TSS, Inc.

We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity and availability of our critical systems and information. We design and assess our program using the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) as a framework to help identify, assess and manage cybersecurity risks relevant to our business.

Our IT management team, in concert with our Chief Security Officer, is responsible for the day-to-day oversight of cybersecurity risk management. Management monitors privacy and security incidents across our systems and those of key third-party service providers and vendors. Significant incidents are reviewed by a cross-functional working group to determine whether escalation is appropriate. Incidents assessed as potentially material are promptly escalated to senior management for further evaluation. Senior management, in consultation with internal and external advisors as appropriate, is responsible for making materiality determinations and related disclosure and compliance decisions. Management would inform the Audit Committee and our independent registered public accounting firm of material cybersecurity incidents and related developments, as appropriate.

The Board of Directors oversees cybersecurity risk as part of its overall risk oversight responsibilities and has delegated primary oversight to the Audit Committee. The Audit Committee oversees management’s implementation of the Company’s cybersecurity risk management program and receives regular reports from senior management regarding cybersecurity risks, trends and, if applicable, material incidents. We engage third-party specialists to periodically assess and test our cybersecurity controls. Management monitors the prevention, detection, mitigation and remediation of cybersecurity risks through internal reporting processes, threat intelligence, third-party assessments and security tools deployed within our IT environment.

As of the date of this report, we have not experienced a cybersecurity incident that has materially affected our operations, business strategy, results of operations or financial condition. However, cybersecurity threats are evolving and increasing in sophistication, and if realized, such risks could materially affect our operations, business strategy, results of operations or financial condition.