What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-09 compared with 2025-03-14 · 67 added, 24 removed, 2 unchanged (98% of the section changed)

UNRESOLVED STAFF COMMENTS

Not applicable.

CYBERSECURITY

SharpLink has established policies and processes for assessing, identifying and managing material cybersecurity risks, and have integrated these processes into our overall risk-management processes.

We have also established policies and processes for managing and responding to material cybersecurity incidents.

We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them.

We devote appropriate resources and designate members of our management, including our Chief Executive Officer and Chief Financial Officer, to manage the risk assessment and mitigation process.

Employees are provided specific guidance to mitigate the risk of a cybersecurity attack.

This guidance includes safeguards over confidential data, being aware of suspicious emails, choosing and changing passwords, protection of Company issued and use of personal devices, managing large data transfers and use of VPNs when outside the office.

Employees are directed to immediately contact either the Chief Financial Officer and Vice President of Affiliate Marketing if they encounter any suspicious activity.

We also require appropriate third -party service providers to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect our company.

We oversee and identify risks from cybersecurity threats associated with our use of service providers through an onboarding vendor risk management program, including an inherent risk assessment.

We have not, to date, experienced a cybersecurity incident which was determined to be material, although, like any technology provider, we have experienced incidents in the past.

For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, “Risk Factors,” in this Annual Report on Form 10-K under the heading “Despite our security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions.

Any such breach could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, and regulatory penalties, disruption of our operations and the services we provide to clients, damage to our reputation, and a loss of confidence in our products and services, each of which could adversely affect our business, financial condition, results of operations and prospects,” which should be read in conjunction with the information above.

Cybersecurity Governance

One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats.

Our Board of Directors is responsible for monitoring and assessing our strategic risk exposure, and our executive officers are responsible for day-to-day management of the material risks we face.

Our Board of Directors administers its cybersecurity risk-oversight function as a whole, as well as through the Audit Committee.

Our Chief Financial Officer and Vice President of Affiliate Marketing are responsible for assessing and managing material risks from cybersecurity threats, as well as managing, responding to and reporting material cyber incidents if any occur.

They will provide periodic briefings, as required, to the Audit Committee and to the Board of Directors about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics.

In addition, our policies for managing and responding to cybersecurity incidents include procedures for appropriate escalations to our Audit Committee Chair.

Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks.

To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future.

See the section entitled “Risk Factors” included elsewhere in this Annual Report for further information.

We continuously work to enhance our cybersecurity risk management program.

Cybersecurity

Risk Management and Strategy

has implemented a cybersecurity risk management framework designed to identify, assess, manage and mitigate reasonably foreseeable cybersecurity

risks to its information systems, applications, networks and data (collectively, “Company Assets”).

This framework is supported

by formal policies, including an Amended and Restated Cybersecurity Policy and a Corporate Incident Response Plan (“CIRP”),

and is integrated into the Company’s broader enterprise risk management and governance processes.

Company’s cybersecurity risk management framework is designed to address threats arising from human error, malicious attacks, system

malfunctions, and third-party dependencies.

Key components of the framework include risk assessment and incident severity classification,

defined escalation and response procedures, access controls, employee training requirements, vendor due diligence practices, and post-incident

review and remediation processes.

Company routinely evaluates cybersecurity risks that could result in unauthorized access to, disruption of, or misuse of Company Assets,

including risks that could compromise the confidentiality, integrity, or availability of data.

Cybersecurity risks are assessed in the

context of the Company’s business operations, including its digital asset treasury activities and legacy affiliate marketing operations,

and are considered alongside other operational and compliance risks.

Response and Recovery

maintains a formal Corporate Incident Response Plan that establishes a structured, step-by-step approach to responding to cybersecurity

incidents, including identification, containment, eradication, recovery, and post-incident review.

Upon identification of an actual or

suspected cybersecurity incident, the Chief Financial Officer (“CFO”) conducts an initial assessment and assigns a severity

Depending on the severity, incidents are escalated to a Security Incident Response Team (“SIRT”) assembled by the

CFO, which may include representatives from management, legal, accounting, information technology and other relevant functions.

SIRT is responsible for coordinating response actions, preserving forensic evidence, assessing potential business and regulatory impacts,

and evaluating whether an incident may be material for disclosure purposes.

Material incidents are escalated to the Audit Committee of

the Board of Directors and disclosed as required under applicable SEC rules.

in 2026, the Company plans to conduct periodic tabletop exercises simulating cybersecurity incidents to evaluate the effectiveness of

its incident response procedures and to enhance readiness across management and key personnel.

Risk Management

Company uses third-party service providers and technology products in the ordinary course of business.

Sharplink conducts due diligence

on third-party vendors, particularly those with access to Company Assets or confidential data and requires vendors to implement appropriate

cybersecurity safeguards and to promptly report incidents that could affect the Company’s systems or data.

While the Company does

not currently outsource its core cybersecurity risk management function, it may engage third-party cybersecurity service providers in

the future to support or enhance its program.

Training and Controls

requires employees, contractors, and other authorized users of Company Assets to comply with cybersecurity controls and responsibilities

outlined in its Cybersecurity Policy.

These include requirements relating to password management, multi-factor authentication, device

security, secure data transfers, incident reporting, and remote work safeguards.

Employees are required to report actual or suspected

cybersecurity incidents immediately to the CFO.

in 2026, the Company plans to implement a formal cybersecurity awareness training program for all employees, including training on phishing

prevention, incident reporting, and secure handling of confidential data.

Training effectiveness will be evaluated periodically and updated

as necessary to reflect evolving risks and regulatory expectations.

Cybersecurity

of cybersecurity risk is a shared responsibility among management and the Board of Directors.

The Audit Committee of the Board provides

primary oversight of cybersecurity risks and receives regular updates from management regarding cybersecurity risk assessments, incidents,

response activities, and compliance with applicable disclosure requirements .

The CFO is responsible for the day-to-day administration

of the Company’s cybersecurity program, including implementation of controls, incident response coordination, and reporting to

the Audit Committee

Cybersecurity

Risks and Incidents

Company has not experienced a cybersecurity incident that it has determined to be material as of the date of this report.

However, like

other companies that rely on information systems and digital infrastructure, Sharplink has experienced cybersecurity incidents in the

Cybersecurity threats are continually evolving, and there can be no assurance that future incidents will not occur or that they

will not have a material impact on the Company’s business, financial condition, results of operations, or reputation.

additional information regarding cybersecurity risks, see Item 1A, “Risk Factors,” including the risk factor titled “ Despite

our security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee

error, malfeasance or other disruptions.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments