Company: COHN
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001437749-25-007158
Chunk: 322

Company: Cohen & Co Inc.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1
Chunk 322
---
.﻿   

ITEM 1C. CYBERSECURITY

   Risk Management and Strategy
    
   The Company has processes in place to identify, assess, and monitor material risks from cybersecurity threats, which are part of the Company’s overall enterprise risk management process and have been embedded in the Company’s operating procedures, internal controls, and information systems.
    
   The Company’s comprehensive cybersecurity and information security framework includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. The framework leverages the National Institute of Standards and Technology Cyber Security Framework (“NIST CSF”) for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley for assessment of internal controls.
    
   The Company contracts with external firms to assess the Company’s cybersecurity controls relative to its peers using the NIST CSF. The Company also has a third-party risk management program that assesses risks from vendors and suppliers. In addition, the Company maintains business continuity and disaster recovery plans as well as a cybersecurity insurance policy.
    
   The Company has established cybersecurity and information security awareness training programs. Formal training on topics relating to the Company’s cybersecurity, data privacy, and information security policies and procedures is mandatory at least annually for all employees. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors, or safety issues. Based on role and location, some employees receive additional in-depth training to provide more comprehensive knowledge on potential risks related to their individual job responsibilities. Training is supplemented through regular Company communications with frequent updates to educate on the latest adversary trends and social engineering techniques. Certain employees also obtain industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.
    
   The Company engages in cyber crisis response simulations to assess the Company’s ability to adapt to information and operational technology threats. Improper or illegitimate use of the Company’s information system resources or violation of the Company’s information security policies and procedures is subject to disciplinary action. The Company’s security posture is supported by a comprehensive defense-in-depth strategy that relies on layers of technology including multi-factor authentication and principles of zero trust to ensure that access to information and communication is vetted and secure.
    
   The Company also utilizes internal and external audits and assessments, vulnerability testing, governance processes over outsourced service providers, active risk management, and benchmarking against peers in the industry to validate the Company’s security posture. The Company also engages external firms to measure the Company’s