KOSS CORP

SECURITY

Risk Management and Strategy

The Company maintains policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and hasintegrated these processes into the overall risk management processes. The Company continued to enhance its cybersecurity program through investments in security technologies, employee awareness, governance, and third-party oversight. The Company has programs in place intended to address and mitigate the cybersecurity risks that could adversely impact customers and/or reputation and lead to financial losses from remediation actions, loss of business, production downtimes and operational delays. These programs include regular monitoring of outside threats, continuous updating of software to mitigate risk, implementation of a formal policy related to employees that access corporate systems from personal devices, a simplification of infrastructure to minimize servers and migration of business-critical systems, including the Company’s Enterprise Resource Planning (ERP) system, to Tier-1 cloud service providers. Enhancements have also been made to endpoint protection and remote access protocols, including enhanced encryption, two-factor authentication (2FA) and real-time threat monitoring.

Annual vulnerability assessments and penetration testing, as well as periodic web application and internal network scanning, are performed bythird party service providers as directed by the Company’s Managed Service Provider (“MSP”). The results of these tests are shared with the CFO by the MSP. We have processes in place to evaluate the potential risks from cybersecurity threats associated with our use ofthird-party service providers that have access to our data, including a review process for such providers’ cybersecurity practices, risk assessments, contractual requirement and system monitoring. The Company also partners with a breach protection platform to provide ongoing, self-guided cybersecurity training to its employees to reduce risk from phishing, social engineering and password-related attacks.

The Company hasnot been impacted by any previous cybersecurity incidents that would materially affect business operations, customer relationships or financial conditions.

Governance

Cybersecurity continues to be a critical component of corporate governance and enterprise risk oversight at the Company. Management, in coordination with the Company’s MSP, is responsible for day-to-day cybersecurity operations and identifying and assessing risks on an ongoing basis to ensure that the Company’s policies and procedures are functioning as designed to protect the Company’s information systems from potential cybersecurity threats. Management and the Board of Directors are provided periodic updates on the Company’s cybersecurity programs, including emerging cybersecurity threats, overall system health, results of vulnerability assessments and penetration testing, status of remediation efforts, third-party security assessments, cybersecurity awareness training metrics, business continuity and disaster recovery readiness and significant cybersecurity events or incidents, if any. Cybersecurity policies and processes are reviewed annually with the Board of Directors, which serves in an oversight role as a whole as part of its broader enterprise risk management responsibilities. In addition, the Audit Committee and the Board consider risk-related matters on an ongoing basis in connection with deliberations regarding specific transactions and issues and would benotified immediately of any cybersecurity incidents.

ITEM 2. PROPERTIES