2 unchanged sentences
Risk Management and Strategy
−Removed: Aemetis' cybersecurity and information security framework includes physical, administrative and technical safeguards, as well as plans and procedures we believe are reasonable to help Aemetis prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact our operations, facilities and employees.
+Added: Our cybersecurity and information security framework includes physical, administrative, and technical safeguards, as well as plans and procedures we believe are reasonable to help our Company prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact our operations, facilities, and employees.
These plans are based upon our assessment of risk considering our industry, specific operations, cyber perimeter, social exposure, information confidentiality, and tertiary stakeholders.
5 unchanged sentences
sabotage systems;
−Removed: or otherwise cause harm to Aemetis, our customers, suppliers, or other key stakeholders .
+Added: or otherwise cause harm to the Company, our customers, suppliers, or other key stakeholders.
We employ capabilities, processes, and other security measures we believe are designed to reduce and mitigate these risks.
−Removed: Aemetis contracts with a primary Managed Security Provider (MSP) to provide services that assist us with assessing, enhancing, implementing and monitoring our cybersecurity risk management programs and responding to incidents.
−Removed: Aemetis maintains cyber recovery plans as well as a cybersecurity insurance policy.
−Removed: Aemetis utilizes a third -party cybersecurity and information security awareness training programs.
+Added: We contract with a primary Managed Security Provider ("MSP") to provide services that assist us with assessing, enhancing, implementing, and monitoring our cybersecurity risk management programs and responding to incidents.
+Added: We maintain cyber recovery plans as well as a cybersecurity insurance policy.
+Added: We use third -party cybersecurity and information security awareness training programs.
Training is administered and tracked through online learning modules and ongoing phishing simulations.
−Removed: Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues.
−Removed: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.
−Removed: However, despite the capabilities, processes, and other security measures we employ that we believe our controls are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.
+Added: Training topics include processes to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors, or safety issues.
+Added: In 2025, we did not identify any cybersecurity threats that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.
+Added: However, despite the capabilities, processes, and other security measures we employ that are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.
Role of Management
−Removed: Aemetis’ cybersecurity initiative is led by its Chief Financial Officer, who is in the unique position of being able to integrate cybersecurity with the financial internal control framework.
−Removed: He is responsible for administration of the cybersecurity and information security program and risk management, using his experience working with information technology and financial control system during a majority of his career, including over 10 years of overseeing the Aemetis information technology and security program.
−Removed: We utilize a Managed Security Provider (MSP) who serves as the central point for identifying all cybersecurity incidents and reporting, including incidents that directly target company network, internal information systems and incidents originating from third parties.
+Added: Our cybersecurity initiative has been led by our Chief Financial Officer, who is in the unique position of being able to integrate cybersecurity with the financial internal control framework.
+Added: He is responsible for administration of the cybersecurity and information security program and risk management, using his experience working with information technology and financial control system during the majority of his career, including over ten years of overseeing our information technology and security program.
+Added: We utilize a Managed Security Provider (MSP) as the central point for identifying all cybersecurity incidents and reporting, including incidents that directly target company network, or internal information systems and incidents originating from third parties.
The MSP provides end-to-end operations for the purpose of monitoring, detecting, alerting, and responding to cyber incidents.
−Removed: The MSP is also responsible for activating the containment and resolution efforts where appropriate to support Aemetis through the resolution of the incident.
−Removed: The MSP escalates incidents with significant impact and pervasiveness to Aemetis’ Chief Financial Officer, who evaluates each incident in terms of its impact on Aemetis and operations, ability to conduct business with customers and suppliers, brand reputation and health, safety or the environment, and the speed and degree to which the incident has been contained.
−Removed: Our Chief Financial Officer, working with the executive management team, also manages the communication with our Board and outside parties.
+Added: The MSP is also responsible for activating the containment and resolution efforts where appropriate to support us through the resolution of an incident.
+Added: The MSP escalates incidents with significant impact and pervasiveness to our Chief Financial Officer, who evaluates each incident in terms of its impact on operations, ability to conduct business with customers and suppliers, brand reputation and health, safety and the environment, and the speed and degree to which the incident has been contained.
+Added: Our Chief Financial Officer, working with the executive management team, also manages communication with our Board and outside parties.
After initial identification, evaluation and escalation for material events, the MSP monitors all cybersecurity incidents for changes in degree of impact or pervasiveness.
Role of the Board
−Removed: The Board of Directors ("Board") recognizes the importance of cybersecurity in safeguarding the sensitive data and protecting the perimeter of the computer network.
−Removed: The Board is responsible for overseeing overall risk management for the Corporation, including review of the cybersecurity program.
−Removed: As part of its oversight responsibilities, the Board receives an annual cybersecurity update from the Chief Financial Officer.
−Removed: The annual review includes oversight of cyber exposure, risk assessment, incident response, integration with other control activities, internal monitoring, and risk management processes, such as updates to Aemetis’ cybersecurity programs and mitigation strategies, and other cybersecurity developments.
+Added: Our Board of Directors ("Board") recognizes the importance of cybersecurity in safeguarding sensitive data and protecting the perimeter of the computer network.
+Added: The Board is responsible for overseeing overall risk management for the Company, including review of the cybersecurity program.
+Added: As part of its oversight responsibilities, the Board receives and evaluates an annual cybersecurity update from management.
+Added: The annual review includes oversight of cyber exposure, risk assessment, incident response, integration with other control activities, internal monitoring, and risk management processes, updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.