SUI Group Holdings Ltd. 10-K

ITEM 1B. UNRESOLVED STAFF COMMENTS None. ITEM 1C. CYBERSECURITY Our risk management strategy for cybersecurity generally includes: · Assessment : We periodically assess our risks relating to cybersecurity threats, including risks relating to our reliance on third parties, as part of our overall risk-management efforts and program. In so doing, we consider the likelihood and impact that could result from the manifestation of such risks, together with the sufficiency of existing policies, procedures, systems, and safeguards to manage such risks. · Identification : We aim to proactively identify the manners in which our business could be materially impacted by cybersecurity risks . · Management : If deemed appropriate, we would design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures . 44 Table of Contents We presently do not engage third parties to assist us with the assessment, identification or management of cybersecurity risks, or in evaluating the effectiveness of our existing approaches, nor do we have formal processes assessing, identifying, and managing material risks from cybersecurity threats, including risks associated with our use of third-party service providers. We are unaware of any material cybersecurity breaches during the year ended December 31, 2025. Our criteria for determining the materiality of cybersecurity incidents include assessing potential or actual financial impacts, reputational damage, and operational disruptions. The Audit Committee is the governance body involved in, and ultimately responsible for, cybersecurity oversight. Members of the Audit Committee generally coordinate with our Chief Financial Officer in this regard, with management alerting the committee members to any specific concerns of which management may be aware. In the event of a cybersecurity concern or event, our Chief Financial Officer would report the event or his or her concerns to our Audit Committee and full Board, as well as outside legal counsel. None of our directors on the Audit Committee nor our Chief Financial Officer have particular experience in cybersecurity matters, nor are there formal processes in place by which such persons would monitor the prevention, detection, mitigation and remediation of cybersecurity incidents.