What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-31 compared with 2025-04-17 · 59 added, 69 removed, 5 unchanged (96% of the section changed)

UNRESOLVED STAFF

Unresolved Staff Comments

Cybersecurity

Risk Management and Strategy

We have established policies and processes for assessing,

identifying, and managing material risks from cybersecurity threats.

We have designed and implemented an Access Control Policy.

and supporting procedures encompass all information systems that are owned, operated, maintained, and controlled by the Company and all

other information systems, both internally and externally, that interact with these systems.

Our cybersecurity program and policies is

a collaborative effort, requiring commitment from all personnel, including management, internal employees and users of information systems,

along with vendors, contractors, and other relevant third parties.

Our Chief Information Security Officer (“CISO”)

and Information System Security Officer (“ISSO”) are responsible for providing overall direction, guidance, leadership, and

support for the entire information systems environment, while also assisting other applicable personnel in their day-to-day operations.

The CISO and ISSO are to report to other members of senior management on a regular basis regarding all aspects of the organization’s

information systems posture.

Our internal employees and users are responsible for adhering to the organization’s information security

policies, procedures, practices, and not undertaking any measure to alter such standards on any information systems.

Additionally, end

users are to report instances of non-compliance to senior authorities, specifically those by other users.

End users – while undertaking

day-to-day operations – may also notice issues that could impede the safety and security of our information systems and are to also

report such instance immediately to senior authorities.

Our vendors, contractor and other third-party entities are responsible for adhering

to the organization’s information security policies, procedures, practices, and not undertaking any measure to alter such standards

on any such system components.

We have also implemented an IT Security Incident Response

Incident response preparation comprises of how to respond to incidents and how to protect against and detect computer-related

The process of providing incident response is identified by four distinct phases:

Cycurion has established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats.

Cycurion has designed and implemented cybersecurity policies and procedures intended to protect its information systems and sensitive information assets.

These policies encompass information systems that are owned, operated, maintained, or controlled by Cycurion, as well as external systems and service providers that interact with Company systems.

Cycurion’s cybersecurity program includes safeguards designed to protect sensitive information, including Controlled Unclassified Information ("CUI"), where applicable.

Our cybersecurity program is a collaborative effort requiring the participation of management, employees, contractors, vendors, and other relevant third parties .

Personnel with access to Company systems are responsible for complying with Cycurion's information security policies and for reporting suspected security incidents or vulnerabilities.

Cycurion maintains a cybersecurity program designed to align with recognized industry standards and cybersecurity frameworks, including the National Institute of Standards and Technology ("NIST") cybersecurity guidance and of the CMMC framework established by the U.S.

Department of Defense for the protection of CUI.

Cycurion's cybersecurity policies, procedures, and operational safeguards incorporate security control objectives consistent with NIST and CMMC practices designed to protect sensitive information processed, stored, or transmitted within Company systems.

As part of its cybersecurity risk management processes, Cycurion performs periodic cybersecurity risk assessments designed to identify potential threats, vulnerabilities, and risks affecting the confidentiality, integrity, and availability of Company systems and data.

Identified risks are evaluated and prioritized based on potential operational and financial impact and are addressed through remediation plans, technical safeguards, or operational controls.

Cycurion maintains a vulnerability management program designed to help identify and remediate security weaknesses within its systems and infrastructure.

The Company conducts periodic vulnerability scans and security assessments and remediation activities are prioritized based on the severity of the issue and the potential impact to operations of information security.

Cycurion also employs continuous monitoring capabilities intended to detect and evaluate potential cybersecurity threats in a timely manner.

These monitoring activities may include log monitoring, endpoint detection tools, vulnerability scanning, and the analysis of security events by designated security personnel.

To help protect endpoint devices, Cycurion uses endpoint protection technologies designed to detect, prevent, and respond to malicious activity.

These tools provide monitoring and alerting capabilities that assist security personnel in identifying and responding to potential cybersecurity incidents.

Cycurion has implemented a formal Change Control Board ("CCB") process to review and approve system changes that could affect the security of Company systems.

Proposed changes are evaluated by designated personnel prior to implementation to assess potential cybersecurity risks and to help ensure that appropriate safeguards remain in place.

The Company also maintains a cybersecurity awareness and training program designed to educate employees and contractors about cybersecurity risks and their responsibilities in protecting Company systems and information.

Training topics may include phishing awareness, password security, data protection practices, and incident reporting procedures.

In addition, Cycurion may conduct periodic simulated phishing exercises to reinforce awareness and promote secure behavior.

Cycurion considers cybersecurity risks associated with third-party vendors, service providers, and contractors as part of its broader cybersecurity risk management efforts.

The Company may assess the security posture of key third parties through contractual requirements, security questionnaires, and other risk management measures designed to reduce potential exposure.

Company systems and services are hosted in secure cloud environments.

To protect these environments, Cycurion employs security controls such as identity and access management, network security protections, encryption technologies, and monitoring capabilities designed to safeguard cloud-based infrastructure and applications.

Incident Response

Cycurion has implemented an IT Security Incident Response Policy designed to support the preparation for, detection of, and response to cybersecurity incidents.

The incident response process generally includes four phases:

(i) preparation;

1 unchanged sentence

(iii) containment, eradication, and recovery;

and (iv) post-incident activity.

Our CISO and ISSO are responsible for developing, implementing,

coordinating, and maintaining IT security policy and procedures.

These individuals also fill the role of Computer Incident Response Team

(CIRT) Leaders.

They are responsible for the operations of the system and its applications, including reporting, responding to security

incidents, and ensuring that adequate event logging is enabled.

Our ISSO is responsible for the security of the system and for ensuring

incident response (IR) policy and plan are documented, followed, that the IR plan is tested annually, updated with lessons learned from

training exercises and on-going incident handling activities, and periodically reviewed at least on an annual basis.

This person also

fills the role of Deputy CIRT Leader.

Our CISO is responsible for information security within the organization and is responsible for

the review and approval of the incident response policy and plan.

General end-users and non-CIRT personnel are responsible for actively

securing their systems and notifying the CIRT of any suspected information security incident (e.g., potential virus detection, phishing

emails, potential malware infection, etc.).

Management considers cybersecurity risk as part of

its overall risk oversight function and reviews policies and procedures relative to both the systems and facility to ensure all requirements

are within the Company’s purview to meet, and that appropriate resources have been dedicated or otherwise made available to accomplish,

these requirements.

Our management team, including our CISO and ISSO, are responsible for day-to-day implementation, assessment, and management

our cybersecurity risk assessment and management processes.

The CISO and ISO have primary responsibility for our overall cybersecurity

risk management program, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents, and works

in partnership with our other business leaders.

Our CISO and ISO supervise both our internal cybersecurity personnel and any retained

external cybersecurity consultants.

Our CISO and ISSO have served in various roles in information technology and information security

for over 25 years each.

The Board of Directors receives presentations and

reports on cybersecurity, which address a range of topics including recent developments, evolving standards, the threat environment, cybersecurity

systems testing and vulnerability assessments, and the Company’s practices and policies to manage risks.

The CISO and ISSO report

to the Board of Directors on cybersecurity matters and materials risks, if any, from cybersecurity threats.

The Board of Directors also

receive notice of any significant cybersecurity incidents, as well as ongoing updates regarding any such incident until it has been addressed.

As of the date of this Annual Report, we are not aware

of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected

the Company, its business strategy, results of operations or financial condition.

As cybersecurity threats become more sophisticated,

it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures.

(iv) post-incident review.

Our Chief Information Officer ("CIO") and Information System Security Officer ("ISSO") are responsible for developing, implementing, coordinating, and maintaining Cycurion's cybersecurity policies and procedures, including incident response activities.

