ChronoScale Holdings Corp 10-K cybersecurity disclosure (Item 1C), fiscal 2026

Item 1C. Cybersecurity

Risk Management and Strategy

We have established and maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats that could adversely affect our business, operations, technology infrastructure, reputation, or financial condition.

Our business operates primarily as a provider of bare-metal GPU infrastructure and related hosting services. Our responsibilities generally focus on the physical security, availability, integrity, and operation of the facilities, hardware, networking infrastructure, infrastructure management systems, and operational environments that support customer workloads. Customers are generally responsible for the security of their operating systems, applications, data, access controls, model deployments, and other workload-level or application-layer security measures implemented on the infrastructure we provide.

As a result, our cybersecurity risk profile differs from that of providers offering managed cloud, software, platform, or application-layer services. For customer-facing infrastructure, our principal risks include unauthorized physical access, theft or damage to equipment, environmental threats affecting data center operations, attacks targeting infrastructure management systems, denial-of-service events affecting availability, and supply-chain or service-provider disruptions. In addition, like most organizations, we face cybersecurity risks associated with our corporate information technology environment, including unauthorized access attempts, ransomware, malware, credential compromise, insider threats, software vulnerabilities, business email compromise, and incidents involving third-party service providers.

Our cybersecurity program incorporates administrative, technical, and physical safeguards designed to address the distinct risks associated with both our hosting infrastructure and our corporate enterprise environment. Key elements of our program include:

• risk-based security governance and oversight;

• physical and environmental security controls for facilities and infrastructure;

• security policies, standards, and procedures;

• vulnerability identification and remediation processes;

• continuous monitoring and detection capabilities;

• identity and access management controls;

• network and infrastructure security controls;

• incident response and recovery planning;

• third-party risk management processes;

• employee security awareness and training; and

• periodic testing, assessments, and independent reviews of security controls.

We regularly assess cybersecurity risks as part of our enterprise risk management processes. Cybersecurity risks are identified through a combination of internal monitoring activities, infrastructure reviews, vulnerability assessments, threat intelligence, third-party assessments, audits, and incident investigations. Identified risks are evaluated based on their potential operational, financial, legal, strategic, and reputational impacts.

We utilize third-party vendors, service providers, and technology partners in our operations. Accordingly, our cybersecurity program includes processes designed to evaluate and monitor cybersecurity risks associated with certain third-party relationships. Depending on the nature of the service provided and associated risk profile, these processes may include security due diligence, contractual security requirements, review of independent assessments and certifications, periodic reassessments, and ongoing monitoring activities.

We maintain incident response procedures intended to facilitate the timely detection, containment, investigation, remediation, and recovery from cybersecurity incidents. Our incident response processes are designed to coordinate activities across technical, operational, legal, compliance, and executive leadership functions and, where appropriate, involve external cybersecurity, legal, forensic, and communications advisors.

Although we devote substantial resources to cybersecurity risk management, no cybersecurity program can eliminate all risks. Accordingly, we may experience cybersecurity incidents in the future that could have a material impact on our operations, business strategy, financial condition, or results of operations.

Governance

The Board oversees the Company's risk management framework, including cybersecurity risks. The Company's cybersecurity governance program is designed to address both (i) the physical security, availability, operational integrity, and resilience of its hosted infrastructure environment and (ii) cybersecurity risks affecting the Company's corporate information technology, business systems, data, and administrative operations. The Board receives periodic updates regarding the Company's cybersecurity program, significant cybersecurity risks, emerging threat trends, material incidents, and management's efforts to assess and mitigate cybersecurity risks.

The Audit Committee assists the Board in its oversight of cybersecurity and technology-related risks and receives regular reports regarding the effectiveness of the Company's cybersecurity risk management activities, cybersecurity risk exposure, incident preparedness, control enhancements, and significant cybersecurity matters.

Management is responsible for implementing and maintaining our cybersecurity risk management program. Cybersecurity oversight is led by the Company's Head of Security, together with members of senior management responsible for technology operations, risk management, legal, and compliance functions. These individuals possess experience in cybersecurity, technology operations, risk management, incident response, and regulatory compliance and are responsible for assessing cybersecurity risks, implementing security controls, coordinating incident response activities, and overseeing cybersecurity risk mitigation efforts across the organization.

Our security lead reports to the Chief Technology Officer ("CTO") and has direct reporting and escalation responsibilities to the Audit Committee and the full Board with respect to significant cybersecurity matters. The CTO provides regular updates concerning the Company's cybersecurity posture, key risks, control enhancements, incident response readiness, threat landscape developments, and material cybersecurity incidents or vulnerabilities.

Management regularly reviews cybersecurity risks, security metrics, ongoing risk mitigation activities, and incident response preparedness. Significant cybersecurity matters are escalated to executive leadership, the Audit Committee, and the Board, as appropriate, based on the nature and significance of the risk or incident.

As of the date of this Annual Report, we are not aware of any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition. However, future cybersecurity incidents could have such effects.