Assets and the continued availability of both the Information Systems and IT services. The policies and procedures apply to all changes to Information Systems managed by the Company or its IT external business partners.


text: Changes must be approved by authorized personnel prior to (i) performance of any work related to a Change, (ii) migration of any Change-related work from the quality environment to the production environment, to ensure the Change was adequately tested and performs properly, and (iii) closing of the Change, to ensure the Change was implemented in the production environment and correctly solves the issue that prompted the Change request.


text: Changes are tracked and documented in a change tracking system, and we retain past versions of source components and supporting documentation. Testing is performed in an environment other than the production environment, and user acceptance testing is performed by an independent person not responsible for development, modification, or configuration of applications, programs, or system code. Errors are identified, logged, and resolved.


text: Additionally, for Changes that may impact our manufacturing process, we perform impact assessments prior to performing a Change to understand the (i) level of financial, technical, and compliance risk, (ii) impact on business operations, (iii) impact of configuration and user access security, (iv) impact on connected Information Systems and interfaces, and (v) need for user training. The extent and documentation of impact assessments are commensurate with the level of risk associated with the Change, and the level of testing performed shall be determined by the results of the impact assessment.


text: Identity and Access Management Our identity and access management policies and procedures define the access control measures to our Information Systems to protect the privacy, security, and confidentiality of Computer Equipment, Information Systems, and Information Assets.


text: Unique identification is assigned to all individuals with a defined relationship (e.g., employees, vendors, suppliers, etc.), and if a relationship changes, a new identifier is created to reflect the new relationship. Passwords must be changed upon first logon and all privileged account passwords (e.g., root, super user, and administrator passwords) must follow our password guidelines. Identification and authentication are required every time Medium or High Risk Information Assets are accessed or elevated privileges are exercised, and use of elevated privileges is temporary and is revoked upon implementation of a change.


text: Our data access procedures require completion and authorization of access request forms to request, change, or delete access privileges to Information Systems containing Medium or High Risk Information Assets. We perform checks for segregation of duties conflicts and only grant the minimum necessary and least privilege access to users based upon their role. When users are reassigned, promoted, or separated, their access privileges are reviewed and, if necessary, updated in a timely manner. We also perform periodic reviews of user privileges and require training for users with access to Medium or High Risk Information Assets.


text: Information Asset Protection Our Information Asset protection policy and procedures enables the management, control, and protection of Information Assets from unauthorized disclosure, theft, loss, destruction, unauthorized alteration, unauthorized access, and the denial of availability, all of which could have a direct and significant impact on the future success of the Company. Protection of Information Asset supports the efficient and effective management, control, and protection of our business information and the business information entrusted to us by our customers and external business partners. All Information Asset protection policies and procedures must also be viewed in the context of our obligations to comply with government requirements, such as those related to the protection of personal data, and compliance with our contractual obligations.


text: We use the following approach to manage risks related to Information Asset protection: (i) identification and classification of Information Assets, (ii) identification and assessment of the threats to those Information Assets and the associated risk based upon impact to the business and the likelihood of their occurrence, (iii) assessment and analysis of risk, and determination of the actions required to lower risks to an acceptable level, (iv) implementation of appropriate controls or management acknowledgment or risk where controls cannot be implemented, (v) continuous monitoring and measuring of risk, (vi) ongoing communication of risks and mitigating actions, and (vii) auditing for compliance.


text: Once a risk is identified, we analyze the risk and assign a risk classification based upon a combination of factors, including data volume, legal and regulatory requirements, privacy considerations, and intellectual property considerations. Risks are classified as (i) Low Risk, where unauthorized disclosure could be expected to have a limited adverse effect on operations, assets, or individuals; ( 2) Medium Risk, where unauthorized disclosure could be expected to have a serious adverse effect on operations, assets, or individuals; or ( 3) High Risk, where unauthorized disclosure could be expected to have a severe or catastrophic adverse effect on operations, assets, or individuals. Before granting access to Information Assets, we assess the relationship of the user and associated risks of the Information Assets to determine if access is appropriate, and we periodically review access rights to ensure compliance and prevent unauthorized access.


