Flora Growth Corp

We established an interdisciplinary team to monitor and assess cybersecurity risks on an ongoing basis, which is led by our Chief Financial Officer ("CFO"). It is a cross-departmental team that consists of finance and operations personnel, as well as third party legal and information technology ("IT") consultants, with all significant implementation efforts executed by our IT consultant, who has extensive experience in IT, enterprise security and cyber risk management. This team is in charge of developing, maintaining and measuring compliance with the cyber risk management program, and dedicates significant resources to cybersecurity and risk management processes to adapt to the ever-changing cybersecurity landscape and to respond to emerging threats in a timely and effective manner.

When a potential incident is first detected, the matter is communicated to the CFO as soon as possible so that the Company may work quickly and diligently to re-secure its systems and work to minimize any damage and further risk to it as a result thereof. Upon receipt, the CFO is charged with immediately investigating the report to ensure the existence or possibility of a cyberattack and employs every effort toward thwarting or limiting a cyberattack, if ongoing, to the fullest extent possible to avoid further damage and exposure to the Company and its systems. As soon as an immediate threat or cyberattack is sufficiently contained to permit it, the CFO notifies the Chief Executive Officer of the situation, who is charged to direct the CFO on any additional or special measures to be taken, including but not limited to a Company-wide alert or directive, which the CFO must follow/implement without delay. Questions or concerns relating to a directive's validity may be confirmed only by the CFO, or a designated executive officer, through a known form of contact not questionably in breach. As soon as reasonably practicable after response efforts commence, the designated executive officers are required to notify the Chair of the Audit Committee of the situation and to thereafter keep the Chair apprised of all material developments, who may escalate the matter to the full Board in the Chair's discretion. Our emergency response plan also sets forth our procedures for a transition back into normal work practices, as well as security incident investigation, remediation procedures, security incident recovery and mandatory reporting.

Our Board of Directors oversees the Company's aggregate risk profile and risk management process. The Board of Directors administers this oversight function with respect to cybersecurity risks through the Audit Committee, which is responsible for overseeing the Company's cybersecurity risk management processes, including the steps our management has taken to monitor and control cybersecurity risks.

We lease a 24,425 sq. ft. facility in Fort Lauderdale, Florida where Just CBD's and Vessel's distribution, wholesale (B2B), and direct-to-consumer (D2C) orders are fulfilled and shipped worldwide. We currently lease this facility for $30,787 a month, pursuant to a lease agreement that expires in April 2024.

We lease a 13,483 sq. ft. facility in Fort Lauderdale, Florida where Flora Lab 3 conducts its manufacturing operations. We currently lease this facility for $41,400 a month, pursuant to a lease agreement that expires in June 2024.

Phatebo leases a 7,300 square foot pharmaceutical storage and logistic center certified under Good Distribution Practices located in Hilzingen, Germany. The monthly lease payments are €3,600 per month and the lease expires on February 29, 2024.

Our Vessel operations were previously headquartered in Carlsbad, California, where we lease 12,000 sq. ft. of office and warehouse space for $24,000 a month, pursuant to a lease agreement that expires in June 2027. During the fourth quarter of 2022, we made the decision to shift all operations relating to Vessel and its business to our facility in Fort Lauderdale. This property has been sublet to third parties for a total of $23,000 per month, pursuant to a sublease agreement that expires in June 2027.