Item 1B. Unresolved Staff Comments
ITEM
1B. UNRESOLVED STAFF COMMENTS
Not
applicable.
ITEM
1C. CYBERSECURITY
Cybersecurity
Risk Management and Strategy
Sharplink
has implemented a cybersecurity risk management framework designed to identify, assess, manage and mitigate reasonably foreseeable cybersecurity
risks to its information systems, applications, networks and data (collectively, “Company Assets”). This framework is supported
by formal policies, including an Amended and Restated Cybersecurity Policy and a Corporate Incident Response Plan (“CIRP”),
and is integrated into the Company’s broader enterprise risk management and governance processes.
The
Company’s cybersecurity risk management framework is designed to address threats arising from human error, malicious attacks, system
malfunctions, and third-party dependencies. Key components of the framework include risk assessment and incident severity classification,
defined escalation and response procedures, access controls, employee training requirements, vendor due diligence practices, and post-incident
review and remediation processes.
The
Company routinely evaluates cybersecurity risks that could result in unauthorized access to, disruption of, or misuse of Company Assets,
including risks that could compromise the confidentiality, integrity, or availability of data. Cybersecurity risks are assessed in the
context of the Company’s business operations, including its digital asset treasury activities and legacy affiliate marketing operations,
and are considered alongside other operational and compliance risks.
Incident
Response and Recovery
Sharplink
maintains a formal Corporate Incident Response Plan that establishes a structured, step-by-step approach to responding to cybersecurity
incidents, including identification, containment, eradication, recovery, and post-incident review. Upon identification of an actual or
suspected cybersecurity incident, the Chief Financial Officer (“CFO”) conducts an initial assessment and assigns a severity
rating. Depending on the severity, incidents are escalated to a Security Incident Response Team (“SIRT”) assembled by the
CFO, which may include representatives from management, legal, accounting, information technology and other relevant functions.
The
SIRT is responsible for coordinating response actions, preserving forensic evidence, assessing potential business and regulatory impacts,
and evaluating whether an incident may be material for disclosure purposes. Material incidents are escalated to the Audit Committee of
the Board of Directors and disclosed as required under applicable SEC rules.
Beginning
in 2026, the Company plans to conduct periodic tabletop exercises simulating cybersecurity incidents to evaluate the effectiveness of
its incident response procedures and to enhance readiness across management and key personnel.
Third-Party
Risk Management
The
Company uses third-party service providers and technology products in the ordinary course of business. Sharplink conducts due diligence
on third-party vendors, particularly those with access to Company Assets or confidential data and requires vendors to implement appropriate
cybersecurity safeguards and to promptly report incidents that could affect the Company’s systems or data. While the Company does
not currently outsource its core cybersecurity risk management function, it may engage third-party cybersecurity service providers in
the future to support or enhance its program.
51
Table of Contents
Employee
Training and Controls
Sharplink
requires employees, contractors, and other authorized users of Company Assets to comply with cybersecurity controls and responsibilities
outlined in its Cybersecurity Policy. These include requirements relating to password management, multi-factor authentication, device
security, secure data transfers, incident reporting, and remote work safeguards. Employees are required to report actual or suspected
cybersecurity incidents immediately to the CFO.
Beginning
in 2026, the Company plans to implement a formal cybersecurity awareness training program for all employees, including training on phishing
prevention, incident reporting, and secure handling of confidential data. Training effectiveness will be evaluated periodically and updated
as necessary to reflect evolving risks and regulatory expectations.
Cybersecurity
Governance
Oversight
of cybersecurity risk is a shared responsibility among management and the Board of Directors. The Audit Committee of the Board provides
primary oversight of cybersecurity risks and receives regular updates from management regarding cybersecurity risk assessments, incidents,
response activities, and compliance with applicable disclosure requirements . The CFO is responsible for the day-to-day administration
of the Company’s cybersecurity program, including implementation of controls, incident response coordination, and reporting to
the Audit Committee
Cybersecurity
Risks and Incidents
The
Company has not experienced a cybersecurity incident that it has determined to be material as of the date of this report. However, like
other companies that rely on information systems and digital infrastructure, Sharplink has experienced cybersecurity incidents in the
past. Cybersecurity threats are continually evolving, and there can be no assurance that future incidents will not occur or that they
will not have a material impact on the Company’s business, financial condition, results of operations, or reputation.
For
additional information regarding cybersecurity risks, see Item 1A, “Risk Factors,” including the risk factor titled “ Despite
our security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee
error, malfeasance or other disruptions. ”
52
Table of Contents