CEL SCI CORP

CEL-SCI recognizes the importance of assessing, identifying, and managing material risks from cybersecurity threats. CEL-SCI’s policies, standards and procedures for assessing, identifying, and managing material risks from cybersecurity threats are integrated into its overall risk management system. In this regard, CEL-SCI uses various tools and processes to help prevent, identify, and resolve any identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, routine employee awareness updates, annual cyber security training, monthly email testing engaging experts and third-party monitoring and detection tools.

CEL-SCI employs third-party information technology (“IT’) consultants to manage its information technology environment and help manage and assess cybersecurity risks. Thethird-party IT consultants have relevant industry experience, including security solutions and data protection and recovery. Using various monitoring and detection tools implemented into CEL-SCI’s internal technology systems, they can identify cybersecurity threats and report such risks to CEL-SCI’s management team.

CEL-SCI’s management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which includes oversight over its third-party IT consultant, monitoring systems and employee engagement. The management team is responsible for reporting any cybersecurity risks identified by CEL-SCI’s third-party IT consultant to its board of directors.

CEL-SCI’sboard of directors is responsible for oversight over its risk management system, including review and approval of the risk management system and processes implemented by management to identify, assess, manage and mitigate cybersecurity risks. The Board is responsible for monitoring and assessing material risk exposure to cybersecurity risks, and CEL-SCI’s management is responsible for the day-to-day supervision of the material risks CEL-SCI may face.

CEL-SCI’s risks from cybersecurity threats have not affected or are reasonably not likely tomaterially affect its business strategy, results of operations, or financial condition.