Company: SLNH
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001641172-25-001756
Chunk: 698

Company: Soluna Holdings, Inc
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1C
Chunk 698
---
We,
like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results
of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period,
we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.
We proactively approach cybersecurity through a systemized thorough process established by our internal Management and IT teams as well
as external IT providers.

These
processes are specifically designed to adapt to the evolving cybersecurity environment, enabling us to respond swiftly and effectively
to new and emerging threats. Our cybersecurity initiative incorporates elements from multiple industry benchmarks, including frameworks
from the National Institute of Standards and Technology and the Center for Internet Security.

We
regularly assess the threat landscape and take a holistic view of cybersecurity risks with a layered cybersecurity strategy based on
prevention, detection, and mitigation. Our internal IT team works closely with our external IT management provider to comprehensively
evaluate cybersecurity risks. They focus on monitoring, identifying, and addressing significant cybersecurity issues in real-time by
employing advanced software monitoring platforms for effective mitigation and management. In addition, we have several avenues to gather
risk intelligence and potential threats identified by various services and capabilities to adjust our security strategy.

We
also have Company-wide policies and procedures concerning cybersecurity and technology standards, including a Resource and Data Recovery
policy. In addition, we have other policies related to endpoint and network protection, encryption standards, malware/ransomware protection,
multi-factor authentication, operational security, and confidential information. These policies go through an internal review process
and are approved by appropriate members of management.

We
have invested in IT security, encompassing various strategies such as enhanced end-user training, implementing layered defense systems,
identifying and safeguarding critical assets, bolstering monitoring and alert capabilities, and consulting with expert advisors. On the
management front, our IT security team diligently oversees alert systems and routinely convenes to evaluate current threat levels, analyze
trends, and strategize effective remediation methods.

In
addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of
third-party vendors and service providers. The internal business owners of the hosted applications are required to review user access
at least annually and provide a System and Organization Controls (“SOC”) 1 or SOC 2 report from the vendor. If a third-party
vendor is unable to provide a SOC 1 or SOC