What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-19 compared with 2025-03-20 · 30 added, 18 removed, 51 unchanged (48% of the section changed)

26 unchanged sentences

NeurAxis, through experienced cybersecurity and HIPAA/HITECH counsel, has developed a security manual and a privacy

These policies and manuals are reviewed and updated annually.

We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities

5 unchanged sentences

NeurAxis also seeks contractual commitments from key suppliers to appropriately secure and maintain their information

technology systems and protect NeurAxis information that is processed or stored on their systems.

This may or may not include business

associate agreements, downstream vendor agreements and vendor auditing in some cases.

technology systems and protect NeurAxis information that is processed or stored on their systems, when applicable.

This may or may

not include business associate agreements, downstream vendor agreements and vendor auditing in some cases.

assessments of NeurAxis:

2 unchanged sentences

NeurAxis has a “real time” cybersecurity

partner that monitors our servers 24/7/365 for any attempted intrusions.

partner that monitors our servers 24/7/365 for any attempted intrusions and directs the execution of the Company’s disaster

recovery plan.

routinely reviews the Office of Civil Right (OCR) audit requirements to assess any gaps within our cybersecurity, privacy and security

3 unchanged sentences

including active interactions with children’s hospitals while assisting with insurance prior approvals, that, if realized, are

reasonably likely to materially affect us, including our operations, business strategy, results

of operations, cash flows or financial condition.

As of the fiscal year ended December 31, 2024, the

Company had not experienced any material cybersecurity incidents that have had a significant impact on our operations, data integrity,

results of operations, or financial performance.

reasonably likely to materially affect us, including our operations, business strategy, results of operations, cash flows or financial

of the fiscal year ended December 31, 2025, the Company had no t experienced any material cybersecurity incidents that have had a significant

impact on our operations, data integrity, results of operations, or financial performance.

CYBERSECURITY

6 unchanged sentences

various cyber security trainings frequently.

The Security Officer collaborates with NeurAxis personnel and our outside IT vendors to

identify and analyze cybersecurity risks to NeurAxis, considers industry trends, implement controls, as appropriate and feasible, to

mitigate these risks and enables business leaders to make risk-based business decisions that impact cybersecurity considerations.

Security Officer meets with senior leadership to review and discuss NeurAxis’ cybersecurity program, including emerging cyber risks,

threats, and industry trends.

The Security Officer also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity

risks and incidents through various means, including by collaborating with external security personnel and business stakeholders, and

incorporating threat intelligence and other information obtained from governmental, public, or private sources to strengthen our cybersecurity

technologies and processes.

The Security Officer collaborates with NeurAxis personnel and our outside vendors to identify

and analyze cybersecurity risks to NeurAxis, considers industry trends, implement controls, as appropriate and feasible, to mitigate

these risks and enables business leaders to make risk-based business decisions that impact cybersecurity considerations.

Officer meets with senior leadership to review and discuss NeurAxis’ cybersecurity program, including emerging cyber risks, threats,

and industry trends.

The Security Officer also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and

incidents through various means, including by collaborating with external security personnel and business stakeholders, and incorporating

threat intelligence and other information obtained from governmental, public, or private sources to strengthen our cybersecurity technologies

and processes.

continues to enhance the Company’s cybersecurity governance through ongoing improvements to its internal control compliance program.

As part of these efforts, the Company has adopted the Control Objectives for Information and Related Technologies (COBIT) 2019 framework

to support the design and governance of its Information Technology General Controls (ITGCs).

the reporting period, management advanced the identification and implementation of ITGCs within the Company’s risk control matrix

as part of the implementation of internal control over financial reporting (“ICFR”).

While the ITGC controls have been identified

and incorporated into the risk control matrix, management expects to conduct the formal assessment and testing of these controls during

fiscal year 2026 in alignment with the continued rollout and enhancement of internal controls over financial reporting .

addition, the Company established a dedicated internal control department during fiscal year 2025.

This function reports directly to

the Audit Committee of the Board of Directors regarding the status and progress of the Company’s internal control over financial

reporting program, including matters related to ITGCs, to strengthen governance and oversight.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments