ZeroStack Corp.

When a potential incident is first detected, the matter is communicated to the CFO as soon as possible so that the Company may work quickly and diligently to re-secure its systems and work to minimize any damage and further risk to it as a result thereof. Upon receipt, the CFO is charged with immediately investigating the report to ensure the existence or possibility of a cyberattack and employs every effort toward thwarting or limiting a cyberattack, if ongoing, to the fullest extent possible to avoid further damage and exposure to the Company and its systems. As soon as an immediate threat or cyberattack is sufficiently contained to permit it, the CFO notifies the Chief Executive Officer of the situation, who is charged to direct the CFO on any additional or special measures to be taken, including but not limited to a Company-wide alert or directive, which the CFO must follow/implement without delay. Questions or concerns relating to a directive's validity may be confirmed only by the CFO, or a designated executive officer, through a known form of contact not questionably in breach. As soon as reasonably practicable after response efforts commence, the designated executive officers are required to notify the Chair of the Audit Committee of the situation and to thereafter keep the Chair apprised of all material developments, who may escalate the matter to the full Board in the Chair's discretion. Our emergency response plan also sets forth our procedures for a transition back into normal work practices, as well as security incident investigation, remediation procedures, security incident recovery and mandatory reporting.

Our Board of Directors oversees the Company's aggregate risk profile and risk management process. The Board of Directors administers this oversight function with respect to cybersecurity risks through the Audit Committee, which is responsible for overseeing the Company's cybersecurity risk management processes, including the steps our management has taken to monitor and control cybersecurity risks.

The Company leases a 14,280 sq. ft. facility in Pompano Beach, Florida where High Roller’s manufacturing operations and Just CBD’s and Vessel’s distribution, wholesale (B2B), and direct-to-consumer (D2C) orders are fulfilled and shipped worldwide. We currently lease this facility for $20,000 a month, pursuant to a lease agreement that expires in February 2029. The lease contains an option to extend in one 5-year increment.

Just CBD leases 4,184 sq. ft. of office space in Fort Lauderdale, Florida. We currently lease this facility for $8,000 a month, pursuant to a lease agreement that expires in March 2028.

TruHC leases a 6,956 square foot EU-GMP certified facility for warehouse, laboratory and office space in Hamburg, Germany. The monthly lease payments are €8,800 per month, pursuant to a lease agreement that expires in April 2025. The lease contains options to extend the lease in 5-year increments. The Company is reasonably certain of renewing this lease for another 5 years.

AV leases a 7,169 square foot facility for warehouse and office space in Brisbane, Australia. The monthly lease payments are A$7,700 per month, pursuant to a lease agreement that expires in April 2027. The lease contains two options to extend for 5-year increments.

Phatebo leases a 7,300 square foot pharmaceutical storage and logistic center certified under Good Distribution Practices located in Hilzingen, Germany. The monthly lease payments are €3,600 per month and the lease expired on February 29, 2024. The Company extended the lease for one year through February 29, 2025 after which Phatebo entered into a similar lease agreement in the same city.

Our Vessel operations were previously headquartered in Carlsbad, California, where we lease 12,000 sq. ft. of office and warehouse space for $24,000 a month, pursuant to a lease agreement that expires in August 2027. During the fourth quarter of 2022, we made the decision to shift all operations relating to Vessel and its business to our facility in Fort Lauderdale. This property has been sublet to third parties for a total of $23,000 per month, pursuant to a sublease agreement that expires in June 2027.