What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-03-13 compared with 2024-03-14 · 53 added, 61 removed, 18 unchanged (86% of the section changed)

Unresolved Staff Comments.

have received no written comments regarding our periodic or current reports from the staff of the Securities and Exchange Commission

that were issued 180 days or more preceding the end of our 2023 fiscal year and that remain unresolved.

We have received no written comments regarding

our periodic or current reports from the staff of the Securities and Exchange Commission that were issued 180 days or more preceding

the end of our 2024 fiscal year and that remain unresolved.

Cybersecurity.

recognize the critical importance of maintaining the trust and confidence of our customers, business partners, employees and other stakeholders.

We engage in active oversight of cybersecurity, a cornerstone of our comprehensive enterprise risk management (ERM) program.

We recognize the critical importance of maintaining

the trust and confidence of our customers, business partners, employees and other stakeholders.

We engage in active oversight of cybersecurity,

a cornerstone of our comprehensive enterprise risk management (ERM) program.

Our cybersecurity framework is rooted in the National Institute

of Standards and Technology, or NIST, Cybersecurity Framework, or CSF, as well as the International Organization for Standardization

(ISO/IEC 27001), reflecting our commitment to uphold the highest cybersecurity standards.

We align our policies, standards and practices

with these benchmarks and dynamically refine them to address evolving cybersecurity threats.

Risk Management and Strategy

We maintain a cybersecurity program aligned with

NIST CSF standards designed to identify critical assets and vulnerabilities, protect them with appropriate safeguards, promptly detect

cybersecurity events, respond effectively to mitigate their impact and recover from incidents to restore services.

Our cybersecurity

framework is rooted in the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, or CSF, as well as the International

Organization for Standardization (ISO/IEC 27001), reflecting our commitment to uphold the highest cybersecurity standards.

policies, standards and practices with these benchmarks and dynamically refine them to address evolving cybersecurity threats.

Management and Strategy

maintain a cybersecurity program aligned with NIST CSF standards designed to identify critical assets and vulnerabilities, protect them

with appropriate safeguards, promptly detect cybersecurity events, respond effectively to mitigate their impact and recover from incidents

to restore services.

Our cybersecurity program is designed to safeguard the confidentiality, integrity and availability of information.

Our cybersecurity risk management strategy includes:

program is designed to safeguard the confidentiality, integrity and availability of information.

Our cybersecurity risk management strategy

● Governance:

The Audit Committee of our Board of Directors oversees our cybersecurity

risk management.

Our Chief Financial Officer and Director of Information Technology, along with key executives, have roles in governance

and facilitating alignment across our organization.

The Audit Committee of our Board of Directors oversees our cybersecurity risk management.

Our Chief Financial Officer and Director of Information Technology, along with key executives,

have roles in governance and facilitating alignment across our organization.

and Standards:

3 unchanged sentences

information security standards.

deploy technical defenses against cybersecurity risks of attack and other incidents, including firewalls, intrusion detection and prevention

systems and access controls.

We refine these measures based on our ongoing assessments, including cybersecurity threat intelligence updates.

Technical Safeguards

We deploy technical defenses against cybersecurity

risks of attack and other incidents, including firewalls, intrusion detection and prevention systems and access controls.

We refine these

measures based on our ongoing assessments, including cybersecurity threat intelligence updates.

Response and Recovery Planning:

We maintain incident response and recovery frameworks,

tested twice yearly through simulations and tabletop exercises, to improve our preparedness

tested twice yearly through backup restorations to critical systems, to improve our preparedness

to effectively manage and mitigate cybersecurity incidents.

and Awareness:

Our personnel undergo mandatory periodic training on cybersecurity threats,

with updated insights into effective defense mechanisms and our evolving cybersecurity policies

and practices.

of Third Parties:

We collaborate with external cybersecurity

service providers, including auditors and consultants, to refine our cybersecurity measures.

These service providers carry out cybersecurity risk evaluations such as periodic assessments

and vulnerability scans to pinpoint potential security flaws and suggest enhancements.

addition, we employ third-party technology and other solutions to enhance our protection

against cybersecurity risks.

These solutions include our use of a managed security service

provider to support our in-house technology team, an endpoint detection and response, or

EDR, system for ongoing surveillance, detection, and action against threats, as well as a

security information and event management, or SIEM, system designed to automate the real

time identification, investigation and prioritization of critical alerts.

● Third-Party

Risk Management:

We use a comprehensive due diligence process to manage third-party risks,

emphasizing continuous monitoring and to ensure our business partners’ cybersecurity

practices meet our stringent standards.

of the filing of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity

incidents, have materially affected or are reasonably likely to materially affect, Alto Ingredients, Inc.

● We take a comprehensive and forward-looking approach to cybersecurity

risk management under the oversight of our Audit Committee.

Management, including our Chief Financial Officer and our Director of Information

Technology, provide regular updates to ensure a strategic, unified response to cybersecurity challenges.

Management is notified of, and

monitors, cybersecurity incidents through our EDR and SIEM systems.

● Our Director of Information Technology has over 20 years of experience

in information technology and five years of experience serving directly as a Chief Information Security Officer for other organizations.

Our personnel and members of our Board of Directors undergo mandatory

periodic training on cybersecurity threats, with updated insights into effective defense

mechanisms and our evolving cybersecurity policies and practices.

● Use of Third Parties :

We collaborate with external cybersecurity service providers, including auditors, consultants and governmental agencies, to refine our cybersecurity measures.

These service providers carry out cybersecurity risk evaluations such as periodic assessments and vulnerability scans to pinpoint potential security flaws and suggest enhancements.

In addition, we employ third-party technology and other solutions to enhance our protection against cybersecurity risks.

These solutions include our use of a managed security service provider to support our in-house technology team, an endpoint detection and response, or EDR, system for ongoing surveillance, detection, and action against threats, as well as a security information and event management, or SIEM, system designed to automate the real time identification, investigation and prioritization of critical alerts.

● Third-Party Risk Management:

We use a comprehensive due diligence process to manage third-party risks, emphasizing continuous monitoring and to ensure our business partners’ cybersecurity practices meet our stringent standards.

As of the filing of this report, we do not believe

that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or

are reasonably likely to materially affect, Alto Ingredients, Inc.

● We take a comprehensive and forward-looking approach to cybersecurity risk management under the oversight of our Audit Committee.

Management, including our Chief Financial Officer and our Director of Information Technology, provide regular updates to ensure a strategic, unified response to cybersecurity challenges.

Management is notified of, and monitors, cybersecurity incidents through our EDR and SIEM systems.

● Our Director of Information Technology has over 20 years of experience in information technology and five years of experience serving directly as a Chief Information Security Officer for other organizations.

networks and systems are continuously monitored by a combination of third-party service providers

2 unchanged sentences

Audit Committee is promptly notified by our management of any material cybersecurity breach.

Board of Directors is briefed at least annually on the state of our cybersecurity program.

Board of Directors is briefed at least quarterly on the state of our cybersecurity program.

internal cybersecurity team collaborates with external cybersecurity service providers, including

auditors and consultants, to refine our cybersecurity measures.

These service providers carry

out cybersecurity risk evaluations such as periodic assessments and vulnerability scans to

pinpoint potential security flaws and suggest enhancements.

and Continuous Improvement

periodically evaluate our cybersecurity measures through internal and external audits and assessments to ensure our cybersecurity program

is at the forefront of industry best practices.

The results of these audits and assessments inform adjustments to our cybersecurity program

to improve our resilience against emerging cybersecurity threats.

auditors, consultants and governmental agencies, to refine our cybersecurity measures.

service providers carry out cybersecurity risk evaluations such as periodic assessments and

vulnerability scans to pinpoint potential security flaws and suggest enhancements.

Engagement and Continuous Improvement

We periodically evaluate our cybersecurity measures

through internal and external audits and assessments to ensure our cybersecurity program is at the forefront of industry best practices.

The results of these audits and assessments inform adjustments to our cybersecurity program to improve our resilience against emerging

cybersecurity threats.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments