Company: CRUS
Filing Date: 2025-05-23
Form Type: 10-K
Source: 0000772406-25-000014
Chunk: 57

Company: CIRRUS LOGIC, INC.
Filing Date: 2025-05-23
Form: 10-K
Item: Item 1C
Chunk 57
---
ITEM 1C.  Cybersecurity

Cybersecurity risk management and strategy

We have policies and processes in place that are designed to assess, identify and manage material risks from cybersecurity threats.  We regularly assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.  We use recognized industry frameworks and standards as guides in identifying, assessing and managing cybersecurity risks relevant to our operations.  For example, we primarily use NIST CSF (National Institute of Standards and Technology Cybersecurity Framework) for this purpose.Key components of our cybersecurity risk management strategy include:•We have a dedicated Information Security team principally responsible for implementing and managing our cybersecurity strategy and controls.•We use industry standard technologies and tools appropriate to our operations which are designed to prevent and detect unauthorized access to, or compromise of, our network, servers, endpoints and external applications, such as multi-factor authentication, malware protection, firewalls and monitoring controls.•We regularly train our personnel on cybersecurity awareness and conduct periodic additional awareness and training activities such as simulated phishing campaigns.

28

Table of Contents 

•We have in place an Incident Response Plan that governs how we respond to and manage cybersecurity incidents. We conduct regular tabletop exercises to test our response to potential incidents.•We use third-party service providers where appropriate to design, implement and support aspects of our security processes as well as to monitor and test our safeguards.Our cybersecurity risk management strategy forms part of our overall enterprise risk management program. We conduct regular risk assessments designed to identify cybersecurity threats and other risks to the company.  These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence, and any potential damage that could result from such risks.  We also evaluate the sufficiency of our existing internal controls and monitor the effectiveness of such safeguards.  In response, we adjust our processes and controls as necessary.Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers.  For example, as part of our contract management process, we conduct IT security reviews, and require executive approval by the General Counsel, Chief Financial Officer and Executive Vice President of Global Operations in relation to products or services that could potentially expose our company to cybersecurity risks.As of the end of fiscal year 2025, we have not identified any risks from known cybersecurity threats (including as a result of any prior cybersecurity incidents) that have materially affected, or are reasonably likely to materially affect