What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-05 compared with 2025-03-31 · 28 added, 64 removed, 3 unchanged (97% of the section changed)

1 unchanged sentence

CYBERSECURITY

Risk management and strategy

We are increasingly dependent on sophisticated software

applications and computing infrastructure to conduct key operations.

We depend on both our own systems, networks, and technology as well

as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

Cybersecurity Program

Given the importance of cybersecurity to our business,

we maintain a robust cybersecurity program to support both the effectiveness of our systems and our preparedness for information security

We are increasingly dependent on sophisticated software applications and third-party hosted services to conduct our business operations.

Our technology environment relies primarily on cloud-based systems operated by, third party providers as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

Cybersecurity Risk Management Strategy

We maintain various information security processes to manage cybersecurity risks designed to support the security , reliability and resilience of our information systems.

This program includes a number of safeguards, such as:

continuous monitoring for internal and external threats;

regular evaluations

of our cybersecurity program, including periodic external reviews;

and industry benchmarking.

We are implementing cybersecurity awareness

trainings for all employees.

Our program leverages standard industry frameworks to strengthen our program effectiveness and reduce cybersecurity

We use a risk-based approach with respect to our use

and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed,

or stored by such third-party service provider.

We use a number of means to assess and manage cyber risks related to our third-party service

providers, including conducting due diligence in connection with onboarding new vendors and seeking to include appropriate security terms

in our contracts where applicable.

Process for Assessing, Identifying and Managing Material Risks from

Cybersecurity Threats

In the event of a cybersecurity incident, designated

personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat,

including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident

analysis and program enhancements.

We maintain a disaster recovery plan in the event of a significant cybersecurity incident.

We have relationships with a number of third-party

service providers to assist with cybersecurity containment and remediation efforts, including insurance providers and various law firms.

Management Oversight

controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and

overseen by the use of consultants as the Company does not have a full-time dedicated cybersecurity position in the Company.

Our consultants

have over 20 years of experience in information technology matters and are responsible

for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and

recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure the cybersecurity program functions

effectively in the face of evolving cybersecurity threats.

Board Oversight

The Board of Directors (the “ Board ”)

has overall responsibility for risk oversight and cybersecurity risk matters.

The Board is responsible for discussing with management

the Company’s data privacy, information technology and security and cybersecurity risk exposures, including:

(i) the potential impact

of those exposures on the Company’s business, financial results, operations and reputation;

(ii) the programs implemented by management

to monitor and mitigate any exposures;

and (iii) major legislative and regulatory developments that could materially impact the Company’s

data privacy and cybersecurity risk exposure.

Cybersecurity Risks

Our cybersecurity risk management processes are integrated

into our overall information technology (“ IT ”) processes.

As part of our IT process, we identify, assess and evaluate

risks impacting our operations across the Company, including those risks related to cybersecurity.

We also maintain cybersecurity insurance

providing coverage for certain costs related to cybersecurity-related incidents that impact our own systems, networks, and technology

or the systems, networks and technology of our contractors, consultants, vendors and other business partners.

As of December 31, 2024, we are not aware of any material

risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the business

strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect.

maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve.

we may not be able to timely detect threats or anticipate and implement adequate security measures.

For additional information, see “Item

1A—Risk Factors.”

continuous monitoring for internal and external threats, periodic evaluations of our cybersecurity program, including external reviews, benchmarking against industry standards and practices, periodic penetration testing and phishing simulations and cybersecurity awareness training for all employees.

Our cybersecurity risk management processes are integrated into our overall information technology (“IT”) processes.

As part of our IT process, we identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity.

The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by a managed information technology service provider working in coordination with our management.

This provider has more than 20 years of experience in information technology and cybersecurity and holds industry-recognized certifications.

The provider is responsible for the day-to-day administration of the cybersecurity program, including monitoring, threat prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents.

The Company does not have a full-time dedicated cybersecurity position in the Company.

We use a risk-based approach with respect to our use and oversight of third -party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by each service provider.

We use a number of means to assess and manage cyber risks related to our third -party service providers, including conducting due diligence in connection with onboarding new vendors and using contractual provisions to address information security where applicable.

In the event of a cybersecurity incident, designated personnel are responsible for assessing the severity and potential impact of the incident, containing and remediating the threat, restoring data and system access as necessary, evaluating related reporting obligations associated with the incident, and performing post-incident analysis and reviews to identify opportunities for program enhancements.

We also maintain relationships with a number of third-party service providers, insurance providers, and external legal counsel to assist with cybersecurity incident response and remediation efforts.

Although we have experienced phishing attempts during the past three years, we have not experienced any cybersecurity threats or incidents that have materially affected our business strategy, results of operations or financial condition nor are we aware of any such risks that are reasonably likely to have such a material effect.

Cybersecurity incidents and threats continue to evolve, and despite our safeguards, we may not be able to anticipate, detect or prevent threats in a timely manner.

For additional information, see “Item 1A—Risk Factors- Our business and operations would suffer in the event of a cybersecurity incident.”

The Audit Committee of our Board is responsible for oversight of the Company's cybersecurity risk management and receives quarterly updates from our management regarding cybersecurity risks, significant cybersecurity incidents and cybersecurity initiatives and strategies.

Our management also notifies our Board of significant cybersecurity incidents and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.

We operate primarily as a remote business.

We maintain a mailing address at 411 Swedeland Road, King of Prussia, Pennsylvania, where we have contracted with Life Sciences of Pennsylvania for access to shared office and working space during normal business hours.

This arrangement is on a month-to-month basis and is cancellable at any time.

LEGAL PROCEEDINGS

From time to time, we may become a party to various legal proceedings and complaints arising in the ordinary course of business.

To our knowledge, we are not currently a party to any actual or threatened material legal proceedings.

MINE SAFETY DISCLOSURES

Not applicable.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments