NATIONAL HEALTHCARE CORP

The Company Board of Directors takes seriously both the responsibility to guard against cyber security threats and its compliance with the SEC Cyber Security regulations adopted on July 26, 2023. The Board of Directors receives an annual cyber security update from the Chief Information Officer (CIO) and Chief Information Security Officer (CISO) and, accordingly, received its customary detailed briefing from the CIO and CISO at its August 8, 2024 meeting.

At its November 2, 2023 meeting, the Board determined that the CIO will report relevant information regarding cyber security threats and risks to the Certification Committee, which meets quarterly and is chaired by a designee of the Audit Committee and is discussed further on page 11 of this Proxy Statement. The Chairman will then elevate any matters of significance, as warranted, to the full Audit Committee. The Audit Committee can then further elevate matters to the full Board of Directors, as necessary or required.

The Company has adopted processes to identify, assess, and manage material risks from cyber security threats. It has also adopted processes to evaluate material effects, or reasonably likely material effects, of risks from cyber security threats and previous cyber security incidents. The Company has adopted processes to assess and evaluate the necessity of any material disclosures required on Form 8-K.

The Company’s CIO has more than 40 years’ experience in information technology and cyber matters in healthcare. The Company’s CISO has 27 years in cyber security matters and has served as the Company’s CISO for 7 years. The Company has an Incident Response Planning Committee who will meet, as necessary, to address, identify, and manage any material cyber security threats. The Company also has a crisis team consisting of the Compliance Officer, General Counsel, Chief Financial Officer, Human Resources Officer, Facilities Management Administrator, and the Network Systems Administrator, which will be engaged if an event poses a significant risk to the Company.

The Company and the Board of Directors are committed to remaining updated on evolving cyber security regulations and best practices, as well as the development and amendment of processes to meet these changing demands.