Company: OCG
Filing Date: 2025-05-15
Form Type: 20-F
Source: 0001213900-25-043484
Chunk: 116

Company: Oriental Culture Holding LTD
Filing Date: 2025-05-15
Form: 20-F
Item: Item 16K
Chunk 116
---
Item 16K. Cybersecurity

Information technology (IT) and safety are critical
to the online trading platforms and operating activities of the Company as they are subject to security threats and increasingly sophisticated
cyber-attacks. As a result, we have policies and processes in place to assess, identify, and manage the strategic andoperational IT-related
risks as an
integrated
part of our overall risk management system. The Company uses layers of personnel and management team to centralize
the control of the cybersecurity management, including the board of director, executive officer, risk control department, and cybersecurity
staffs. The cybersecurity staffs use various technologies to supervise the online activities, keep a journal and records of the abnormal
or major activities, detect and discover potential threats and bugs. The risk control department will assess and manage the cyber risks
with make regular evaluations to understand the discoveries by the cybersecurity staffs and take appropriate actions to eliminate such
threats to the cybersecurity of the Company. The Company has notengagedany third-party assessors, consultants, auditors, or other third
parties in connection with any such processes. The Company has set up the password requirement, control of authorization on a need to
know basis, categorize sensitive information so that they can be managed and transmitted at different security levels. Other than those, the Company currently does not have processes to oversee and identify the risks from cybersecurity threats associated with its use of
any third-party service provider. As of date of this report, there has been no previous cybersecurity incidents, have materially affected
the Company yet. The Board is responsible for the oversight of risks from cybersecurity threats.
The cybersecurity staff will report any
material threats, risks and incidents to the IT manager, then the IT manager will report to Chief Executive Officer who will report to
the Board. The Company has adopted Cybersecurity Management Policy so that suspicious activities or incidents can be quickly identified
and reported through the system to the appropriate management team.
According to the policy, the cybersecurity staff will evaluate and
manage the weakness, events, alerts and incidents and escalated material events to IT manager, then Chief Executive Officer, or the Board
if necessary. Mr. Wenyong Ding has served as our IT Manager since August 2018 and has related cybersecurity manage experiences and expertise. From April 2015 to July 2018, Mr. Ding was served as Software Project Manager of Nanjing Culture and Artwork Property Exchange Co., Ltd.
From September 2013 to March 201