{"url_path":"/sec/fdct/10-k/2026/item-1c","section_key":"item-1c","section_title":"Item 1C **","topic":"sec","document":{"doc_type":"10-K/A","doc_date":"2026-06-08","source_url":"https://www.sec.gov/Archives/edgar/data/1722731/0001493152-26-027724-index.html","accession_number":"0001493152-26-027724","cik":"0001722731","ticker":"FDCT","issuer_name":"FDCTECH, INC.","edgar_url":"https://www.sec.gov/Archives/edgar/data/1722731/0001493152-26-027724-index.html","primary_entity_key":"0001722731","primary_entity_name":"FDCTECH, INC."},"word_count":583,"has_tables":true,"body_markdown":"**ITEM\n1C.**\n**CYBERSECURITY**\n\n \n\n**Risk\nManagement and Strategy**\n\n** **\n\nThe\nCompany has adopted a cybersecurity risk management framework designed to identify, assess,\nand manage material risks arising from cybersecurity threats to its information systems,\nclient data, and financial technology infrastructure. Key elements of our framework include:\n\n \n\n \n●\n**Threat\nidentification and assessment.** We conduct periodic assessments of our information systems to identify vulnerabilities, evaluate\npotential cybersecurity threats, and prioritize remediation efforts based on risk severity. These assessments incorporate threat\nintelligence from industry sources and regulatory guidance issued by the financial authorities that govern our subsidiaries, including\nthe Malta Financial Services Authority (MFSA) and the UK Financial Conduct Authority (FCA).\n\n \n \n \n\n \n●\n**Technical\nsafeguards.** We employ a combination of industry-standard security technologies including network access controls, data encryption,\nmulti-factor authentication, intrusion detection systems, and endpoint protection tools across our global operations.\n\n \n \n \n\n \n●\n**Incident\nresponse.** We maintain written incident response procedures that establish protocols for detecting, containing, and remediating\ncybersecurity incidents, including escalation procedures to senior management and, where applicable, regulatory notification obligations.\n\n \n \n \n\n \n●\n**Employee\ntraining.** We provide cybersecurity awareness training to employees and contractors with access to our information systems, with\nemphasis on phishing, social engineering, and data handling practices.\n\n \n \n \n\n \n●\n**Third-party\nrisk management.** We rely on certain third-party\nservice providers for technology infrastructure, cloud computing, and payment processing. We assess the cybersecurity practices of\nmaterial vendors as part of our onboarding and ongoing monitoring processes; however, we cannot guarantee that third parties will\nmaintain adequate safeguards at all times.\n\n \n \n \n\n \n●\n**Integration\nwith enterprise risk management.** Cybersecurity risk is considered as part of the Company’s overall enterprise risk management\nprocess. Material cybersecurity risks are reported to senior management and escalated to the Board of Directors as warranted.\n\n \n\n15 \n\n \n\n \n\nThe\nCompany’s regulated subsidiaries are subject to cybersecurity and data protection requirements\nunder applicable financial services regulations, including requirements imposed by the MFSA,\nFCA, and ASIC. Compliance with these frameworks is reviewed as part of each subsidiary’s\nongoing regulatory supervision.\n\n \n\nAt\nDecember 31, 2025, we are not aware of any cybersecurity incidents that have materially affected, or are reasonably likely to materially\naffect, our business, results of operations, or financial condition. We recognize, however, that the threat landscape is continuously\nevolving, and there can be no assurance that our controls will prevent all future incidents. See “Item 1A — Risk Factors”\nfor a discussion of cybersecurity-related risks.\n\n** **\n\n**Governance**\n\n** **\n\n*Board\nOversight.* The Board\nof Directors is responsible for overseeing the Company’s cybersecurity risk management.\nSenior management provides the Board with periodic updates on the cybersecurity threat environment,\nthe status of the Company’s security posture, significant vulnerabilities or incidents,\nregulatory developments, and the effectiveness of remediation efforts. The\nBoard reviews and approves the Company’s overall risk management framework, within\nwhich cybersecurity risk is addressed, and engages with management on cybersecurity matters\nas circumstances warrant.\n\n* *\n\n*Management’s\nRole.* Primary responsibility\nfor cybersecurity risk management rests with the Company’s Chief Executive Officer, Mitchell M. Eaglstein, who also serves as the\nCompany’s principal technology and operations executive and Chief Financial Officer, Imran Firoz, who serves as the Company’s\nprincipal finance and controller executive. Mr. Eaglstein and Mr. Firoz have over 20 years of experience each in financial technology\nand SEC-reporting companies, with extensive involvement in information systems, regulatory compliance, and operational risk management.\nDay-to-day cybersecurity activities are coordinated by our\ntechnology team across our operating subsidiaries, with support from external IT security consultants where specialized expertise is\nrequired. Management reports cybersecurity matters to the Board through regular updates and, for potentially material incidents, through\nimmediate escalation."}