GUIDED THERAPEUTICS INC

Cybersecurity is an area of increasing concern to management and our investors. There are two main areas involving personal data that we pay particular attention to: 1) Patient data of women enrolled in our clinical trials or commercially by overseas partners and 2) Company employee information,

By design, our device and software (LuViva) are not connected to the internet. Patient results cannot be saved to the device and must first be downloaded to a flash drive and then transferred to another computer or cloud-based system to be saved. The design of our product limits our exposure to the compliance requirements of NIST800-171.

Regarding employee information, our Company generally keeps all employee personally identifiable information with our payroll service provider. Each year the provider furnishes us with their SOC report which includes their cybersecurity policies and procedures.

Theboard of directors, as a whole, has oversight responsibility for our strategic and operational risks, while we engage consultants who are responsible for day-to-day assessment and management of cybersecurity risks and who report regularly to the board of directors. We have previously experienced cybersecurity incidents, from time to time. These incidents have not materially affected our business strategy, results of operations or financial condition. We are not currently aware of any cybersecurity incidents that would have a material effect on our business strategy, results of operations or financial condition. Nevertheless, there is always a risk that a phishing attempt, ransomware or other attack by a bad actor could have a material adverse effect on our financial position or results of operations. Based on information currently available, management does not believe that there is a reasonably likely risk of these issues, nevertheless the possibility of one occurring cannot be completely ruled out.