CV Sciences, Inc.

Risk Management and Strategy

We continue to assess and improve the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. We value the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security law. Our cybersecurity risks, and the controls designed to mitigate those risks, are included as a part of our overall risk management governance which is reviewed at least annually by our board of directors.

Our IT networks and related systems are critical to the operations of our business and essential to our ability to successfully perform day-to-day operations. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a component of our internal control system. Cybersecurity awareness, including specific topics related to social engineering and email fraud, are included in our employee handbook. We have processes and controls, in particular with respect to our financial and reporting technology, to prevent and minimize cybersecurity risks and attacks. We rely on industry-standard third-party software and vendors for our core systems, including data storage, analysis and backup.

Governance

Our board of directors is responsible for overseeing our cyber security risk management and strategy. Our AVP Logistics, Systems & IT is responsible for managing our outside technology services and has over 10 years of relevant experience. The AVP Logistics, Systems & IT reports directly to our Chief Financial Officer and reviews cybersecurity assessments withour Chief Financial Officer on a regular basis. Our Chief Financial Officer is responsible for escalating any cybersecurity matters as appropriate. The Audit Committee of our board of directors will regularly review cybersecurity requirements and risks on a quarterly basis.

While we believe we have implemented appropriate measures and controls for our business, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. To date, to our knowledge, there have been no incidents materially affecting the Company, but a material incident could result in disruption of critical IT networks and systems, impeding our operations, release of confidential information, and/or corruption of data. Such an incident could damage our reputation, brands, future sales and could expose us to potential liability.