Capstone Green Energy Holdings Inc

We use, store and process data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems and business operations, including vetting and managing third-party service providers with comprehensive due diligence, continuous monitoring and strict compliance with industry standards. In addition, weprovide cybersecurity awareness training to our employees, incident response personnel, and senior management, including training on best practices for data privacy and security. Our enterprise risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process.

The Board is responsible for overseeing assessments of major risks facing the Company and for reviewing options to mitigate these risks. It has delegated oversight responsibility for information security matters to the Audit Committee, Chief Financial Officer (“CFO”) and our internal information technology (“IT”) resources. Our Director of IT manages our internal team of security professionals, as well as our third-party IT service providers, which provides 24/7 security monitoring. The personnel comprising our IT team are experienced professionals with many years of experience across a variety of technology sub-specialties.

Our CFO oversees our cybersecurity risk management, including appropriate risk mitigation strategies, systems, processes, and controls, and receives updates from IT and our third-party IT service providers on cybersecurity and information security matters. The CFO communicates with the Audit Committee and the Board periodically regarding the state of our cybersecurity risk management, current and evolving threats and recommendations for changes. We have also implemented a cyber incident response plan that provides a protocol to report certain incidents to the CFO with the goal of timely assessment of such incidents, determining applicable disclosure requirements and communicating with the Audit Committee and the Board for timely and accurate reporting of any material cybersecurity incident.

As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For additional discussion of our cybersecurity-related risks, see Part I, Item 1A, “Risk Factors.”