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our overall risk management program. Our CEO, General Counsel, and Vice President of Quality and Technical Operations ("VP of Quality") directly oversee the development, implementation, operation, and revision of our cybersecurity policies and procedures, and are primarily responsible for the oversight of risks from cybersecurity threats and any security incidents that may occur. These officers have more than 24 years of combined experience in managing IT, operations, and information risk and security. Our VP of Quality has experience developing comprehensive information security programs for organizations, and brings extensive experience in the private sector and is a specialist in IT governance strategies, risk management protocols, and compliance frameworks. All security incidents are managed by our VP of Quality and reported to management, including our CEO, General Counsel, and other personnel based upon the specifics of the incident and its impact. Additionally, if a known or suspected security incident occurs at the Company, based upon its risk classification and if we assess the impact to be critical, the incident is escalated in a timely manner to the Audit Committee of the Board of Directors for oversight of the monitoring, reporting, and response process. The Audit Committee also oversees the implementation of our policies and procedures to prevent or reduce cybersecurity risks on an ongoing basis during the performance of its general committee duties.


text: We face a number of cybersecurity risks in connection with our business and have from time-to-time experienced cybersecurity incidents, which to date have not had a material impact on our financial condition or results of operations. For more information about the cybersecurity risks we face, see Item 1A—Risk Factors "Our internal computer systems, or those used by any CROs or other third -party contractors or consultants we may engage, may fail or suffer security breaches."


text: The Company conducts no business activities other than activities relating to capital management, stockholder relations, and acting as a source of financial strength for its subsidiary, the Bank. Cyber/information security is a significant and integrated component of the Company's risk management strategy. As an insured depository institution, threats to information security are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: BankFinancial CORP


text: Information Security Policy and Risk Management: The Bank maintains an Information Security Policy reviewed and updated as needed, and at least annually by its Board of Directors. The Boards of Directors of the Company and the Bank review a formal Information Security Report at least annually and also receive periodic reports on cyber/information security topics and matters.


text: As required by federal banking laws and regulations, the Bank's cyber/information security risk management practices include risk assessments, controls and practices specifically for cybersecurity, information technology deployment and third -party information technology vendor risk management.


text: The Bank conducts an extensive training program, from entry-level to executive-level, focused on information security and customer data privacy. As part of its Enterprise Risk Management protocols, the Company and the Bank maintain insurance policies appropriate for the scope of its operations, including coverage for risks related to cyber/information security and customer data privacy.


text: Information Technology & Information Security Audits. The Bank conducts independent external and internal audits of internal controls relating to information technology and information security in accordance with standards established by the Federal Financial Institutions Examination Council (FFIEC). Pursuant to their respective Charters, the Audit Committees of the Company and the Bank review and monitor the effectiveness of the Bank's internal controls, including those controls related to information security, based on independent external audit and internal audit reports. The Chief Audit Officer, who is also a Certified Information Systems Auditor, coordinates the external and internal audit plan and reporting functions for the Bank.


text: Information Security Management. To prepare and respond to incidents, the Bank maintains implemented multi-layered cybersecurity protocols, integrating people, technology, and processes as part of the Bank's Information Security Program. The Information Security Program is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity, third -party vendor management and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities, deploys current information security technologies and ensures awareness, accountability, and oversight for data protection throughout the Bank and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Company engages qualified third -party vendors, consultants and independent auditors to, among other things, conduct network penetration tests and perform cyber/information security audits.


text: The Information Services Division of the Bank is primarily responsible for identifying, assessing and managing material risks from cyber/information security threats. Information security management is conducted by the Chief Information Officer (CIO) and Chief Information Security Officer (CISO) of the Bank. The CIO has over ten years' experience with the Bank, including information security technology deployment and previous information technology audit experience. The CISO has more than 15 years of experience with the Bank, with expertise in large-scale systems information security and customer data privacy management.


text: The CIO monitors, evaluates and adjusts the Bank's Information Security Program, considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, technology development initiatives, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems. The Management Audit/Compliance Committee reviews and coordinates the status and results of information security controls, network penetration, business continuity/disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Technology Coordinating Committee of the Bank, and presents cyber/information security updates on a periodic basis to the Chief Executive Officer and the Bank's Board of Directors.


text: Our employees are the first line of defense with respect to cyber/information security protection. Each employee is responsible for protecting Bank and customer information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from cyber/information security threats and activities intended to compromise cyber/information security.


