Capstone Holding Corp.

Risk Management and Strategy

Identifying, assessing and managing material cybersecurity threats is important to our operations and business strategy. We have established policies and procedures that are designed to prioritize the safeguard of our information systems. These procedures help identify potential vulnerabilities and manage risks from unauthorized incidents within our information systems that may result in adverse effects on data residing within. We conduct periodic and ad-hoc assessments that are managed by third party information technology providers, to identify potential cybersecurity threats.

Upon completion of these risk assessments, thethird-party information technology providers help the company assess how to reconfigure or implement additional procedures to mitigate any potential cybersecurity threats.

In connection with the acquisitions of Carolina Stone Distributors, LLC and Fraser Canyon Holdings Inc. (Canadian Stone Industries) completed during2025, the Company is in the process of assessing and integrating the cybersecurity risk management practices and information technology environments of the acquired businesses into the Company’s existing cybersecurity framework. Until integration is complete, the acquired businesses continue to operate their respective pre-acquisition cybersecurity programs and controls.

Risks from Cybersecurity Threats

We do not currently believe there are any cybersecurity threats or vulnerabilities that would have materially impaired our operations or financial conditions during the fiscal year ended December 31, 2025.

Cybersecurity Governance

It is the responsibility of our board of directors to monitor and assess potential strategic risk exposure. Our board of directors administers its oversight function as a whole, as well as through the Audit Committee. Our executive management team informs the Audit Committee on cybersecurity risks periodically, with a minimum frequency of once per year.