Company: GFS
Filing Date: 2025-03-20
Form Type: 20-F
Source: 0001709048-25-000024
Chunk: 39

Company: GLOBALFOUNDRIES Inc.
Filing Date: 2025-03-20
Form: 20-F
Item: Item 16K
Chunk 39
---
ITEM 16K. CYBERSECURITY

In the ordinary course of our business, we maintain sensitive data on our networks, including our intellectual property and proprietary or confidential business information relating to our business and that of our customers and business partners. Our and our service providers’ IT and computer systems store and transmit customer information, trade secrets, corporate data and personal information, and are otherwise essential to the operation of our production lines, which has in the past from time to time and may continue in the future to make us a target for cyberattacks. The secure maintenance of this information is critical to our business and reputation.

Risk Management and Strategy

GF’s cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks..

GF maintains a comprehensive, company-wide commitment and program to engage every employee to safeguard and protect our and our customers’ intellectual property and products. The program integrates information security, product security, operational security and cybersecurity into a comprehensive program that covers all phases of the customer experience. Annually, we conduct comprehensive security training for all employees, as well as more focused role-specific training for employees whose job roles require an enhanced level of security awareness and control as well as data and government product security. The program leverages and embraces GF’s experience as a Trusted Foundry and supplier of advanced semiconductors to the U. S. government and the aerospace and defense industry, as well as GF’s experience as a certified international Common Criteria standard (ISO 15408, CC Version 3.1) manufacturer, and adopts many of those stringent security capabilities to all GF locations and customers. We also work with outside consultants and external legal counsel to support our program in assessing, identifying and managing material risks from, and internal controls and processes relating to, cybersecurity threats, and ensuring compliance with all applicable related laws, regulations and rules (including notice, disclosure and remediation requirements).

As part of our security programs, we have mechanisms to detect and monitor unusual network activity and other cybersecurity threats, along with containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our products and have processes to assess those issues for potential cybersecurity impact or risk. Our dedicated cybersecurity team continually monitor cybersecurity threats to GF, and any incidents or potential incidents are flagged in our systems and escalated in accordance with our cybersecurity incident response policies and procedures. Our cybersecurity team receives regular reports on any incidents and potential incidents, with anything requiring further escalation to be reported to our Chief Executive Officer and Chief