TECOGEN INC.

Risk Management Strategy

Our business is dependent upon our information technology (“IT”) systems, devices and networks to collect, process and store the data necessary to conduct our business and record and report our business and financial information. We recognize the importance of developing, implementing, and maintaining effective cybersecurity measures to safeguard our IT systems and protect the confidentiality, integrity, and availability of our confidential and personal data, including with respect to our customers, suppliers, and employees, as well as our intellectual property.

We maintain a cybersecurity risk management program to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our cybersecurity risk management program incorporates various mechanisms to detect and monitor unusual network activity, as well as containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business and have processes to assess those issues for potential cybersecurity impact or risk.

We have integrated our cybersecurity risk management program into our broader enterprise risk management program. This integration is designed to make cybersecurity considerations an integral part of our decision-making processes at every level and we believe that this integration allows cybersecurity risks to be evaluated and addressed in alignment with our business objectives and operational needs. While we work to maintain our information security program and risk management efforts, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to our systems, networks, and data or those of our third-party providers.

We rely on suppliers that are also exposed to ransomware and other malicious attacks that can disrupt business operations. Although we take steps to secure confidential information that is provided to or accessible by third parties, such measures may not always be effective and losses or unauthorized access to, or releases of, confidential information occur. Such incidents and other malicious attacks could materially adversely affect our business, reputation, results of operations and financial condition.

We have experienced malicious attacks and other attempts to gain unauthorized access to our systems, including a ransomware attack on our computer network which occurred on April 28, 2023. Following remediation, our network returned to full operation on May 1, 2023.

We have engaged athird-party consultant in connection with our risk management and assessment processes. Our consultant assists us in the design and implementation of our cybersecurity policies and procedures, as well as the monitoring and testing of our safeguards. In the event of a cybersecurity incident, our incident response plan outlines the steps to be followed from incident detection to mitigation, recovery and notification, and involves notifying senior management, our legal department, and the board of directors and/or our audit committee, if appropriate, and mitigation and remediation steps by our third-party consultant.

Governance

Our board of directors has overall responsibility for informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors has delegated to our audit committee its cybersecurity risk oversight processes, including oversight and mitigation of risks from cybersecurity threats.

Our audit committee receives periodic reports from management regarding our cybersecurity risks and is notified of any significant cybersecurity threat or incident. The audit committee reports to theboard of directors regarding its activities, including with respect to cybersecurity matters and the occurrence of any material cybersecurity incident, if appropriate.

We have engaged a third-party consultant to manage risks associated with network protection and workstation management. Our consultant performs an annual assessment of our cybersecurity risk policies and procedures.

Our cybersecurity risk management and strategy processes are jointly led by ourembedded software engineer and Chief Executive Officer, in conjunction with a third-party consultant we have engaged to assist with cybersecurity risks assessment and monitoring. Our embedded software engineer is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes described above, including our incident response plan. Together with the General Counsel, Chief Executive Officer and outside consultant that comprise our cybersecurity management team, we collectively possess significant experience in evaluating, managing, and mitigating security and other risks, including cybersecurity risks.

Our embedded software engineer possesses significant information systems experience.

Our headquarters are located in North Billerica, Massachusetts, consisting of approximately 26,412 square feet of manufacturing, storage and office space, of which approximately 21,000 square feet is dedicated to manufacturing and warehousing.

On March 31, 2023, we entered into two lease agreements for two adjacent buildings located in North Billerica, Massachusetts, to serve as our headquarters and manufacturing facilities. The lease agreements provide for initial lease terms of five (5) years with two successive options to renew for additional terms of five (5) years. Both lease agreements commenced on January 1, 2024, and require payment of the base rent, real estate taxes, common maintenance expenses, and aggregate security deposits in the amount of $38,200. Our costs for initial improvements required to the leased premises is estimated to range between $1,150,000 and $1,200,000. The estimated straight-line monthly rent expense for the initial term of the lease is approximately $26,412 per month. In accordance with ASC 842-20-30-1, we recognized and recorded the lease liability and right-of-use asset using the discount rate for the lease upon the lease commencement date, January 1, 2024. We believe that our facilities are appropriate and adequate for our current needs.

Service Centers

Our eleven leased service centers can be categorized into two different sizes. The larger leased spaces have office space to accommodate administrative, sales and engineering personnel, and warehouse space to stock parts in support of our service contracts. As of December 31, 2025, the service centers that fit this larger category are based in Piscataway, New Jersey and Valley Stream and Buchanan, New York to service the Metro New York City and the Mid-Atlantic region. The San Francisco Bay area and Northern California are served by such a center in Hayward, California. A portion of the corporate headquarters in North Billerica, Massachusetts are used in this manner to service all of our satellite service centers. The smaller service centers are parts depots or warehouses for the stocking of parts in support of our service contracts. These centers are located in Easton, Massachusetts, Los Angeles, California, Sterling Heights, Michigan, Newark, New York, East Windsor, Connecticut, East Syracuse, New York, Toronto, Ontario and Wellesley Chapel, Florida.