PhenixFIN Corp

Cybersecurity Program Overview

Our cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We engage external experts, including cybersecurity assessors and consultants, to evaluate cybersecurity measures and risk management processes. We engage and depend on service providers to actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. Our finance and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such service providers.

Board Oversight of Cybersecurity Risks

Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from our Chief Executive Officer and our Chief Compliance Officer, regarding the overall state of our cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents.

Management’s Role in Cybersecurity Risk Management

Our management, including our Chief Executive Officer and Chief Compliance Officer, is responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as regulatory compliance and corporate governance and rely on third-party service providers to provide expertise with respect to information technology and cybersecurity. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, primarily through the receipt of notifications from service providers.

Assessment of Cybersecurity Risk

The potential impact of risks from cybersecurity threats are assessed regularly, including how such risks could materially affect our business strategy, operational results, and financial condition. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.