Greenlane Holdings, Inc. 10-K

ITEM 1B. UNRESOLVED STAFF COMMENTS None. ITEM 1C. CYBERSECURITY Cybersecurity Risk Management and Strategy The Company maintains processes designed to assess, identify, and manage material risks from cybersecurity threats to its systems, networks, and data. These processes include ongoing monitoring of information systems, periodic risk assessments, and implementation of security controls aligned with the Company’s operational scale and risk profile. The Company’s cybersecurity program includes access controls, network monitoring, and incident response procedures intended to detect, mitigate, and respond to potential cybersecurity threats. The Company may engage third-party service providers from time to time to assist in evaluating and enhancing its cybersecurity posture, including through risk assessments and testing of controls. The Company’s digital asset treasury introduces additional cybersecurity considerations, including custody, access control, and transaction authorization risks. The Company maintains its digital assets, including BERA and U.S. dollar-denominated stablecoins, with third-party custodians and through Company-controlled wallets subject to defined access controls. Access to private keys and transaction authorization processes is restricted through multi-party approval mechanisms and segregation of duties. The Company employs layered security measures, including authentication controls and monitoring of wallet activity, to reduce the risk of unauthorized access, loss, or transfer of digital assets. Governance Cybersecurity risk management is overseen by the Company’s information technology function, which is responsible for monitoring and managing cybersecurity risks and incidents. The Vice President of Information Technology reports to senior management on cybersecurity matters, including any significant risks or incidents. The Company has established a Digital Assets Committee responsible for oversight of the Company’s digital asset treasury activities, including custody arrangements, access controls, and related risk management practices. The Digital Assets Committee receives updates from management regarding digital asset security, custody, and operational controls. The Audit Committee of the Board of Directors maintains oversight of cybersecurity risk management and is informed of material cybersecurity risks and incidents, including those related to digital asset activities, as appropriate. The Company maintains an incident response framework designed to address cybersecurity incidents in a timely manner and to mitigate potential impacts on operations and financial condition. During the year ended December 31, 2025, the Company did not identify any cybersecurity incidents that materially affected its business strategy, results of operations, or financial condition.