BIOLIFE SOLUTIONS INC

We have a thorough process for identifying, assessing, and managing cybersecurity risks. We design and assess our cybersecurity risk management program leveraging the National Institute of Standards and Technology Cybersecurity Framework ("NIST") within our broader risk management framework. The cybersecurity team gathers insights from external experts and internal threat intelligence teams to support our cybersecurity risk management program. A dedicated team oversees cybersecurity risk management, led by professionals with deep expertise, including our Vice President of Technology, who has over 20 years of experience in technology and cybersecurity focused roles. Our executive leadership, supported by our cybersecurity team, oversees our enterprise risk management and regularly considers cybersecurity and other material risks. We promote a culture of security, sending out monthly cybersecurity awareness trainings to our employees.

Within our cybersecurity risk management system, our incident management team tracks and logs privacy and security incidents across the Company and third-party service providers. Significant incidents undergo review by a cross-functional group, with immediate escalation for potentially material incidents. We have an incident response retainer with a leading professional services network, ensuring immediate support in the event of a cybersecurity incident. We consult with outside counsel as needed, with final decisions made by the CFO and CEO.

The Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of steps the Company has taken to monitor or mitigate significant cybersecurity risks. The Audit Committee additionally ensures compliance with disclosure requirements and cooperation with law enforcement. Senior management regularly updates the Audit Committee on cyber risks and any material incidents.

While our business strategy and financial condition have not been materially affected by cybersecurity risks, we cannot guarantee future immunity. For more details, refer to Part I, Item 1A, “Risk Factors” in this Annual Report.