Item 1B. Unresolved Staff Comments
Item
1B. Unresolved Staff Comments
None.
Item
1C. Cybersecurity
Risk
Management and Strategy
We
recognize the importance of maintaining the confidentiality, integrity, and availability of our information systems and data. As part
of our overall enterprise risk management framework, we have implemented processes designed to assess, identify, and manage material
risks from cybersecurity threats.
28
Use
of Third-Party Managed Services Provider
We
engage Synoptek, LLC as our third-party managed services provider (“MSP”) to administer and manage our information technology
environment. Under this arrangement, the MSP provides operational support for our Microsoft Azure infrastructure, Microsoft 365 environment,
endpoint management, identity and access management, security monitoring, and 24×7 service desk support.
While
we rely on our MSP for day-to-day IT operations and security management functions, responsibility for oversight of cybersecurity risk
remains with our management and Board of Directors.
Cybersecurity
Risk Management Processes
Our
cybersecurity risk management processes include a combination of internal oversight and third-party managed controls. These processes
include:
● Cloud
infrastructure monitoring and management within Microsoft Azure;
● Endpoint
detection and response (EDR), anti-malware protection, and patch management;
● Multi-factor
authentication (MFA) and conditional access controls through Microsoft Entra ID;
● Identity
provisioning and deprovisioning procedures;
● Microsoft
365 security configuration, including email threat protection;
● Data
backup services for Microsoft 365 workloads;
● Periodic
vulnerability scanning and reporting;
● 24×7
monitoring and incident response coordination through our MSP’s service desk and operations
model
Security
services described in our managed services agreement include baseline Zero Trust–aligned controls, identity governance, endpoint
monitoring, and Azure configuration oversight.
We
periodically review reports and updates from our MSP regarding system performance, vulnerabilities, and threat activity.
Third-Party
Risk Management
Because
we rely substantially on third-party providers, including our MSP and cloud platform vendors, we are exposed to risks associated with
their cybersecurity practices and controls. Although we conduct diligence in selecting providers and seek contractual protections, we
do not directly control their internal security operations.
A
cybersecurity incident affecting our MSP, cloud infrastructure providers, SaaS vendors, or other third parties could materially impact
our operations, data security, or financial condition.
Material
Effects of Cybersecurity Risks
Cybersecurity
threats continue to evolve and may include:
● Phishing
and social engineering attacks;
● Ransomware
and malware infections;
● Unauthorized
access to cloud infrastructure;
● Credential
compromise;
● Supply-chain
attacks affecting vendors;
● Insider
misuse or human error.
29
A
material cybersecurity incident could result in:
● Operational
disruption;
● Loss
or exposure of sensitive data;
● Reputational
harm;
● Regulatory
scrutiny;
● Litigation
or indemnification obligations;
● Financial
loss;
● Diversion
of management attention.
As
of the date of this Annual Report, we have not identified any cybersecurity incidents that have materially affected our business, financial
condition, or results of operations. However, future incidents could have a material adverse effect.
Governance
Management’s
Role in Cybersecurity Risk Management
Our
executive management team is responsible for assessing and managing material cybersecurity risks. Management works in coordination with
our MSP to monitor system health, review vulnerability reports, and evaluate incident response activity.
Cybersecurity
matters are evaluated as part of our broader risk management and disclosure control processes. If a cybersecurity incident occurs, management
assesses its severity, scope, operational impact, and potential materiality in accordance with SEC reporting requirements.
We
do not currently employ a dedicated in-house Chief Information Security Officer. Security advisory services, including fractional CISO
services and security engineering support, may be provided through our MSP engagement as needed.
Board
Oversight of Cybersecurity Risks
Our
Board of Directors oversees our risk management processes, including cybersecurity risk, as part of its overall oversight responsibilities.
The Board receives updates from management regarding significant cybersecurity risks and incidents, as appropriate.
The Board retains responsibility for oversight of material
business risks, including cybersecurity. The Board does not currently maintain a separate cybersecurity or technology committee.
Incident
Reporting and Disclosure Controls
We
maintain disclosure controls and procedures designed to ensure that information regarding cybersecurity threats and incidents is communicated
to management in a timely manner to allow appropriate evaluation and disclosure decisions.
In
the event that management determines a cybersecurity incident is material, we will disclose such incident in accordance with applicable
SEC rules and regulations.