The CIO and ISSO also serve as leaders of Cycurion's Incident Response Team ("IRT").

These individuals are responsible for overseeing the response to cybersecurity incidents, coordinating remediation efforts, and ensuring that security monitoring and logging capabilities are enabled across applicable systems.

Incident response procedures include processes for identifying, classifying, and responding to potential cybersecurity incidents.

Security personnel may investigate suspected incidents, collect, and preserve relevant evidence, and coordinate remediation actions designed to restore normal system operations.

Cycurion periodically reviews and updates its incident response procedures and may conduct internal exercises or simulations designed to evaluate incident response readiness.

Employees and system users are responsible for reporting suspected cybersecurity incidents such as malware infections, phishing attempts, unauthorized access attempts, or other suspicious activities to designated security personnel.

If a cybersecurity incident occurs, management evaluates the nature, scope, and potential impact of the incident to determine whether the incident could materially affect Cycurion's business, operations, or financial condition.

This evaluation may involve consultation with internal security personnel, senior management, and legal advisors.

Management considers cybersecurity risk as part of Cycurion's overall risk management and oversight processes.

Cycurion's management team, including the CIO and ISSO, is responsible for the day-to-day implementation, assessment, and management of Cycurion's cybersecurity risk management processes.

The CIO and ISSO oversee Cycurion's cybersecurity program and work with other members of management to implement and maintain cybersecurity policies, procedures, and safeguards designed to protect Company systems and data.

The CIO and ISSO supervise internal cybersecurity personnel and may coordinate with external cybersecurity professionals or consultants who assist with security monitoring, risk assessments, and cybersecurity program improvements.

The Board of Directors receives periodic updates regarding cybersecurity matters, including information related to cybersecurity risks, threat landscape developments, and cybersecurity program activities.

Cybersecurity risk oversight is integrated into Cycurion's broader enterprise risk management processes.

Management periodically provides the Board with updates regarding cybersecurity risk management activities and the effectiveness of cybersecurity controls.

Our Information Security team, led by our Vice President of Operations , William (Eric) Singleton, is responsible for assessing and managing material cybersecurity risks.

Certifications held by the Information Security team members include (ISC)² CISSP, (ISC)² CGRC, ISACA CISM, ISACA CRISC, CompTIA Security+, CompTIA Security X (CASP+), CompTIA PenTest+, CompTIA CNVP, EC-Council CEH, GIAC GWAPT, (ISC)² CAP, FITSI FITSP, CWAPT, IABF, and AWS Solutions Architect Associate.

Singleton's background includes over 25 years of experience in IT and Information Security spanning federal government and commercial sectors, with expertise in cybersecurity strategy, risk management, compliance frameworks, penetration testing, vulnerability assessment, security control assessment, and FISMA/RMF program oversight.

His formal education includes a Bachelor of Science in Computer Science from Northeastern University.

Certifications held by Mr.

Singleton include the (ISC)² Certified Authorization Professional (CAP), with additional specialized training in Incident Response and Threat Hunting, Offensive Operations, Penetration Testing, Red and BlueTeaming, Continuous Diagnostics and Mitigation (CDM), and Cloud Security.

Our Vice President of Operations provides reports to the Audit Committee of our Board of Directors on a standing basis at each Audit Committee meeting, and as otherwise requested by the Chair of the Audit Committee or as determined necessary by the VP of Operations or other members of senior management.

The VP of Operations is personally involved in, and responsible for, the risk assessment, identification, and management process described above.

Cybersecurity Risk Impact

As of the date of this Annual Report, Cycurion is not aware of any cybersecurity incidents that have materially affected its business strategy, results of operations, or financial condition.

However, cybersecurity threats continue to evolve in sophistication and frequency.

As a result, Cycurion may be required to devote additional resources to enhance its cybersecurity protections and maintain the effectiveness of its cybersecurity risk management processes.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments