Sensus Healthcare, Inc.

Cybersecurity Risk Management and Processes

Sensus is actively working towards the integration of a cybersecurity risk management program into its comprehensive risk management framework to protect the confidentiality, integrity, and availability of its critical systems and information.

Our cybersecurity risk management program is being designed based on various cybersecurity frameworks, including National Institute of Standards and Technology and the Center for Internet Security, as well as information security standards issued by the International Organization for Standardization, including ISO 27001 and ISO 27002. The Company uses these frameworks and information security standards as a guide to identify, assess, and management cybersecurity risks relevant to the business.

The Company has implemented or is implementing the following key elements into the cybersecurity risk management program:

In addition, the Company has a strategic plan, which encompasses the following key elements:

The Company has not identified any risks from known cybersecurity threats and did not have any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, refer to Item 1A. Risk Factors – “The Company’s operations may be impaired if our information technology systems fail to perform adequately or are the subject of a data breach or cyberattack,” which is incorporated by reference into this Item 1C.

Cybersecurity Governance

The Board of Directors actively collaborates with management to supervise cybersecurity risks. The Chief Technology Officer (“CTO”), with over ten years of experience in technology and engineering within the medical device industry, leads the Company’s overall cybersecurity function and is responsible for monitoring cybersecurity risks. The CTO works with internal personnel and

third-party consultants to design and implement controls for the prevention, detection, mitigation, and remediation of cybersecurity risks. The CTO maintains regular communication with the Board on matters related to cybersecurity and provides updates to management on a quarterly basis. In the event of a cybersecurity incident, the Board is to be promptly notified.

Management considers cybersecurity risk as part of its risk oversight function and is in the process of establishing a cybersecurity governance committee. The cybersecurity governance committee will oversee the management’s implementation of the cybersecurity risk management program.