Company: CTRM
Filing Date: 2025-05-14
Form Type: 20-F
Source: 0001140361-25-018945
Chunk: 28

Company: Castor Maritime Inc.
Filing Date: 2025-05-14
Form: 20-F
Item: Item 16K
Chunk 28
---

ITEM 16K.   CYBERSECURITY
-------------------------
 
  We maintain various cybersecurity measures and protocols to safeguard our systems and data and continuously monitor and assess potential threats to pre-emptively address any emerging cyber risks. We have implemented various processes for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our overall risk management framework. These processes include access controls to organizational systems, data encryption, cybersecurity training and security awareness campaigns through direct mail, and are designed to systematically evaluate potential vulnerabilities and cybersecurity threats and minimize their potential impact on our organization’s operations, assets, and stakeholders. Our cybersecurity risk management processes share common methodologies, reporting channels and governance processes with our broader risk management processes. By embedding cybersecurity risk management into and aligning it with our broader risk management processes, we aim to ensure a comprehensive and proactive approach to safeguarding our assets and operations.
   
  We engage assessors, consultants, auditors, and other third-party specialists to enhance the effectiveness of our cybersecurity processes, augment our internal capabilities, validate our controls, and stay abreast of evolving cybersecurity risks and best practices.
 
  In 2024, we did not detect any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.
 
  Responsibility for overseeing cybersecurity risks is integrated into the purview of the Information Technology and Cybersecurity Department of Castor Ships (the “ITC Department”), our commercial and technical co-manager. The ITC Department is responsible for monitoring, detecting and assessing cybersecurity risks and incidents at the parent company, subsidiary and vessel level. The ITC Department provides these services to us pursuant to the Amended and Restated Master Management.
   
  We also utilize third-party service providers for certain IT-related and other services, where appropriate, to assess, test or otherwise assist with aspects of our security controls. Accordingly, we also implement processes to oversee and identify material cybersecurity risks associated with our utilization of third-party service providers on whom we have a material dependency, such as conducting due diligence assessments to evaluate their cybersecurity measures, data protection practices, and compliance with relevant regulatory requirements.
  
  The ITC Department currently comprises a senior IT professional who has approximately 15 years’ experience in risk management, cybersecurity, and information technology. This individual has, and any future members of the ITC Department are expected to have, credentials relevant to their role, which includes prior experience working in similar roles and formal education (e.g., a Bachelors of