Company: BGLC
Filing Date: 2025-04-15
Form Type: 10-K
Source: 0001477932-25-002725
Chunk: 132

Company: BioNexus Gene Lab Corp
Filing Date: 2025-04-15
Form: 10-K
Item: Item 1
Chunk 132
---
 applicable to smaller reporting companies will make our common stock less attractive to investors.

We are currently a “smaller reporting company”, meaning that we are not an investment company, an asset-backed issuer, or a majority-owned subsidiary of a parent company that is not a smaller reporting company and annual revenues of less than $100 million during the most recently completed fiscal year. In the event that we are still considered a “smaller reporting company,” at such time as we cease being an “emerging growth company,” we will be required to provide additional disclosure in our SEC filings. However, similar to an “emerging growth companies”, “smaller reporting companies” are able to provide simplified executive compensation disclosures in their filings; are exempt from the provisions of Section 404(b) of the Sarbanes-Oxley Act requiring that independent registered public accounting firms provide an attestation report on the effectiveness of internal control over financial reporting; and have certain other decreased disclosure obligations in their SEC filings, including, among other things, only being required to provide two years of audited financial statements in annual reports. Decreased disclosures in our SEC filings due to our status as a “smaller reporting company” may make it harder for investors to analyze our results of operations and financial prospects.

Item 1B. Unresolved Staff Comments.

None.

Item 1C. Cybersecurity

Risk Management and Strategy

Our cybersecurity policies, standards, processes and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; and (5) security incident response to investigate, respond to, and mitigate cyber threats. As needed, we will engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.

In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect