NovaBay Pharmaceuticals, Inc.

Risk Management and Strategy

Many aspects of our business depend on the availability, integrity, and security of our information systems and digital infrastructure, including systems used to record, process, and report financial information and to support our operations within open digital financial networks. Following our business realignment during and subsequent to 2025, our operations increasingly involve the accumulation and deployment of operating digital assets within blockchain networks to provide protocol-level services, including staking, governance participation, validation, and related activities. As a result, our cybersecurity risk profile includes risks associated with blockchain-based networks, digital asset custody, private-key management, smart contracts, and reliance on third-party service providers that support digital asset operations. Ourcybersecurity risk management program is informed by established security frameworks, such as the NIST Cybersecurity Framework, and includes an annual enterprise risk assessment that addresses cybersecurity risks. The program encompasses documented policies, procedures, and standards governing information security, digital asset management, and incident response. We do not maintain in-house information technology or cybersecurity personnel and instead rely on established third-party providers for enterprise software, cloud-based services, and digital asset infrastructure. Management seeks to engage service providers with experience, security practices, and operational controls appropriate to our size, operating model, and risk framework.

Our cybersecurity risk management approach is designed to be proportional to the Company’s scale and complexity and emphasizes preventative controls, access management, and oversight of third-party service providers. In the event of a cybersecurity incident or digital-asset-related security event, we would primarily rely on the incident response, remediation, and recovery capabilities of our service providers, together with oversight by management. The Company maintains cybersecurity insurance coverage designed to address certain losses and liabilities arising from cybersecurity incidents.

Governance

Oversight of cybersecurity risk is provided by Company management, including our Chief Executive Officer and Chief Financial Officer. Our Board of Directors oversees cybersecurity risk as part of its broader oversight of enterprise risk, including risks related to technology infrastructure and digital asset operations. In connection with our business realignment, the Board has established a Digital Asset Strategy Advisory Committee, which provides additional oversight with respect to risks associated with the Company’s participation in blockchain networks and deployment of operating digital assets.

The Board receives updates from management regarding cybersecurity risks and related matters as appropriate. Escalation procedures are in place to ensure that cybersecurity incidents are reported to the Board or any relevant subcommittees, depending on the nature and severity of the incident. Given the Company’s size and operating model, cybersecurity oversight is integrated into the Board’s general risk oversight responsibilities rather than managed through a dedicated cybersecurity committee.

Management considers cybersecurity risks as part of its overall risk management process and elevates matters to the Board when appropriate.

Cybersecurity Risks

Our cybersecurity risks include risks arising from unauthorized access to information systems, data breaches, malware or ransomware attacks (including those leveraging artificial intelligence), phishing or social-engineering attempts (including AI-generated content such as deepfakes), supply chain attacks, and failures or security incidents involving third-party service providers. In addition, our operations within blockchain networks expose us to risks specific to digital assets, including the loss, theft, or compromise of private keys; vulnerabilities in smart contracts or protocol-level code; outages or disruptions affecting blockchain networks or validators; and cybersecurity incidents at custodians or other digital asset infrastructure providers. We also recognize that cybersecurity insurance coverage may have limitations and may not fully cover all losses arising from such incidents.

A cybersecurity incident or digital-asset-related security event could result in financial loss, operational disruption, reputational harm, regulatory scrutiny, legal liability, or other adverse consequences. While we maintain controls and rely on third-party providers designed to mitigate these risks, such measures may not prevent all cybersecurity incidents.

As of the date of this Annual Report, we arenot aware of any cybersecurity incidents, including incidents related to our digital asset operations, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For additional information regarding cybersecurity-related risks, see “Item 1A—Risk Factors.”

• 31 -