Star Equity Holdings, Inc.

Risk Management and Strategy

We identify and address cybersecurity threats and risks related to our business using an interdisciplinary approach that includes assessments primarily by our management, IT team and legal department. To defend against, detect and respond to

• 19 - cybersecurity incidents, we employ amulti-layered approach that has been integrated into our overall risk management systems and processes which includes, among other things: conducting proactive privacy and cybersecurity reviews of systems and applications, auditing applicable data policies, conducting employee training, monitoring emerging laws and regulations related to data protection and information security and continuously improving controls and implementing appropriate changes. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

The cybersecurity-control principles that form the basis of our cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework. Our management performs an annual review ofthird-party service providers’ SOC reports to verify appropriate controls are in place. Our Business Services segment undergoes an annual audit to ensure compliance with ISO 27001 controls.

In 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon. Despite our ongoing efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

Additionally, cybersecurity risks and threats that could have a material impact on the Company are discussed further in the Item 1A Risk Factors. Those sections of Item 1A should be read in conjunction with this Item 1C.

Cybersecurity Governance

Cybersecurity is an important part of our risk management processes and is an area of focus for our board of directors and management. Our board of directors, as a whole, has oversight responsibility for our strategic and operational risks, and ensures that appropriate risk mitigation strategies are implemented by management. Our audit committee assists the board of directors with this responsibility by periodically reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of our management team, which is responsible for the assessment and management of cybersecurity risks.

In addition, we have retained an external consultant to serve as our internal audit function and to support our cybersecurity risk management and governance practices. Our consultant has substantial experience in cybersecurity risk management and information technology, including security, compliance, systems and programming and reports to our audit committee and our board of directors on any appropriate items.

The Global Director of Information Technology (GDIT) is the management position with primary responsibility for the development, operation, and maintenance of our information security program for the Business Services segment. The GDIT has over 25 years of experience as a security professional, and has completed the Prince 2 risk management certification at the practitioner level. Responsibilities of this role include management of third-party vendors, ensuring data interactions with outside parties, adhering to IT security best practices, and ensuring that all devices within the Business Services segment IT infrastructure are appropriately secured and managed. Responsibilities also encompass communication to senior management and future IT strategy and security planning for all segments, which may include outsourcing of certain responsibilities.

The Company’s compliance committee and counsel are informed of all security incidents and are tasked with ensuring appropriate remediation activities are implemented. Results of audits and material security incidents are presented to the Board of Directors on a quarterly basis.

• 20 -