Capstone Holding Corp.

Risk Management and Strategy

Identifying, assessing and managing material cybersecurity threats is important to our operations and business strategy. We have established policies and procedures that are designed to prioritize the safeguard of our information systems. These procedures help identify potential vulnerabilities and manage risks from unauthorized incidents within our information systems that may result in adverse effects on data residing within. We conduct periodic and ad-hoc assessments that are managed bythird party information technology providers, to identify potential cybersecurity threats.

Upon completion of these risk assessments, the third-party information technology providers help the company assess how to reconfigure or implement additional procedures to mitigate any potential cybersecurity threats.

Risks from Cybersecurity Threats

We donot currently believe there are any cybersecurity threats or vulnerabilities that would have materially impaired our operations or financial conditions during the fiscal year ended December 31, 2024.

Cybersecurity Governance

It is the responsibility of our board of directors to monitor and assess potential strategic risk exposure. Ourboard of directors administers its oversight function as a whole, as well as through the Audit Committee. Our executive management team informs the Audit Committee on cybersecurity risks periodically, with a minimum frequency of once per year.