TaoWeave, Inc.

Cybersecurity Risk Management and Strategy

We have a multilayered framework for detecting and responding to reasonably foreseeable cybersecurity risks and threats. To protect our information technology (“IT”) systems from cybersecurity threats, we use various tools that help prevent, detect, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. In the event of a material change to our systems or operations, we would assess the internal and external threats to the security, confidentiality, integrity, and availability of our data and systems, along with other material risks to our operations. We leverage technical safeguards intended to protect the Company’s information systems from cybersecurity threats, including firewalls, threat monitoring, intrusion prevention and detection systems, anti-malware, access controls, privilege management, asset and endpoint management, and ongoing system security assessments. We oversee third-party service providers by conducting vendor diligence and reviews on a regular basis. We monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular network scans, system audits, and intelligence feeds. The results of these assessments are used to improve our security posture through remediation efforts.

We have developed an incident management process designed to coordinate the activities to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate any reputational damage.

Our business strategy, results of operations, and financial condition have not been materially affected as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see “Item 1A, Risk Factors” in this Annual Report.

Governance

Oblong’s Director of IT is responsible for assessing and managing cybersecurity risks. It has extensive experience focused on increasing the organization's resilience to security threats and staying current on new developments by monitoring the cybersecurity landscape. The team monitors Oblong’s IT environment for potential security threats, investigating and acting on security events to minimize potential risks to the environment.

Oblong’s Audit Committee engages in oversight of Oblong's cybersecurity risks and receives regular updates from management on technology and security updates and Oblong’s assessment of cybersecurity threats and mitigation plans. The Audit Committee oversees the processes over internal controls and financial reporting, including controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. In the event of a material cybersecurity incident affecting our IT systems or data management, the Audit Committee would promptly work to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity incidents.