AmpliTech Group, Inc.

Cybersecurity Risk Management and Strategy

The Company relies on internal information systems andthird-party services for operational and financial processes, and these systems and services may experience disruptions, failures, or security incidents arising from inherent cybersecurity risks. While cybersecurity incidents havenot materially affected the Company to date, these risks continue to evolve, and the Company may be exposed to operational or financial impacts from potential cybersecurity threats in the future. The Company may experience cybersecurity incidents affecting its internal or third-party systems, including unauthorized access, malware, or system and operational disruptions. Cybersecurity threats may originate from a range of sources, from isolated unauthorized access attempts to more complex attacks; the Company’s controls continue to evolve, with additional measures planned. The Company maintains basic administrative and technical controls intended to address cybersecurity risks; however, these measures may not prevent all such incidents, and capabilities for prevention, detection, and response continue to develop. A cybersecurity incident could compromise sensitive information despite the controls in place.

Cybersecurity risks are considered as part of broader operational risk discussions; however, formal integration into enterprise risk management is still developing. Cybersecurity risks are reviewed periodically in the context of overall operational risk, with plans to formalize annual cybersecurity risk assessment processes. When heightened risks are identified, responsibility for identified risks is managed by designated personnel, with enhanced tracking and documentation processes currently in development.

Cybersecurity Governance

The Board of Directors has delegated oversight of cybersecurity risk management, strategy, and governance to executive management, including the Company’s CEO, CFO, and COO. Cybersecurity concerns, operational issues, and risk considerations are discussed with executive management on an informal basis as needed; formal reporting processes to the Board are developing.

Senior management does not hold formal cybersecurity certifications; oversight relies on operational experience and support from information technology specialists to assist in managing relevant risks, with plans to utilize certified external consulting. The Company has conducted limited penetration testing within the past year; however, this is not part of a formal recurring program.

Cybersecurity incidents are reported to executive management and material incidents are reviewed by the Board of Directors as appropriate, though formal reporting and assessment procedures are developing.

The Company has initiated efforts to develop a formal Information Security Management System aligned with ISO/IEC 27001, and this initiative is in the early stages. Notwithstanding the Company’s ongoing efforts to enhance its cybersecurity program, the Company may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect. The Company maintains cybersecurity insurance; however, coverage may not fully align with its risk exposure or address all potential incidents or losses.