New Concept Energy, Inc. 10-K Cybersecurity GRC - 2024-04-01

Page last updated on April 11, 2024

New Concept Energy, Inc. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-04-01 16:38:33 EDT.

Filings

10-K filed on 2024-04-01

New Concept Energy, Inc. filed an 10-K at 2024-04-01 16:38:33 EDT
Accession Number: 0001214659-24-005800

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity We rely on the information technology and systems maintained by Pillar Income Asset Management, Inc. ( Pillar ), an entity which provides a number of services to the Company, and we rely on Pillar and its personnel to identify and manage material risks from cybersecurity threats. Pillar takes various actions, and incurs significant costs, to maintain and manage the operation and security of information technology and systems, including the data maintained in those systems. We believe that Pillar s Director of Information Technology and his associates endeavor to evaluate and address cyber risks in alignment with our business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology ( NIST ) and CIS Critical Security Controls frameworks. Since we rely on accounting, financial, operational, management and other information systems, including the Internet and third-party hosted services to conduct our operations, store personal and sensitive data, process financial information and results of operations for internal reporting purposes and comply with financial reporting, legal and tax requirements, we have processes and procedures in place to monitor the prevention, detection, mitigation and remediation of cybersecurity risks. These include, but are not limited to (i) maintaining a defined and practiced incident response plan (ii) employing appropriate incident prevention and detection safeguards (iii) maintaining a defined disaster recovery policy and employing disaster recovery software, where appropriate (iv) educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats and (v) reviewing and evaluating new developments in the cyber threat landscape. Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external support in evaluating, monitoring and testing our cybersecurity management systems and related cyber risks. We do not believe we are reasonably likely to be materially affected from cybersecurity threats. 5 Table of Contents

Company Information