Company: SNPS
Filing Date: 2025-12-22
Form Type: 10-K
Source: 0000883241-25-000028
Chunk: 70

Company: SYNOPSYS INC
Filing Date: 2025-12-22
Form: 10-K
Item: Item 1C
Chunk 70
---
 CSF implementation through regular third-party maturity assessments, which provide the basis for establishing performance goals for the coming period. We also closely monitor the ever-changing landscape of related laws and regulations and regularly update our policies and processes to promote continued compliance.Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process. As part of this process, appropriate personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. As part of the above approach and processes, we regularly engage with assessors, consultants, auditors, and other third-parties to help identify areas for continued focus, improvement and/or compliance.Since 2015, Synopsys is not aware of any material information security breaches and has not made any associated penalties/settlements, and the expenses we have incurred from cybersecurity incidents were immaterial. This 

29

Table of Contents

includes penalties and settlements, of which there were none. During the same time period, while some of our suppliers have experienced security breaches, none of these breaches have had a material impact on Synopsys.

In our risk factors, we describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See our risk factor disclosures in Part I, Item 1A of this Annual Report. 

Cybersecurity Governance

Information technology and data security, particularly cybersecurity, is a top area of focus for our Board of Directors (the Board), which considers these areas as essential for the success of our company and the broader technology industry in which we operate. Our Board is actively involved in overseeing cybersecurity risk management. At least once a year, senior management, including our Chief Information Security Officer (CISO), presents to the Board on Synopsys' cybersecurity performance and risk profile. Further, senior management and our CISO present semiannually to our Corporate Governance and Nominating Committee (CGN Committee) on Synopsys' cybersecurity risk oversight activities and cybersecurity preparedness efforts. The CGN Committee, a majority of whom are individuals with a strong background in cybersecurity and related matters, meets with members of senior management to review our information technology and data security policies and practices, and to assess current and potential threats, cybersecurity incidents and related risks. Our CISO reports directly to our executive management team and advises Synopsys on cybersecurity risks and assess