{"url_path":"/sec/cgeh/10-k/2026/item-1c","section_key":"item-1c","section_title":"Item 1C ****. Cybersecurity.**","topic":"sec","document":{"doc_type":"10-K","doc_date":"2026-06-25","source_url":"https://www.sec.gov/Archives/edgar/data/1009759/0001104659-26-077817-index.html","accession_number":"0001104659-26-077817","cik":"0001009759","ticker":"CGEH","issuer_name":"Capstone Energy Plus, Inc.","edgar_url":"https://www.sec.gov/Archives/edgar/data/1009759/0001104659-26-077817-index.html","primary_entity_key":"0001009759","primary_entity_name":"Capstone Energy Plus, Inc."},"word_count":737,"has_tables":true,"body_markdown":"**Item 1C****. Cybersecurity.**\n\n*Risk Management and Strategy*\n\nCybersecurity risk management is an integral component of Capstone's overall enterprise risk management framework. We use, store, and process sensitive data relating to our customers, employees, partners, and suppliers across our business operations, and we recognize that the protection of this data, and the systems through which it flows, is essential to maintaining the trust of our stakeholders and the continuity of our business.\n\nFollowing the NIST Cybersecurity Framework, we have implemented a cybersecurity risk management program designed to identify, assess, prioritize, and mitigate risks from cybersecurity threats to our data, systems, and operations. Key elements of our program include:\n\n●Threat Identification and Continuous Monitoring. Our third-party IT service providers provide 24/7 security monitoring of our systems and networks, enabling real-time detection and response to potential threats. We supplement this with internal monitoring and periodic assessments designed to identify emerging risks and vulnerabilities before they can be exploited.\n\n●Third-Party Risk Management. We apply comprehensive due diligence in evaluating and onboarding third-party service providers with access to our systems or data, including assessment of their cybersecurity controls, compliance posture, and incident response capabilities. We maintain ongoing monitoring of key third-party relationships and require adherence to applicable security standards as a condition of engagement.\n\n●Employee Training and Awareness. We provide regular *cybersecurity* awareness training to all employees, incident response personnel, and senior management, covering best practices for data privacy and security, phishing recognition, and safe handling of sensitive information. This training is updated periodically to reflect the evolving threat landscape.\n\n●Incident Response Planning. We have implemented a formal cyber incident response plan that establishes clear protocols for the identification, escalation, assessment, and remediation of cybersecurity incidents. The plan defines reporting obligations to senior management, the Audit Committee, and the Board, with the goal of ensuring timely assessment of material incidents and compliance with applicable disclosure requirements. Our incident response plan is reviewed and tested annually through a cybersecurity tabletop exercise to validate its effectiveness and identify areas for improvement.\n\n●Integration with Enterprise Risk Management. Cybersecurity threats are evaluated alongside other material business risks as part of our broader enterprise risk management process, ensuring that cybersecurity considerations are embedded in strategic and operational decision-making at all levels of the organization.\n\n*Governance*\n\nThe Board is responsible for overseeing the assessment and management of major risks facing the Company, including cybersecurity risks. The Board has delegated primary oversight responsibility for information security matters to the Audit Committee, which receives periodic updates from management on the state of the Company's cybersecurity program, current and emerging threats, and the effectiveness of risk mitigation strategies and controls.\n\nAt the management level, our Chief Financial Officer (\"CFO\") has overall responsibility for cybersecurity risk management oversight, including the adequacy of risk mitigation strategies, systems, processes, and controls. The CFO receives regular updates from our internal IT team and third-party service providers on cybersecurity and information security matters, and communicates with the Audit Committee and the Board on a periodic basis, and promptly in the event of a significant incident, regarding the state of our cybersecurity posture and any material developments.\n\nDay-to-day cybersecurity operations are managed by our Director of IT, who leads an internal team of security professionals and coordinates with our third-party IT service providers. Our IT team includes a Certified Information Systems Security Professional (\"CISSP\") and other professionals with extensive experience across a range of cybersecurity and technology disciplines. This combination of internal expertise and external 24/7 monitoring support is designed to provide comprehensive coverage of our cybersecurity risk environment.\n\n33\n\n[Table of Contents](#TOC)\n\nThe Audit Committee reviews cybersecurity risk as part of its broader risk oversight responsibilities and maintains direct lines of communication with both the CFO and the Director of IT to ensure that material developments are escalated appropriately and that the Board maintains informed oversight of this critical risk area.\n\n*Cybersecurity Incidents*\n\nAs of the date of this report, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, cybersecurity threats are continuously evolving, and we cannot provide assurance that our program will prevent all incidents or that future incidents will not have a material impact on our business. For a more complete discussion of cybersecurity-related risks, see Part I, Item 1A, “Risk Factors.”"}