Cultivate Capital Business Continuity Plan and Information Security Program (the “BCP”)

Cultivate Capital Group, LLC maintains this Business Continuity Plan and Information Security Program in accordance with FINRA Rule 4370. The BCP is designed to enable the Firm to continue operations and meet its regulatory obligations in the event of a significant business disruption.

The Firm does not maintain customer accounts and does not accept or hold investor funds, except for limited-purpose accounts associated with Regulation Crowdfunding offerings. The Firm’s BCP reflects its limited-purpose broker-dealer model and reliance on third-party service providers for transaction processing, escrow, communications, and record retention.

       A.   Emergency Contacts and Plan Maintenance

The Firm has designated two emergency contact persons and has provided this information to FINRA electronically. The CEO, as the Firm’s Executive Representative, is responsible for ensuring that emergency contact information is reviewed and updated:

· annually, within seventeen (17) business days following the end of each calendar year; and

· promptly upon any material change.

The CEO is responsible for reviewing this BCP at least annually and updating it as necessary to reflect material changes in the Firm’s operations, personnel, systems, or third-party service providers.

       B.   Business Disruptions

A business disruption is any event that materially impacts the Firm’s ability to conduct business or access critical systems, personnel, or records. Disruptions may be caused by natural events (e.g., hurricanes, earthquakes, severe weather), technological failures (e.g., power outages, telecommunications failures, cybersecurity incidents), or other events that prevent normal operations.

Given the Firm’s remote work model, disruptions may also include localized outages affecting individual personnel or service providers rather than physical office locations.

       C.   Continuity of Operations

In the event of a business disruption, Cultivate Capital will take reasonable steps to continue operations to the extent practicable, including:

· shifting work to unaffected personnel or locations;

· utilizing remote access to systems and records;

· coordinating with third-party service providers to restore access or functionality; and

· prioritizing regulatory, compliance, and operational obligations.

Because the Firm does not handle investor funds or maintain customer accounts, business continuity focuses on preserving access to records, communications, compliance functions, and regulatory reporting rather than transaction execution or customer servicing.

       D.   Third-Party Service Providers

Cultivate Capital relies on third-party service providers for certain critical functions, including transaction processing, escrow services, communications archiving, and record retention.

For business continuity planning purposes, the Firm operates under the conservative assumption that any third-party service provider could experience a significant disruption or failure. Accordingly, the Firm evaluates:

· whether affected activities can be temporarily suspended without regulatory harm;

· whether alternative providers or processes are available; and

· whether delayed resumption of services would materially impact the Firm’s obligations.

The Firm maintains contact information for key vendors and periodically assesses vendor resilience as part of its overall risk management process.

       E. Information Security

The Firm maintains information security measures designed to protect Firm systems, data, and records from unauthorized access, loss, or misuse. These measures include, as appropriate:

· controls over system access and user entitlements;

· password and authentication requirements;

· restrictions on unauthorized devices or systems;

· audit trails for system access and changes; and

· procedures for responding to cybersecurity incidents.

Information security controls are reviewed periodically and updated as necessary based on changes in technology, vendors, or regulatory expectations.

       F. Regulatory Communications and Records

In the event of a business disruption, the Firm will make reasonable efforts to:

maintain access to required books and records;

respond promptly to regulatory requests; and

notify regulators as required if operations are materially impacted.

Records are maintained electronically and backed up through Firm systems and third-party providers.

       G.   Employee Awareness

All Firm personnel are encouraged to familiarize themselves with the BCP and to promptly report any event or condition that could materially disrupt Firm operations. Questions regarding the BCP should be directed to the CEO or the CCO.