The Company maintains processes designed to assess, identify and manage material risks from cybersecurity threats. Because the Company’s Hotel and corporate operations depend substantially on information technology systems operated or supported by third parties, the Company’s cybersecurity risk management processes address risks arising from both its corporate technology environment and the third-party systems used in the operation and franchising of the Hotel.

Risk Management and Strategy

The Company’s technology environment generally consists of three principal areas. First, the Hotel utilizes systems and technology provided and maintained by Hilton in connection with reservations, booking, marketing and other franchise-related functions. Second, Aimbridge Hospitality (“Aimbridge”), as manager of the Hotel, provides and maintains systems used for Hotel-level accounting, operations and administrative support. Third, the Company’s corporate office relies on a third-party information technology and cybersecurity provider and third-party software platforms, including Yardi, for accounting and administrative functions. A substantial portion of the Company’s corporate operations and communications are conducted through internet-based systems and third-party technology platforms.

Because of the Company’s size, it does not maintain a dedicated internal cybersecurity department and instead relies on its third-party information technology and cybersecurity provider for technical cybersecurity expertise and services relating to its corporate technology environment.

The Company’s cybersecurity risk and vulnerability assessments:

The Company uses its third-party information technology and cybersecurity provider and related cybersecurity tools and services to assist in monitoring its corporate technology environment, evaluating vulnerabilities and addressing identified cybersecurity risks. Hotel personnel also complete annual Payment Card Industry (“PCI”) compliance certification and training requirements through both Hilton and Aimbridge.

The Company’s cybersecurity risk management processes are integrated into its overall risk management processes.

Third-Party Service Providers

The Company depends substantially on third-party technology and service providers for systems used in its operations. Hilton provides and maintains systems used for reservations, booking, marketing and other franchise-related functions, while Aimbridge provides and maintains systems used for Hotel-level accounting, operations and administrative support. Hilton and Aimbridge maintain their own cybersecurity programs and controls, and Hotel personnel complete annual PCI compliance certification and training requirements through both organizations.

The Company also relies on its third-party information technology and cybersecurity provider for its corporate technology environment and on third-party software platforms, including Yardi, for certain accounting and administrative functions.

The Company does not directly control the cybersecurity systems, practices or infrastructure of Hilton, Aimbridge, Yardi or its other third-party service providers. Accordingly, a cybersecurity incident affecting one of these providers could adversely affect the Company even if the Company’s corporate systems were not directly compromised.

Management and Board Oversight

The Company’s management is responsible for overseeing the assessment and management of material risks from cybersecurity threats. Because the Company does not maintain a dedicated internal cybersecurity department, management relies on its third-party information technology and cybersecurity provider, as well as information received from material technology and service providers, to assist in identifying, assessing and responding to cybersecurity risks.

The Company’s Controller and Principal Financial Officer is responsible for coordinating the Company’s cybersecurity risk management activities with its third-party information technology and cybersecurity provider. The Controller and Principal Financial Officer receive information regarding identified cybersecurity risks, vulnerabilities and incidents and is responsible for escalating material cybersecurity matters to senior management and, when appropriate, the Board of Directors. The Controller and Principal Financial Officer is not a dedicated cybersecurity professional; the Company relies on its third-party information technology and cybersecurity provider for technical cybersecurity expertise and services.

Management monitors cybersecurity risks through communications with the Company’s third-party information technology and cybersecurity provider, assessments of identified risks and vulnerabilities, and information received from material third-party service providers.

The Board of Directors oversees risks from cybersecurity threats and receives periodic reports from management regarding cybersecurity risks, incidents and risk mitigation measures. Material cybersecurity incidents would be reported to the Board as appropriate. The Board reviews the Company’s cybersecurity risk management processes and incident-response planning at least annually.

Effect of Cybersecurity Risks

Risks from cybersecurity threats, including risks associated with third-party systems used by the Company, have not materially affected the Company, including its business strategy, results of operations or financial condition. The Company did not identify any cybersecurity incident during the fiscal year ended June 30, 2026, that materially affected the Company.

The Company has not identified any cybersecurity threat that management currently believes is reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

The Company nevertheless remains subject to cybersecurity risks arising from its own technology environment and from systems maintained by Hilton, Aimbridge, Yardi and other third-party service providers. A material cybersecurity incident affecting any of these systems could disrupt Hotel or corporate operations, compromise confidential or proprietary information, result in legal or regulatory exposure, or otherwise materially adversely affect the Company’s business, results of operations or financial condition. See Item 1A – Risk Factors.