What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-03-31 compared with 2024-03-20 · 34 added, 18 removed, 3 unchanged (95% of the section changed)

Unresolved Staff Comments

As a smaller reporting company, we are not required to provide the information required by this Item.

a smaller reporting company, we are not required to provide the information required by this Item.

Cybersecurity

We recognize the critical importance of maintaining the safety and security of our systems and data and have a process for overseeing and managing cybersecurity and related risks.

This process is supported by both management, as well as our Board of Directors and our Science and Technology Committee.

The current chair of our Science and Technology Committee is a NACD certified cybersecurity expert.

Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight.

The full Board receives an update on the Company’s risk management process and the risk trends related to cybersecurity at least annually.

Our Science and Technology Committee specifically assists the Board in its oversight of risks related to cybersecurity.

To help ensure effective oversight, the Science and Technology Committee receives reports on information security and cybersecurity from the Company’s information technology managers at least four times a year.

Our approach to cybersecurity risk management includes the following key elements:

Multi-Layered Defense and Continuous Monitoring – We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks.

recognize the critical importance of maintaining the safety and security of our systems and data and have a process for overseeing and

managing cybersecurity and related risks.

This process is supported by both management, as well as our Board of Directors and our Science

and Technology Committee.

The current chair of our Science and Technology Committee is a National Association of Corporate Directors

(“NACD”) certified cybersecurity expert.

Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees

assists the Board in the role of risk oversight .

The full Board receives an update on the Company’s risk management process and

the risk trends related to cybersecurity at least annually .

Science and Technology Committee specifically assists the Board in its oversight of risks related to cybersecurity.

To help ensure effective

oversight, the Science and Technology Committee receives reports on information security and cybersecurity from the Company’s information

technology managers at least four times a year .

approach to cybersecurity risk management includes the following key elements:

Multi-Layered

Defense and Continuous Monitoring – We work to protect our computing environments and products from cybersecurity threats

through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks.

We utilize data analytics to detect anomalies and search for cyber threats.

We engage third-party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats.

Third-Party Risk Assessments – We conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties.

Training and Awareness – We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats.

Our employees with network access participate periodically in required training, including phishing, spear phishing and other security and awareness training.

Supplier Engagement – We review critical third-party systems at least annually, including the various System and Organizational Controls (“SOC”) reports or perform risk assessments.

While we have experienced cybersecurity incidents in the past, to date none have materially affected the Company or our consolidated financial position, results of operations and/or cash flows.

We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.

For more information regarding the risks we face from cybersecurity threats, please see “Risk Factors.”

We engage third-party consultants or other advisors to

assist in assessing, identifying and/or managing cybersecurity threats.

Risk Assessments – We conduct information security assessments before sharing or allowing the hosting of sensitive data

in computing environments managed by third parties.

and Awareness – We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats.

Our employees with network access participate periodically in required training, including phishing, spear phishing and other security

and awareness training.

Engagement – We review critical third-party systems at least annually, including the various System and Organizational

Controls (“SOC”) reports or perform risk assessments.

we have experienced cybersecurity incidents in the past, to date none have materially affected the Company or our financial

position, results of operations and/or cash flows.

We continue to invest in the cybersecurity and resiliency of our networks and to enhance

our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.

For more information regarding the risks we face from cybersecurity threats, please see Item 1A.

“Risk Factors.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments