Company: COHN
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001437749-25-007158
Chunk: 1241

Company: Cohen & Co Inc.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1A
Chunk 1241
---
 certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.
    
   The Company engages in cyber crisis response simulations to assess the Company’s ability to adapt to information and operational technology threats. Improper or illegitimate use of the Company’s information system resources or violation of the Company’s information security policies and procedures is subject to disciplinary action. The Company’s security posture is supported by a comprehensive defense-in-depth strategy that relies on layers of technology including multi-factor authentication and principles of zero trust to ensure that access to information and communication is vetted and secure.
    
   The Company also utilizes internal and external audits and assessments, vulnerability testing, governance processes over outsourced service providers, active risk management, and benchmarking against peers in the industry to validate the Company’s security posture. The Company also engages external firms to measure the Company’s NIST CSF maturity level.
    
   No risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition.

   Governance
    
   Role of the Board and Management
    
   The Company’s board recognizes the importance of cybersecurity in safeguarding the Company’s sensitive data. The board is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage, and mitigate risk, at least annually. The board has delegated responsibility for oversight of the Company’s cybersecurity, information security framework, and risk management to the Company’s management cybersecurity committee (the “Cybersecurity Committee”).
    
   Pursuant to its charter, the Cybersecurity Committee must consist of at least four members of the Company’s executive management team, which shall include the Company’s director of technology, chief operating officer, chief compliance officer, and chief financial officer, each of whom is required to have working familiarity, knowledge, and competencies in relevant areas, including data privacy, public policy, information technology (“IT”) strategy, IT development and deployment, or IT risk assessment and management, including information security management. In addition, the Company’s director of technology has formal education in IT and extensive experience working in and leading the Company’s information systems and technology function. 
    
   The principal responsibilities and duties of the Cybersecurity Committee, pursuant to its written charter, are to:
    
     ●  Review and provide oversight on the effectiveness of the Company’s information security and privacy