Company: TSEM
Filing Date: 2025-04-30
Form Type: 20-F
Source: 0001178913-25-001537
Chunk: 263

Company: TOWER SEMICONDUCTOR LTD
Filing Date: 2025-04-30
Form: 20-F
Item: Item 16K
Chunk 263
---
ITEM 16K. CYBERSECURITY

Risk Management and Strategy

We believe an effective cybersecurity program is critical to guard the confidentiality, integrity, and availability of our information systems and data residing in those systems. We have built and continue to develop processes for assessing, identifying, preventing, mitigating and managing material risks from cybersecurity threats. We have embedded the oversight and management of cybersecurity risk within our enterprise risk management framework to guide our cybersecurity risk management program and help drive a company-wide culture of cybersecurity risk management. In addition, we have established policies and procedures as well as disclosure controls with a structured reporting mechanism to ensure proper and timely flow of information as well as appropriate management of events, threats and any related matter.

Our Information Technology Department uses a wide range of activities, including cybersecurity risk assessments, audits, vulnerability and penetration testing, security monitoring tools, and system scanning, among other technology and human resources, to monitor and identify cybersecurity threats and incidents, as well as to evaluate the effectiveness of our cybersecurity measures. We perform regular phishing testing on a monthly basis, and employees who fail the test receive a warning and in-person training on a quarterly basis. We provide an annual training on information security and cyber awareness for our personnel with >98% participation rate among all employees. In addition, we provide face-to-face training for all new employees on cybersecurity. New employees are also requested to sign a form detailing the permitted use of our computer resources. In addition, every quarter we send a cyber security awareness brochure to all employees. These training activities provide employees with effective tools to address cybersecurity threats and implement our evolving security processes and practices.

With respect to cybersecurity monitoring, we engage athird partyto perform 24/7 cybersecurity monitoring, detection and response services. With the third party's assistance, our Information Technology Department tracks metrics that monitor our cybersecurity risk posture, including any identified cybersecurity threats and risks, security awareness proficiency of employees, and any system vulnerabilities and patching requirements. We also engage third parties to perform assessments of our cybersecurity measures (including audits) and to help improve our processes and practices. The results of such assessments, audits and reviews are reported by the Chief Information Security Officer (CISO), and/or a delegate of the CISO, to the Company’s management and to our Audit Committee, and we are committed to adjusting our cybersecurity processes and practices as necessary based on the information provided by these assessments, audits and reviews. Our cybersecurity processes and practices are modelled based on industry best practices, including the ISO/IEC 27001 Standard.

We