Lifeloc Technologies, Inc

Cybersecurity Risk Management and Strategy

We rely on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software for threat protection and malware detection. Such third party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate. Based on the results of our risk assessments, if deemed necessary or appropriate, we take steps to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. These cybersecurity risk management processes are integrated into our overall enterprise risk management program.

We intend to work with outside counsel and third party service providers to further develop our expertise, processes and procedures with respect to cybersecurity protection and our response plan.

To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially affected our business strategy, results of operations, or financial condition, though we cannot provide assurance that they will not be materially affected in the future.

Cybersecurity Governance

Our Audit Committee of our Board of Directors is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Members of management provide periodic briefings to the Audit Committee of our Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure.

Our CEO is the member of management primarily responsible for assessing and managing our cybersecurity risk management program and for informing the Audit Committee about cybersecurity risks and incidents. He works directly with our third-party IT service providers to evaluate the effectiveness of our cybersecurity safeguards and to oversee our incident response processes. Our management team has extensive experience managing operational and business risks at the Company, including risks arising from cybersecurity threats. Because we rely substantially on third-party providers for the technical aspects of our cybersecurity program, we do not maintain a dedicated in-house cybersecurity function, and the relevant expertise for managing cybersecurity risks at the Company is provided principally through those third-party relationships rather than through specialized credentials held by members of management.

In the event of a cybersecurity incident, our incident response plan is designed to escalate incidents to members of management, and if appropriate to the Audit Committee, depending on the severity and circumstances of the incident.