KOSS CORP

SECURITY

Risk Management and Strategy

The Company maintains policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and hasintegrated these processes into the overall risk management processes. The Company has programs in place intended to address and mitigate the cybersecurity risks that could adversely impact customers and/or reputation and lead to financial losses from remediation actions, loss of business, production downtimes and operational delays. These programs include regular monitoring of outside threats, continuous updating of software to mitigate risk, implementation of a formal policy related to employees that access corporate systems from personal devices, a simplification of infrastructure to minimize servers and migration of business-critical systems, including the Company’s ERP system, to Tier-1 cloud service providers. Enhancements have also been made to endpoint protection and remote access protocols, including enhanced encryption, two-factor authentication (2FA) and real-time threat monitoring.

Annual vulnerability assessments and penetration testing, as well as periodic web application and internal network scanning, are performed bythird party service providers as directed by the Company’s Managed Service Provider (“MSP”). The results of these tests are shared with the CFO by the MSP. We have processes in place to evaluate the potential risks from cybersecurity threats associated with our use ofthird-party service providers that have access to our data, including a review process for such providers’ cybersecurity practices, risk assessments, contractual requirement and system monitoring. The Company also partners with a breach protection platform to provide ongoing, self-guided cybersecurity training to its employees to reduce risk from phishing, social engineering and password-related attacks.

The Company hasnot been impacted by any previous cybersecurity incidents that would materially affect business operations, customer relationships or financial conditions.

Governance

Cybersecurity remains a critical component of corporate governance at the Company. The Company’s MSP is responsible for identifying and assessing risks on an ongoing basis to ensure that the Company’s policies and procedures are functioning as designed to protect the Company’s information systems from potential cybersecurity threats. Management is provided regular updates on the Company’s cybersecurity programs, training metrics, system health status and material cybersecurity risk and mitigation strategies, along with any necessary enhancements to those programs. Cybersecurity policies and processes are reviewed annually with the Board of Directors, which serves in an oversight role as a whole. In addition, the Audit Committee and the Board consider risk-related matters on an ongoing basis in connection with deliberations regarding specific transactions and issues and would benotified immediately of any cybersecurity incidents.

ITEM 2. PROPERTIES