Item 1B. Unresolved Staff Comments
ITEM 1B: UNRESOLVED STAFF COMMENTS
As a smaller reporting company,
we are not required to provide this information.
ITEM 1C: CYBERSECURITY
Risk Management and Strategy
We maintain a cybersecurity
risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. This program is integrated
into our broader enterprise risk management processes and addresses risks to our corporate information technology (“IT”) environment,
including systems, networks, hardware, software, data, personnel and operational processes.
Our cybersecurity program
incorporates recognized industry standards and best practices, including alignment with the National Institute of Standards and Technology
(“NIST”) Cybersecurity Framework (“CSF”). We also consider applicable data protection and privacy regulations
in jurisdictions in which we operate. We engage independent third-party specialists to perform periodic assessments of our cybersecurity
program, including evaluations against the NIST CSF and vulnerability testing. These assessments are designed to identify, quantify and
categorize cyber risks and potential vulnerabilities. Based on the results of such assessments, management develops and implements risk
mitigation and remediation plans, as appropriate.
We maintain policies and
procedures governing areas such as information security, acceptable use, identity and access management, onboarding and offboarding,
change and configuration management, risk management, data protection, backup and recovery, and incident response. We also utilize third-party
cybersecurity service providers and technology solutions to support our cybersecurity operations, including services related to:
● asset inventory management;
● network security, firewalls and endpoint protection;
● intrusion detection, monitoring and automated
alerting;
● identity and privileged access management;
● vulnerability scanning and periodic testing;
● employee cybersecurity awareness training;
● encryption and data protection protocols;
● cloud infrastructure security;
● incident response support; and
● cybersecurity advisory and remediation services.
47
Because we rely on third-party
vendors, cloud providers and service partners in our operations, we maintain a third-party risk management process designed to assess
and monitor cybersecurity risks associated with critical service providers. This includes vendor due diligence during onboarding, review
of available independent audit reports (such as SOC reports, where applicable), evaluation of contractual security provisions, and ongoing
monitoring of vendor performance and risk posture.
Despite these efforts, we
cannot eliminate all cybersecurity risks. The threat landscape continues to evolve, and our systems and those of our third-party providers
may be vulnerable to unauthorized access, disruption or compromise.
Governance
Management Oversight
Management is responsible for
the day-to-day oversight and administration of our cybersecurity risk management program. The Company utilizes a senior technology advisor
as a consultant with primary responsibility for cybersecurity oversight. This individual has extensive experience in information technology
and cybersecurity.
The senior technology advisor,
together with internal personnel and external cybersecurity service providers, oversees the prevention, detection, mitigation and remediation
of cybersecurity incidents. Management receives information from internal monitoring tools, third-party service providers, vulnerability
assessments, and threat intelligence sources, including governmental and private sector resources.
We maintain an incident response
plan designed to provide a structured framework for identifying, escalating, investigating and responding to cybersecurity incidents,
including processes to assess materiality and comply with applicable legal and regulatory reporting requirements.
Board Oversight
The Audit Committee of our
Board of Directors oversees cybersecurity risk exposure and management’s efforts to monitor and mitigate cybersecurity risks. Management
and, as appropriate, external cybersecurity advisors provide periodic briefings to the Audit Committee regarding :
● the effectiveness and status of our cybersecurity
program;
● significant cybersecurity risks and vulnerabilities;
● emerging threat developments; and
● cybersecurity incidents, if any, and related
response efforts.
While the Board retains ultimate
oversight responsibility for cybersecurity risk as part of its broader enterprise risk management function, it has delegated primary committee-level
oversight to the Audit Committee, which reports to the Board on these matters.
Cybersecurity Risks and Incidents
We face risks from cybersecurity
threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation.
These risks include, among others, ransomware attacks, business email compromise, supply chain attacks, insider threats, and data breaches
affecting sensitive business, customer or employee information.
To date, we have not identified
any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results
of operations or financial condition. However, future incidents could occur, and there can be no assurance that our cybersecurity risk
management measures will prevent or mitigate all potential incidents.
In addition, evolving cybersecurity
and data protection regulations may impose additional compliance, reporting and governance obligations on us, potentially increasing our
costs and exposure to liability.
For additional information
regarding cybersecurity-related risks, see Item 1A. “Risk Factors.”
48