Company: BNRG
Filing Date: 2025-03-04
Form Type: 20-F
Source: 0001213900-25-020178
Chunk: 88

Company: Brenmiller Energy Ltd.
Filing Date: 2025-03-04
Form: 20-F
Item: Item 16K
Chunk 88
---
 risk management process, including the management of risks arising from cybersecurity threats. The board of directors receives regular
presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards,
vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security
considerations arising with respect to our peers and third parties. Our board of directors receives prompt and timely information regarding
any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it
has been addressed. On an annual basis, our board of directors discusses our approach to cybersecurity risk management with our management
team.

Our VP QA/RA implements programs
designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance
with our incident response and recovery plans. Through ongoing communication our management monitors the prevention, detection, mitigation
and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to our board of directors and
management when appropriate.

We have implemented a comprehensive
Incident Response Plan (“ IRP”) and Incident Response Management Procedure, ensuring compliance with ISO 27001:2022, NIST standards,
and SEC disclosure requirements. The Incident Response Team (“ IRT”), led by senior management, oversees cybersecurity incidents,
mitigation efforts, and business continuity. The Incident Management Team (“ IMT”) is responsible for overseeing the response
process, including containment, coordination, and resolution. Key personnel include the Information Technology Officer, Chief Operations
Officer, our legal counsel, and VP QA/RA as the Incident Response Manager. Our IT and Security Teams is responsible for implementing technical
controls for containment and eradication, our legal and compliance team ensures that incidents are reported in accordance with applicable
law and regulations, and the communications/IR team would manage public and internal communications regarding the incident. We perform
automated monitoring, a 24/7 reporting system, and structured escalation based on severity. Upon detection, incidents are contained, investigated,
and reported as required, with secure forensic evidence collection. Post-incident reviews ensure continuous improvement, with quarterly
testing and annual updates to address emerging threats. This structured approach ensures effective risk mitigation, regulatory compliance,
and operational resilience. Our board of directors is currently the highest supervisory authority on this matter, and we are considering
delegating some of these supervisory authorities to our audit committee in the future.

Neither cybersecurity threats
nor any previous cybersecurity incidents have materially affected or are