FLANIGANS ENTERPRISES INC 10-K

ITEM 1B UNRESOLVED STAFF COMMENTS As a Smaller Reporting Company as defined by Rule 12b-2 of the Exchange Act and in Item 10(f)(1) of Regulation S-K, we are electing scaled disclosure reporting obligations and therefore are not required to provide the information requested by this Item 1B. ITEM 1C CYBERSECURITY Cybersecurity Risk Management and Strategy We are committed to safeguarding our information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction. Our program to protect our information assets and the management of risks to those assets supports the confidentiality, integrity, and availability of the information necessary to our long-term business success. Our cybersecurity risk management program includes: ● the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including, third-party network security reviews, scans, and audits, on at least an annual basis; ● regular cybersecurity awareness training for employees with access to our information systems, incident response personnel, and senior management; ● a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; ● a disaster recovery plan and controls designed to protect against business interruption, including by backing up our critical systems; ● use of end-to-end encryption and tokenization technology, a public key infrastructure, designed to ensure that only trusted devices can access our enterprise information technology network, and Intrusion Prevention System (IPS) that scans data in transit to help prevent the execution of harmful code; and ● a third-party risk management process for service providers, suppliers, and vendors who have access to our information systems. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or are effective in protecting our systems and information. We are not currently aware of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. 21 Cybersecurity Governance Our Board of Directors has oversight responsibility for the Company’s cybersecurity risk management, including technology and cybersecurity risks facing the Company. Management updates the Board, as necessary, regarding cybersecurity risk management matters, including reporting any material cybersecurity incidents. Our management team, including the CEO, CFO, COO, Senior Director of Information Technology, Director of Information Technology, and Director of Accounting, as appropriate, supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.