CapsoVision, Inc 10-K cybersecurity disclosure (Item 1C), fiscal 2025

Item 1C. Cybersecurity

Cybersecurity Risk Management and Strategy

We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our critical systems and information. Our strategy utilizes on a "Defense in Depth" architecture that is aligned with the international standard ISO/IEC 27001:2022, and adheres to the regulatory requirements under HIPAA, FDA cybersecurity guidance, GDPR and Sarbanes-Oxley IT General Controls (SOX ITGC). We employ a multi-layered approach to assess, identify and manage material cybersecurity risks relevant to our business.

Key elements of the cybersecurity risk management program include:

• Continuous Risk Assessment: Periodic risk assessment and treatment across critical systems and information, including corporate networks and third-party managed services .

• Threat Management: Utilization of advanced security software for real-time threat detection and response, patch management and behavior data analysis and monitoring.

• Vulnerability Validation: Internal and external testing to identify vulnerabilities, including vulnerability scan and penetration testing, to proactively identify security gaps.

• Compliance Auditing: Regular internal and external audits to ensure the implementation of our cybersecurity program is compliant with the international standards and regulatory frameworks.

• Incident Response: A formalized process that includes procedures for identifying, containment, eradication and recovery from cybersecurity incidents.

• Data Protection: Encryption of critical data at rest and in transit to ensure personal health information and financial data are protected.

• Resiliency and Recovery: Disaster recovery and business continuity plans designed to maintain critical operations and minimize the downtime.

• Security Culture: Mandatory cybersecurity awareness training for our employees, incident response personnel, and senior management.

• Supply Chain Security: Vendor risk assessment for key service providers and partners.

We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See the risk

factor titled, "Our business and operations may suffer in the event of information technology system failures, cyber attacks, or deficiencies in our cybersecurity." for additional information.

Cybersecurity Governance

The Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity risks, including responsibility for our controls and procedures for mitigating cybersecurity and other information technology risks, and our plans to respond to data breaches.

The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

The internal security team, led by the Senior Director of Information Technology , exercises oversight through a multi-faceted monitoring approach, which integrates threat intelligence from security communities, guidance from external advisors and governmental agencies, and aggregated analytics produced by security technologies deployed in our IT environment.

The Senior Director of Information Technology oversees the daily assessment and management of material risks arising from cybersecurity threats, and reports on the company's cybersecurity posture during semi-annual management review meetings. The reviews evaluate the achievement of security objectives, risk management and mitigation, personnel and access control change, resource allocation, key performance metrics, and opportunities for continuous improvement.