CitroTech Inc. 10-K

Item 1B. Unresolved Staff Comments. None. Item 1C. Cybersecurity . Cybersecurity Risk Management and Strategy The Company manages its cybersecurity and data privacy risks through implementing desktop protective measures, promoting user awareness, monitoring for potential threats, and responding to security incidents to ensure the confidentiality, integrity, and availability of sensitive information. These cybersecurity risk management processes are incorporated into the Company's overall risk management framework and are designed to identify, assess, and manage risks to the Company's operations and information systems. The Company has engaged consultants to evaluate and enhance the effectiveness of our information security policies and procedures. The Company considers cybersecurity risks associated with third-party service providers as part of its overall cybersecurity risk management framework. In 2025, we did not identify any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Governance The Board of Directors oversees risks from cybersecurity threats and receives periodic reporting from management regarding the Company’s cybersecurity risk profile and information security program. The Company’s information security program is managed by the Company’s Chief Operating Officer (“COO”), who has experience overseeing operational risk management and information security matters as part of his executive responsibilities, and who monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. The COO provides periodic reports to our Board of Directors, as well as members of our senior management as appropriate. These reports occur at least annually and include updates on the Company’s cyber risks and threats and assessments of the information security program. Item 2. Properties. The information required by Item 2 of Form 10-K regarding the Company’s physical properties is incorporated herein by reference to Item 1 of Part I of this Annual Report under the section entitled “Facilities.”