OFA Group 10-K

ITEM 1B. Unresolved Staff Comments Not Applicable ITEM 1C. Cybersecurity Cybersecurity Risk Management and Strategy The management of the operation and the business affairs of a Cayman Islands company lies within the power of its board of directors. Directors of companies incorporated under the Companies Act are subject to both statutory obligations under the Companies Act as well as fiduciary duties under the common law to the extent applicable to Cayman Islands companies. In addition to the statutory duties which include duties such as reporting obligations, the maintenance of internal company registers, accounting requirements, etc., directors of Cayman Islands companies owe fiduciary duties including the duty to act in good faith and in the best interests of the company as well as a duty to act with care, skill and diligence under English common law principles. Maintaining sufficient protection against the increasing risks associated with cybercrime is one of the key challenges to the commercial world and, the overseeing of cybersecurity risks falls within the duties of the Company’s board of directors, including its independent directors. The independent directors oversee cybersecurity risks as of the date of this annual report. Our board of directors plays an active role in monitoring cybersecurity risks and is committed to the prevention, timely detection, and mitigation of the effects of any such incidents on our operations. In addition to regular reports from each of the board’s committees, the board receives regular reports from our management on material cybersecurity risks and the degree of our exposure to those risks. While the board oversees our cybersecurity risk management, management is responsible for day-to-day risk management processes. Management also works with third party service providers, i.e. software companies who provide software and antivirus supports to the Company to ensure appropriate controls are in place and to regularly monitor network activities. We believe this division of responsibilities is the most effective approach for addressing our cybersecurity risks and that our board leadership structure supports this approach. 69