text: Customer Data Privacy. The Bank maintains and publishes its Customer Data Privacy Principles on its official website. The Principles include disclosures of the use and sharing of certain customer information, as well as the significant restrictions the Bank places on such activities. In addition, the Bank maintains policies restricting the knowing use or collection of information about children under age 13 by the Bank, other than to provide parental notice or consent. The Bank also maintains policies and controls over the use of electronic mail solicitations, including a customer's ability to "opt-out" of electronic solicitations at any time.


text: The Bank maintains policies, controls and training programs concerning customer information security, including transaction processing. The Bank deploys universal conditional access policies, requires multi-factor authentication for external network access and on-line banking access by Bank customers, and maintains additional access controls for network security and transaction processing. The Bank also has policies and controls to identify, classify and limit access to non-public customer information, including a comprehensive third -party vendor management cyber/information security risk management program.


text: Customer Data Privacy Reviews. The Bank conducts independent external and internal reviews of internal controls relating to customer data privacy and data security in accordance with the requirements of the Gramm-Leach-Bliley Act, the Right to Financial Privacy Act, and standards established by the FFIEC. Pursuant to their respective Charters, the Audit Committees of the Company and the Bank review the effectiveness of the Bank's internal controls, including those controls related to customer data privacy based on independent external audit and internal audit reports.


text: Information Security Incident Responses. The Bank maintains information security incident response plans for various information security/data breach scenarios. The Bank tests its incident response plans at least annually. Pursuant to applicable federal and state laws, regulations and FFIEC standards, the Bank maintains incident response notification procedures for affected customers, including notification of federal regulatory authorities and law enforcement. For the preservation of all possible avenues for law enforcement, the Bank does not disclose information security incidents to the general public unless required by law or as directed by applicable lawful authority.


text: For purposes of the following disclosure, the terms "cybersecurity incident" and "cybersecurity threat" have the meanings given to such terms in Item 106 (a) of Regulation S-K promulgated under the Securities Exchange Act of 1934.

companyName: PARKERVISION INC

ticker: PRKR


text: Given the small size of our organization, we leverage a third-party information technology ("IT") service provider for management of our information systems needs. Our IT service provider works closely with executive management in the assessment, identification and management of cybersecurity threats. Cybersecurity threats are prevented and detected by multiple approaches, including perimeter defense, vulnerability management, intrusion testing, multifactor authentication and data protection. We have also implemented a formal cybersecurity awareness program that includes cybersecurity training for all employees and relevant contractors and is integrated with our overall risk management process. Material risks from cybersecurity threats, including those associated with the use of third-party service providers, are assessed during our annual review of our enterprise risks and related controls.


text: Our overall Board of Directors ("Board") has oversight of all enterprise risks, including those arising from cybersecurity threats. The Board has not assigned that responsibility to any committee or subcommittee of the Board. Assessments of ongoing and emerging enterprise risks, including cybersecurity threats, if applicable, are an integral part of our regularly scheduled Board meetings.


text: We have an informal cyber incident response plan for mitigating and remediating cybersecurity threats and incidents. Any identified cybersecurity threats and incidents are promptly reported to executive management who, along with our IT professionals, will assess the severity of the event and formulate a response. Our determination of the severity of a cybersecurity incident would generally include an evaluation of the incident's effect on the Company, including (i) our business strategy, results of operations, or financial condition, (ii) the integrity, confidentiality, resiliency, and security of our networks and systems, and (iii) our operations. Based on the severity of the event, the Board will be notified and will provide strategic direction through the incident response and communication.


text: We rely on technology in all aspects of our business, including information systems of our third -party service providers. The information systems upon which we depend have been, and likely continue to be, subject to cybersecurity threats such as unauthorized access attempts, business email compromise, phishing, malware, ransomware, hacking and other cyberattacks attempting to disrupt operations. Our dependence on these information systems exposes us to cyberattacks, both directly and through cyberattacks impacting our service providers. A significant cybersecurity incident could result in service interruptions, security events, regulatory compliance failures, the inability to protect employee or corporate information or assets against unauthorized access or use, or other operational difficulties. As described above, we continuously monitor our cybersecurity threats, including risks associated with our use of service providers. We are not aware of any risks from cybersecurity threats, or previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.