What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-03-31 compared with 2024-05-10 · 44 added, 41 removed, 46 unchanged (65% of the section changed)

19 unchanged sentences

cybersecurity program, with strategic direction aligned to the following core functions:

We continuously assess our systems, data, and vulnerabilities to understand our cybersecurity

risk profile.

We enlist third-party cybersecurity consultants and vendors to support our cybersecurity efforts, tapping into their specialized

knowledge and insights to assess and test the effectiveness of our cybersecurity program and to inform decision-making on detection and

the deployment of defense measures, commensurate with our risk profile.

As part of our Vendor Risk Management program, we periodically

examine our third-party providers’ and vendors’ risks by reviewing the content and enforcement of their cybersecurity standards,

policies, and procedures.

We also employ real-time monitoring to detect suspicious activity in order to minimize risks associated with

data breaches or other security incidents that may arise from third-party sources or insider threats.

Siebert 2023 Form-10K 16

We implement technical safeguards, including access controls, data encryption, network security,

endpoint protection, and regular vulnerability patching.

Our employee training and awareness programs are designed to improve cybersecurity

awareness throughout the organization, and we are committed to educating our employees on security best practices coupled with industry-relevant

context such as anti-money laundering, social engineering, and fraud.

We employ automated monitoring tools and operational procedures for timely detection of anomalies,

cybersecurity events, and potential cybersecurity incidents.

We have a Security Incident Response Plan, supported by operational procedures, to help guide

response teams to prioritize and execute containment, investigation, eradication, and communication for confirmed cybersecurity incidents

Our Business Continuity & Disaster Recovery Plan is in place to enable response to significant

business disruptions and timely restoration of systems, data, and business operations following confirmed cybersecurity incidents or disaster

We continuously assess our systems, data, and vulnerabilities

to understand our cybersecurity risk profile.

We enlist third-party cybersecurity consultants and vendors to support our cybersecurity

efforts, tapping into their specialized knowledge and insights to assess and test the effectiveness of our cybersecurity program and

to inform decision-making on detection and the deployment of defense measures, commensurate with our risk profile.

As part of our Vendor

Risk Management program, we periodically examine our third-party providers’ and vendors’ risks by reviewing the content and

enforcement of their cybersecurity standards, policies, and procedures.

We also employ real-time monitoring to detect suspicious activity

in order to minimize risks associated with data breaches or other security incidents that may arise from third-party sources or insider

We implement technical safeguards, including access

controls, data encryption, network security, endpoint protection, and regular vulnerability patching.

Our employee training and awareness

programs are designed to improve cybersecurity awareness throughout the organization, and we are committed to educating our employees

on security best practices in an industry-relevant context, relating to topics such as anti-money laundering, social engineering, and

fraud prevention.

We employ automated monitoring tools and operational

procedures for timely detection of anomalies, cybersecurity events, and potential cybersecurity incidents.

We have a Security Incident Response Plan, which

is supported by operational procedures, to help guide response teams to prioritize and execute containment, investigation, eradication,

and communication for confirmed cybersecurity incidents or breaches.

Our Business Continuity & Disaster Recovery Plan

is in place to enable response to significant business disruptions and timely restoration of systems, data, and business operations following

confirmed cybersecurity incidents or disaster scenarios.

We also incorporate industry-relevant

1 unchanged sentence

● Regulatory Compliance:

We integrate cybersecurity controls that address requirements of FINRA, SEC, and

other relevant regulatory bodies.

We integrate cybersecurity controls

that address requirements of FINRA, SEC, and other relevant regulatory bodies.

● Financial Transaction Security:

We employ specific fraud detection and prevention measures to protect

client funds and trading operations.

We employ specific fraud detection

and prevention measures to protect client funds and trading operations.

● Market Integrity:

We strive to safeguard systems and data that contribute to fair and efficient markets.

However, this does not mean

that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help

us identify, assess, and manage cybersecurity risks relevant to our business.

We strive to safeguard systems and data

that contribute to fair and efficient markets.

This does not mean that we

meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify,

assess, and manage cybersecurity risks relevant to our business.

Our cybersecurity program

2 unchanged sentences

As of the filing of this Report,

we are not aware of any cybersecurity incidents that have occurred since the beginning of 2023 that have materially affected, or are reasonably

likely to materially affect us, including our business strategy, results of operations or financial condition.

We acknowledge that we

cannot eliminate all security risks within our organization, and we cannot guarantee that any undetected cybersecurity incidents have

we are not aware of any cybersecurity incidents that occurred during the fiscal year ended December 31, 2024 that have materially affected,

or are reasonably likely to materially affect us, including with respect to our business strategy, results of operations or financial

We acknowledge that we cannot eliminate all cybersecurity risks within our organization, and we cannot guarantee that any undetected

cybersecurity incidents have occurred.

For additional information about these risks, see Part I, Item 1A, - Risk Factors of this Report.

8 unchanged sentences

Our Chief Technology Officer (“CTO”), whose experience includes approximately

25 years of managing technology strategy and programs at public financial services organizations, also has key responsibilities and input

into the management of our cybersecurity risks from a technology perspective.

In order to monitor the prevention, detection, mitigation

and remediation of cybersecurity incidents, our CISO, CTO, and respective technology and operations teams monitor the cybersecurity threat

landscape, plan and implement security controls, and detect and respond to cybersecurity threats and incidents using a combination of

security tooling, automated systems, and manual processes.

25 years of managing technology strategy and programs at public financial services organizations.

The CTO also has key responsibilities

and provides input into the management of our cybersecurity risks from a technology perspective.

In order to monitor the prevention, detection,

mitigation and remediation of cybersecurity incidents, our CISO, CTO, and respective technology and operations teams monitor the cybersecurity

threat landscape, plan and implement security controls, and detect and respond to cybersecurity threats and incidents using a combination

of security tooling, automated systems, and manual processes.

Our Board of Directors, through

5 unchanged sentences

incidents and breaches, and cybersecurity-related matters involving third parties or vendors.

Siebert 2023 Form-10K 17

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments