The following discussion presents information about our consolidated results of operations, financial condition, liquidity and capital resources and should be read in conjunction with our consolidated financial statements and the notes thereto beginning on page F-1 of this Annual Report.

Overview

We are engaged in the business of providing IT or cybersecurity services, privacy and compliance services to the healthcare and other industries. Our business is operated throughout the United States.

We support the United States healthcare market to help organizations identify and protect against the ever-changing threat factors, develop and mature their security and privacy programs aligned to the globally recognized NIST frameworks and comply with regulations and standards including the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Health Information Technology for Economic and Clinical Health Act ("HITECH") Breach Notification Rule, Federal Trade Commission consumer protection guidelines and state privacy standards.

We are one of the few consulting and advisory companies focused in the healthcare industry, and our years of experience of understanding the industry's unique challenges allows us to provide our customers with services designed around industry best practices and a methodology to evaluate the rigor and effectiveness of their programs to improve security controls, policies and procedures and to protect patient health information. Our team of subject matter experts and consultants are comprised of knowledgeable professionals who have learned their craft both in the classroom and through years of practical on-the-job experience, including as policy makers, attorneys and leaders in cybersecurity, privacy and compliance.

--------------------------------------------------------------------------------


                                       14

--------------------------------------------------------------------------------

Table of Contents

--------------------------------------------------------------------------------

Our services are categorized into four groups which are assessment and audit, technical testing, program development and remediation, and monitoring and advisory services. These services are delivered as recurring managed services or under consulting or professional services engagements.

·Assessment and Audit Services - identify and measure security and privacy risk of an organization's readiness and verify and validate their programs meet compliance and business objectives.

·Technical Testing Services - test the effectiveness of controls in an organization's environment.

·Program Development and Remediation Services - develop policies and procedures and playbooks to help build out a fully comprehensive risk management program and provide resources to help organizations prioritize, implement and execute initiatives to strengthen their security and privacy programs.

·Monitoring and Advisory Services - provide on-going management and oversight of specific components of an organization's security and privacy programs to address or give alerts when an issue arises and to offer our expertise that they need to accelerate the effectiveness of their programs.

Prior to March 20, 2019, we provided document solutions to the healthcare industry. See Note 19 to the consolidated financial statements regarding discontinue operations.





Results of Operations

Year Ended December 31, 2019 Compared to the Year Ended December 31, 2018

Net Revenue

Revenue was $21.4 million for the year ended December 31, 2019, as compared to $21.3 million for the same period in 2018. Revenue increased $1.1 million from new multi-year managed service revenues and approximately $0.6 million from the addition of the Backbone business. Those increases were offset by $1.6 million in lower revenues from consulting and professional services, primarily due to the completion of a large non-recurring contract for one of our largest customers.

Cost of Revenues

Cost of revenue primarily consists of salaries and related expenses for direct labor and indirect support staff. Cost of revenue was $13.0 million for the year ended December 31, 2019, as compared to $11.1 million for the same period in 2018. This increase was almost entirely related to an increase in salaries and related costs due to increased headcount in order to support new services, and our efforts to augment the employee salary and benefit offerings to attract and retain talent and incremental cost of revenues from the Backbone acquisition.

Gross margin was 39% of revenue for the year ended December 31, 2019, and 48% for the same period in 2018. The reduction in gross margin is reflective of our investment in attracting talented cyber security employees, costs associated with ramping up our new managed services offerings and the lower than expected Consulting and Professional Services revenue from new and existing customers.

Sales and Marketing

Sales and marketing expenses include salaries, commissions and expenses for sales and marketing personnel, travel and entertainment, and other selling and marketing costs. Sales and marketing expenses were $5.3 for the year ended December 31, 2019, as compared to $5.2 million for the same period in 2018. The small increase is a result of additional marketing expenses incurred in an effort to increase sales including tradeshow and program related marketing expenses.

General and Administrative

General and administrative expenses include personnel costs for finance, administration, human resources, information systems, and general management, as well as facilities expenses, professional fees, legal expenses and other administrative costs. General and administrative expenses increased by $0.5 million to $6.9 million for the

--------------------------------------------------------------------------------


                                       15

--------------------------------------------------------------------------------

Table of Contents

--------------------------------------------------------------------------------

year ended December 31, 2019, as compared to $6.4 million for the same period in 2018. The increase in general and administrative expenses is attributed to 1) $0.9 million in non-recurring expenses related to the onboarding of our new CEO while our outgoing CEO remained as part of the transition, severance related costs associated with targeted cost reductions and transaction fees associated with the Backbone acquisition; and 2) $0.3 million in software subscriptions and support costs for streamlining operations and business tracking. These additional costs were primarily offset by lower costs of $0.6 million in severance paid to a departed executive in 2018. We are continuing to look at additional areas we might be able to further reduce costs.

Valuation of Contingent Earnout

In 2018, we performed a valuation of the contingent earn-out to the sellers of CTEK Security, Inc. and incurred $0.3 million in earnout charges for meeting the 2018 criteria and we accrued an additional $178,269 related to the potential for payout for meeting earnout criteria in 2019 and 2020. We did not hit the 2019 earnout targets and marked down the balance to $0 for the potential of not hitting the 2020 target. In November 2019, with the acquisition of Backbone, we added $2.4 million of contingent earnout charges and liabilities.

Depreciation

Depreciation increased to $180,000 for the year ended December 31, 2019 as compared to $150,000 for the same period in 2018 due to an increase in purchased software related to automation tools.

Amortization

Amortization expense was steady at $1.9 million for the year ended December 31, 2019 compared to the $1.8 million for same period in 2018.

Revision of Useful Life and Impairment of Definite-Live Intangible Assets

At the end of 2019, we made the decision to phase out the Delphiis acquired technology to move to another third-party platform that provides more flexibility in the services we provide and allows us to reduce expenses related to maintaining this tool. As a result, we updated our evaluation of the estimated useful life of the related intangible asset and accelerating amortization of the remaining balance of $77,000 in 2019.

Additionally, we identified events and circumstances related to the future revenue projections of the cybersecurity consulting business we acquired in 2017 compared to the original projections that indicated we should review our long-lived assets for impairment. The Company engaged a valuation expert to assist management in updating its analysis of the fair value of the intangible assets. We determined that the carrying value of customer relationships exceeded its estimated fair value resulting in an impairment charge of $0.5 million in 2019.

Other Income (Expense)

Net interest expense for the year ended December 31, 2019 was $0.5 million compared to $1.4 million for the same period in 2018. The decrease was due to a lower outstanding debt balance after the payoff of the term loan and paydown of the promissory notes from the proceeds of the sale of the managed print services business.

Income Tax Benefit (Expense)

Income tax benefit was $1.5 million for the year ended December 31, 2019 as compared to $1.3 million in 2018. Income tax expense is based on estimated annual income tax rates that we anticipate for the tax years.

Discontinued Operations

On March 20, 2019, we sold our assets used in the provision of our managed print services business division and the buyer assumed certain liabilities relating to this business. See Note 19 for additional details.

--------------------------------------------------------------------------------


                                       16

--------------------------------------------------------------------------------

Table of Contents

--------------------------------------------------------------------------------

Liquidity and Capital Resources

As of December 31, 2019, our cash balance was $5.3 million, current assets minus current liabilities was positive $6.0 million and our debt and lease obligations totaled $0.4 million, excluding our office lease space in Mission Viejo, California, that we sublease fully to two subtenants. The level of additional cash needed to fund operations and our ability to conduct business for the next twelve months will be influenced primarily by the following factors:

? our ability to access the capital and debt markets;

? our ability to manage our operating expenses and maintain gross margins as the Company grows while attracting, recruiting and retaining cybersecurity professionals;

? demand for our cybersecurity services from healthcare providers; the near-term impact of the Coronavirus on our customers allocation of time and resources to cybersecurity and their ability to enter into new contractual arrangements during a period of crisis; and

? general economic conditions and changes in healthcare reimbursement and regulatory environment.

We have historically funded our operating costs, acquisition activities, working capital requirements and capital expenditures with cash from operations, proceeds from the issuances of our common stock and other financing arrangements. Following the sale of the MPS business in 2019, we are now a much smaller cybersecurity focused business with significantly lower debt balances and debt service obligations. However, we also have less scale over which to leverage our operating expenses and public company expenses and are currently operating in a cash flow negative position while we seek to grow the cybersecurity business. During 2019, we reported a loss from continuing operations of $5.4 million and cash used in operating activities from continuing operations was $1.6 million.

Our operating plan for the next twelve months contemplates raising additional equity and/or debt capital, investing in enhancing our sales and operational resources while also streamlining our operations to reduce costs and improve financial performance while we expand our cybersecurity business.

While we have approximately $6 million of working capital as of December 31, 2019, we do expect to raise additional capital to grow the business. Management believes potential sources of liquidity include at least the following:

? In March 2020, the Company received a funding commitment in the amount of $2.5 million from an existing investor.

? On March 27, 2020 President Trump signed the Coronavirus Aid, Relief, and Economic Security Act which provides economic relief to businesses. The Company is currently evaluating the opportunity to receive a loan under this program.

? On October 10, 2017, the Company filed a registration statement on Form S-3 to register an indeterminate number of securities. On November 22, 2017, we filed an Amendment No. 1 to such registration statement on Form S-3 to update the information in the registration statement. The registration statement covers such indeterminate principal amount or number of shares of Common Stock, debt securities, warrants and number of units of the registrant with an aggregate initial offering price not to exceed $15.0 million. The registration statement on Form S-3 was declared effective on November 22, 2017.

If these capital resources are not available, or not available on reasonable terms, we also have the ability to significantly reduce personnel and other variable and semi-variable costs to conserve cash and operate as a going concern. However, those actions if required, could negatively impact growth and the long-term value of the business.

Further, in late 2019, a novel strain of coronavirus was first detected in Wuhan, China. Following the outbreak of this virus, governments throughout the world, including in the United States of America, have

--------------------------------------------------------------------------------


                                       17

--------------------------------------------------------------------------------

Table of Contents

--------------------------------------------------------------------------------

quarantined certain affected regions, restricted travel and imposed significant limitations on other economic activities. The Company's operations team is closely monitoring the potential impact to the Company's business, including its cash flows, customers and employees. If the situation impacts our customers cash flow or resources available for cybersecurity projects, our cash flows, financial position and operating results for fiscal year 2020 and beyond will be negatively impacted. Neither the length of time nor the magnitude of the negative impacts can be presently determined.

As we execute our growth plans over the next 12 months, we intend to carefully monitor the impact of growth on our operating expenses, working capital needs and cash balances relative to the availability of cost-effective debt and equity financing. In the event that capital is not available, we may then have to scale back or freeze our organic growth plans, sell assets on less than favorable terms, reduce expenses, and/or curtail future acquisition plans to manage our liquidity and capital resources. However, we cannot provide assurance that we will be able to raise additional capital.

In addition, our business is subject to additional risks and uncertainties, including, but not limited to, those described in Item 1A. "Risk Factors".

Off-Balance Sheet Arrangements

Our off-balance sheet arrangements consist primarily of purchase and other commitments arising in the normal course of business, as further discussed below under the section "Contractual Obligations, Contingent Liabilities and Commitments." As of December 31, 2019, we did not have any other relationships with unconsolidated entities or financial partners, such as entities often referred to as structured finance or special purpose entities, which would have been established for the purpose of facilitating off-balance sheet arrangements or other contractually narrow or limited purposes.

Application of Critical Accounting Policies

The SEC defines critical accounting policies as those that are, in management's view, most important to the portrayal of our financial condition and results of operations and most demanding of our judgment. The discussion and analysis of our financial condition and results of operations are based upon our financial statements, which were prepared in accordance with accounting principles generally accepted in the U.S., which is referred to as "GAAP." The preparation of these financial statements requires us to make estimates and judgments that affect the reported amounts of assets, liabilities, revenues and expenses, and related disclosures of contingent assets and liabilities. On an on-going basis, we evaluate these estimates, including those related to stock-based compensation, customer programs and incentives, bad debts, supply inventories, intangible assets, income taxes, contingencies and litigation. We base our estimates on historical experience and on various other assumptions that are believed to be reasonable under the circumstances, the results of which form the basis for making judgments about the carrying values of assets and liabilities that are not readily apparent from other sources. Actual results may differ from these estimates under different assumptions or conditions.

We consider the following accounting policies to be those most important to the portrayal of our financial condition and those that require the most subjective judgment:

Revenue Recognition and Deferred Revenue

We operate under a consolidated strategy and management structure, deriving revenue from the following sources:

oManaged services

oConsulting and professional services

Revenue is recognized pursuant to ASC Topic 606, "Revenue from Contracts with Customers" (ASC 606). Accordingly, revenue is recognized at an amount that reflects the consideration to which we expect to be entitled in exchange for transferring goods or services to a customer. This principle is applied using the following 5-step process:

--------------------------------------------------------------------------------


                                       18

--------------------------------------------------------------------------------

Table of Contents

--------------------------------------------------------------------------------

1.Identify the contract with the customer - A contract with a customer exists when (i) we enter into an enforceable contract with a customer that defines each party's rights regarding the services to be transferred and identifies the payment terms related to these services, (ii) the contract has commercial substance and the parties are committed to perform, and (iii) we determine that collection of substantially all consideration to which it will be entitled in exchange for services that will be transferred is probable based on the customer's intent and ability to pay the promised consideration.

2.Identify the performance obligations in the contract - Performance obligations promised in a contract are identified based on the services that will be transferred to the customer that are both capable of being distinct, whereby the customer can benefit from the service either on its own or together with other resources that are readily available from third parties or from us, and are distinct in the context of the contract, whereby the transfer of the services is separately identifiable from other promises in the contract. To the extent a contract includes multiple promised services, we apply judgment to determine whether promised services are capable of being distinct and distinct in the context of the contract. If these criteria are not met the promised services are accounted for as a combined performance obligation.

3.Determine the transaction price - The transaction price is determined based on the consideration to which we will be entitled in exchange for transferring services to the customer.

4.Allocate the transaction price to the performance obligations in the contract - If the contract contains a single performance obligation, the entire transaction price is allocated to the single performance obligation. Contracts that contain multiple performance obligations require an allocation of the transaction price to each performance obligation based on a relative standalone selling price ("SSP") basis. Determination of SSP requires judgment. We determine standalone selling price taking into account available information such as historical selling prices of the performance obligation, overall strategic pricing objective, market conditions and internally approved pricing guidelines related to the performance obligations.

5.Recognize revenue when (or as) each performance obligation is satisfied - We satisfy performance obligations over time. Revenue is recognized over the time the related performance obligation is satisfied by transferring a promised service to a customer.





Managed Services

Managed services revenue is earned monthly during the term of the contract, as services are provided at a fixed fee and is recognized ratably over the contract term beginning on the commencement date of the contract. Managed services contracts are typically long-term contracts lasting three years. Revenue related to managed services provided is recognized based on the customer utilization of such resources, which management estimates to occur ratably over the customer contract term.

Prior to our sale of the MPS business in March 2019, our contracts with managed print service customers included provisions that related to guaranteed savings amounts and shared savings. Such provisions were considered by management during our initial proprietary client assessment. Our historical settlement of such amounts had been within management's estimates.

Consulting and Professional Services

Consulting and professional services contracts are typically short-term, project-based services rendered on either a fixed fee or a time and materials basis. These contracts are normally for a duration of less than one year. For fixed fee arrangements, revenue is normally recognized ratably over the term of the project. For time and materials arrangements, revenues are recognized as the services are rendered.

Deferred and Unbilled Revenue

We receive payments from customers based on billing schedules established in our contracts. Deferred revenue primarily consists of billings or payments received in advance of the amount of revenue recognized and

--------------------------------------------------------------------------------


                                       19

--------------------------------------------------------------------------------

Table of Contents

--------------------------------------------------------------------------------

such amounts are recognized as the revenue recognition criteria are met.

Unbilled revenue reflects our conditional right to receive payment from customers for our completed performance under contracts.

Accounts Receivable Valuation and Related Reserves

We estimate the losses that may result from that portion of our accounts receivable that may not be collectible as a result of the inability of our customers to make required payments. Management specifically analyzes customer concentration, customer creditworthiness, current economic trends and changes in customer payment terms when evaluating the adequacy of the allowance for doubtful accounts. We review past due accounts on a monthly basis and record an allowance for doubtful accounts where we deem appropriate.

Impairment Review of Goodwill and Intangible Assets

We periodically evaluate our intangible assets and goodwill relating to acquisitions for impairment. Goodwill is not amortized but is evaluated at least annually at year end for any impairment in the carrying value. We review our intangible assets for impairment whenever events or changes in circumstances indicate that the carrying value of such assets may not be recoverable. Factors we consider important which could trigger an impairment review include, but are not limited to, the following: significant underperformance relative to expected historical or projected future operating results; significant changes in the manner of our use of the acquired assets or the strategy for our overall business; and a significant negative industry or economic trend for a sustained period. Goodwill and intangible asset impairment assessments are generally determined based on fair value techniques, including determining the estimated future discounted and undiscounted cash flows over the remaining useful life of the asset. Those models require estimates of future revenue, profits, capital expenditures and working capital for each reporting unit. We estimate these amounts by evaluating historical trends, the current state of the Company's industries and the economy, current budgets, and operating plans. Determining the fair value of reporting units and goodwill includes significant judgment by management and different judgments could yield different results. Any resulting impairment loss could have a material impact on our financial condition and results of operations.





Stock-Based Compensation

Under the fair value recognition provisions of the authoritative guidance, stock-based compensation cost granted to employees is measured at the grant date based on the fair value of the award and is recognized as expense over the requisite service or performance period, which is the vesting period. Stock options and warrants issued to consultants and other non-employees as compensation for services to be provided to us are accounted for based upon the fair value of the services provided or the estimated fair value of the option or warrant, whichever can be more clearly determined. We currently use the Black-Scholes option pricing model to determine the fair value of stock options.

The determination of the fair value of stock-based payment awards on the date of grant using an option-pricing model is affected by our stock price as well as assumptions regarding a number of complex and subjective variables. These variables include our expected stock price volatility over the term of the awards, the expected term of the award, the risk-free interest rate and any expected dividends. Compensation cost associated with grants of restricted stock units are also measured at fair value on the date of the grant. We evaluate the assumptions used to value restricted stock units on a quarterly basis. When factors change, including the market price of the stock, stock-based compensation expense may differ significantly from what has been recorded in the past. If there are any modifications or cancellations of the underlying unvested securities, we may be required to accelerate, increase or cancel any remaining unearned stock-based compensation expense.

Income Taxes

Deferred tax assets and liabilities are recognized for the future tax consequences attributable to differences between the financial reporting requirements and those imposed under federal and state tax laws. Deferred taxes are provided for timing differences in the recognition of revenue and expenses for income tax and financial reporting purposes and are measured using enacted tax rates expected to apply to taxable income in the years in which those temporary differences are expected to be recovered or settled. The effect on deferred tax assets and liabilities of a change in tax rates is recognized in income in the period that includes the enactment date. Deferred income tax expense represents the change during the period in the deferred tax assets and liabilities. Realization of the deferred tax asset is largely dependent on generating sufficient taxable income in future years. Deferred tax assets are

--------------------------------------------------------------------------------


                                       20

--------------------------------------------------------------------------------

Table of Contents

--------------------------------------------------------------------------------

reduced by a valuation allowance when, in the opinion of management, it is more likely than not that some portion or all the deferred tax assets will not be realized. Use of our net operating loss deferred assets may be limited by changes in our ownership.

The above listing is not intended to be a comprehensive list of all of our accounting policies. In many cases, the accounting treatment of a particular transaction is specifically dictated by GAAP, with no need for management's judgment in its application. There are also areas in which management's judgment in selecting any available alternative would not produce a materially different result. Please see our audited financial statements and notes thereto which begin on page F-1 of this Annual Report on Form 10-K, which contain accounting policies and other disclosures required by GAAP and please refer to the disclosures in Note 1 of our financial statements for a summary of our significant accounting policies.

Recent Accounting Pronouncements

Refer to Note 1 to the consolidated financial statements for information regarding recent accounting pronouncements.

© Edgar Online, source Glimpses