Company: CERO
Filing Date: 2025-04-15
Form Type: 10-K
Source: 0001213900-25-032134
Chunk: 1940

Company: CERO THERAPEUTICS HOLDINGS, INC.
Filing Date: 2025-04-15
Form: 10-K
Item: Item 1C
Chunk 1940
---
Item 1C. Cybersecurity.

Cybersecurity Risk Management
and Strategy

We have implemented risk
management procedures, which include cybersecurity risk management, that are designed to define our corporate risk tolerance and align
assumed risks to that tolerance through risk identification, prioritization, assessment, mitigation and planned responses if risk is realized.
These elements are applied to cybersecurity as well as other origins of risk.

Our cybersecurity risk management
procedures are designed to address four key areas:

●Identification
of assets at risk from cybersecurity threats

●Identification
of potential sources of cybersecurity threats

●Assessment
of the status of protections in place to prevent or mitigate cybersecurity threats

●Given
that landscape, how to manage cybersecurity risks

Our risk assessment and mitigation
procedures are centered on three key components:

●identification
of risks, which involved input from different groups across our company;

●evaluation
of the likelihood of the risks manifesting, the severity of the potential consequences and prioritization of different risk items based
on, among other things, importance to the business and cost/benefit analysis to fully address; and

●execution
- establishment of a program to address.

Our information technology
(the “Information Technology Team”) is responsible for monitoring our information systems for vulnerabilities and mitigating
any issues. It works with others within our company to understand the severity of the potential consequences of a cybersecurity incident
and to make decisions about how to prioritize mitigation and other initiatives based on, among other things, materiality to the business.
The Information Technology Team has processes designed to keep us apprised of the different threats in the cybersecurity landscape - this
includes working with consultants, discussions with peers at other companies, and reviewing government alerts and other news items. The
team also regularly monitors our network(s) to identify security risks.

We have an employee education
program that is designed to raise awareness of cybersecurity threats to reduce our vulnerability as well as to encourage consideration
of cybersecurity risks across functions.

We monitor risks through
active (e.g., vulnerability scans) and passive (e.g., end-point protection) methods and addresses system alerts on a constant basis.

As part of the assessment
of the protections we have in place to mitigate risks from cybersecurity threats, we engage third parties to conduct risk assessments
on our systems.

Before purchasing third-party
technology or other solutions that involve exposure to our assets and electronic information, our Information Technology Team performs
a review on vendors (evaluating suitability, risk, and impact) before they are approved to work