Company: AEHR
Filing Date: 2025-07-28
Form Type: 10-K
Source: 0001654954-25-008553
Chunk: 215

Company: AEHR TEST SYSTEMS
Filing Date: 2025-07-28
Form: 10-K
Item: Item 1B
Chunk 215
---
None.

ITEM 1C. Cybersecurity

Cybersecurity Risk Management and Strategy

We have established processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. To prevent, detect and respond to information security threats, we maintain a cyber risk management program that employs Cyber Security Framework (“CSF”) in accordance with the National Institute of Standards and Technology (“NIST”) security framework. CSF is a set of voluntary guidelines that help organizations assess and improve their cybersecurity posture by implementing processes for identifying and mitigating risk, and detecting, responding to and recovering from cyberattacks. 

We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. 

 20Table of Contents

Our Security Awareness Program includes training that reinforces our information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Company’s resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by Company-wide testing initiatives. 

Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers or who have access to our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.

While we have not, as of the date of this Report, experienced any material cybersecurity incidents that materially affected us, including our operations, business strategy, results of operations, or financial condition, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business, financial condition, results of operations. See “Risk Factors – We are exposed to cybersecurity threats or incidents.”

Cybersecurity Governance

One of the key functions of