Cybersecurity Risk Management Processes Integrated [Text Block]

Our Audit Committee is responsible for overseeing the Company’s internal controls including oversight of our risk management program and cybersecurity. Management is responsible for the day-to-day administration of our risk management program and its cybersecurity policies, processes, and practices. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology and the International Organization for Standardization and are standalone from our overall risk management system and processes. We seeks to address all material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company’s information systems or the information that we collect and store, by assessing, identifying and managing cybersecurity issues as they occur.

Cybersecurity Risk Management Third Party Engaged [Flag]

true

Cybersecurity Risk Board of Directors Oversight [Text Block]

(5)

Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats to equip the Company’s employees with effective tools to address cybersecurity threats, and to communicate the Company’s evolving information security policies, standards, processes, and practices.

We conducts periodic assessment and testing of the Company’s policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events.

Governance

The Audit Committee oversees the Company’s risk management program, including the management of cybersecurity threats. The Audit Committee receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Audit Committee discusses the Company’s approach to overseeing cybersecurity threats with our CFO and other members of senior management.

The Company’s VP of Business Analytics, who has over 10 years of IT security management experience in the cannabis industry, serves as the primary internal point of contact for cybersecurity matters and is responsible for managing our relationship with our managed security service provider, NetworkOne. NetworkOne is responsible for day-to-day cybersecurity operations, including administration of all user accounts, servers, and network infrastructure across our Microsoft environment. NetworkOne provides us with monthly reports of network and user activity metrics, formal quarterly security reports, and real-time reporting during active security incidents. Management conducts quarterly internal reviews of IT security posture in collaboration with NetworkOne.

We maintain intentional separation of administrative responsibilities as a control measure. NetworkOne holds master administrative access to our Microsoft environment and associated network infrastructure. The Company’s CFO maintains master administrative access to our accounting systems and financial software platforms, providing an independent control layer over financial system access that is separate from general IT administration.

Senior management, in coordination with NetworkOne, implements a program designed to protect the Company’s information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with these teams, senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.

Material Effects of Cybersecurity Incidents

Risks from cybersecurity threats have not materially affected, and we do not believe are reasonably likely to materially impact our operations, including our business strategy, results of operations, or financial condition.

Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]

Risks from cybersecurity threats have not materially affected, and we do not believe are reasonably likely to materially impact our operations, including our business strategy, results of operations, or financial condition.