ENvue Medical, Inc.

Cybersecurity Risk Management and Governance

We operate in the medical device and healthcare technology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

Cybersecurity Risk Assessment Program

Our cybersecurity risk assessment program consists of an annual review of our risks and policies. The program outlines governance, policies and procedures, and technology controls we use to oversee and identify risks from cybersecurity threats, and is informed by cybersecurity incidents we have observed both within the Company and in our industry. We are adopting formal policies governing information security, acceptable use, and data retention, which are reviewed and updated on at least an annual basis.

We have engaged a third party virtual Chief Information Security Officer (CISO) to assist in assessing, developing, and maintaining our cybersecurity program. Among other things, this engagement includes periodic evaluations of our workstations and on site storage equipment.

We maintain and constantly improve security measures designed to protect client, patient, customer, employee, and vendor information and to prevent data loss and other security breaches. We maintain business continuity, contingency, and recovery plans for use in the event of a cybersecurity incident, including local and cloud based backup of files and emails.

Third Party Service Provider Risk

We have implemented processes to oversee and identify cybersecurity risks associated with our use ofthird party service providers. These processes include vendor due diligence prior to engagement, contractual requirements for security standards where appropriate, and ongoing monitoring of compliance with applicable protocols. We require that third party software providers used for accounting, billing, and payroll maintain SOC 1 compliance, and we monitor their continued adherence to those standards.

Cross-Border Operations

We maintain operations in both the United States (Tyler, Texas, Arlington Heights, Illinois) and Israel (Tel Aviv), including through our subsidiary NanoVibronix Ltd. (Nesher, Tel-Aviv) Our cybersecurity program is designed to address the risks associated with cross-border data flows and the applicable data protection requirements in each jurisdiction, including Israeli privacy law. We seek to ensure that our policies and controls are applied consistently across both locations.

Management and Board Oversight

Our Chief Operating Officer, with oversight from the Chief Executive Officer and senior management, is responsible for the day-to-day assessment and management of risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents. Day-to-day operational cybersecurity activities are managed by our IT Manager in coordination with external IT support.

The Audit Committee of the Board of Directors is responsible for oversight of risks from cybersecurity threats in conjunction with management. The Committee receives interim reports and updates from senior management, and management has committed to updating the full Board on a quarterly basis with respect to the management of risks from cybersecurity threats. Such reports cover our information technology security program, including its current status, capabilities, objectives, and plans, as well as the evolving cybersecurity threat landscape. The Nominating and Corporate Governance Committee considers risks from cybersecurity threats as part of its oversight of the Company’s business strategy, risk management, and financial oversight.

Materiality Assessment

In determining whether a cybersecurity incident is material, senior management evaluates the nature and scope of the incident, the data or systems affected, potential financial impact, regulatory implications, and any operational disruption. Material incidents are escalated to the Chief Executive Officer and reported to the Nominating and Corporate Governance Committee in accordance with our incident response procedures.

As of the date of this report, no cybersecurity incident (or aggregation of incidents) or cybersecurity threat has materially affected our results of operations or financial condition. However, an actual or perceived breach of our security could damage our reputation, cause existing clients and customers to discontinue their relationships with us, prevent us from attracting new clients and customers, interfere with the progress of our clinical trials, or interfere with our efforts to pursue regulatory approvals for our product candidates, or subject us to third party lawsuits, regulatory fines, or other actions or liabilities, any of which could adversely affect our business, operating results, or financial condition. For further information, see “Risk Factors-Our business and operations would suffer in the event of computer system failures, cyber-attacks or deficiencies in our cyber-security” in Item 1A of this Annual Report on Form 10-K. We currently carry a cyber liability insurance policy.