BIOMERICA INC 10-K

ITEM 1B. UNRESOLVED STAFF COMMENTS None. ITEM 1C. CYBERSECURITY We have implemented and maintain an information security program designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data including intellectual property, clinical trial participant and patient-related data, and confidential information that is proprietary, strategic or competitive in nature, or collectively, Information Systems and Data. 18 Our cybersecurity threat risk management processes include the following, among others: ● We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management particularly since we utilize a third-party IT managed services vendor. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT department and our IT managed services to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. ● Our IT managed services vendor implements and maintains various technical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: information security policies, network and device security, encryption standards, incident response plans, disaster recovery plans, risk management, vulnerability detection as well as security tools such as firewalls, malware protection tools, secure authentication tools, centralized logging and monitoring tools, threat intelligence tools, and data protection tools. ● We maintain continuous oversight through regular monitoring, which includes annual evaluations of Service Organization Control (SOC) reports for our providers and the implementation of additional complementary controls as needed. This proactive approach is designed to mitigate risks related to data breaches or other security incidents that could originate from third-party interactions. The Board of Directors oversees cybersecurity risk management, including the practices that management implements to prevent, detect and address risks from cybersecurity threats. The Board of Directors receives regular quarterly briefings on cybersecurity risks including any cybersecurity incidents or threats that may occur or have occurred from the CFO. The Board of Directors may also promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates regarding the same. For a description of the risks from cybersecurity threats that may materially affect us and how those risks may affect us see “Failures in our information technology and storage systems or data security breaches could significantly disrupt our business or force us to expend excessive costs” under Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K.