Company: TSEM
Filing Date: 2025-04-30
Form Type: 20-F
Source: 0001178913-25-001537
Chunk: 264

Company: TOWER SEMICONDUCTOR LTD
Filing Date: 2025-04-30
Form: 20-F
Item: Item 16K
Chunk 264
---
 require all third-party vendors that may have access to Company, employee, customer, or other third-party data, and/or access to the Company’s systems, to complete a questionnaire and undergo a vetting process prior to being approved and onboarded. The vetting process may include a review of the vendor's relevant policies and procedures, standards certifications, technology architecture, business practices and cybersecurity profile. Third-party vendor agreements include confidentiality obligations and specify data elements that the third party has access to, how the third party protects the data, personal information and data subject’s rights, and procedures for the return or destruction of protected data.

In addition to the above processes and resources, we deploy technical safeguards and maintain a cybersecurity incident response process that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls, system backups, denial of service attack prevention, endpoint protection, network protection and cloud workload protection, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. In addition, within the Information Technology Department, we have an Incident Response Team, which maintains and is responsible for communicating any cybersecurity incidents in accordance with a written incident response plan (the “ Incident Response Plan”). The Incident Response Plan defines responsibilities and immediate actions necessary to mitigate risk, defines report of incidents to management, and identifies necessary steps to remediate the incident and prevent future incidents. The Incident Response Team is responsible for identifying and assessing the impact of various factors, including duration of the breach or other incident, the number of systems and users affected, the actual or potential system downtime and associated financial impact, as well as the cost and timing of system and data recovery. We also implement controls and procedures that provide for the escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Third parties engaged in monitoring and detection are required to report all cybersecurity incidents immediately to the CISO. Our CISO is responsible for reporting critical cybersecurity incidents that may affect Tower’s operations immediately to the our senior management team and the Company’s compliance officer. Depending on the nature and severity of an incident, the incident may also need to be reported to our Disclosure Committee to determine whether the incident is or is reasonably likely to become material and shall be reported to the Audit Committee and the Board of Directors, and whether the Company must disclose the incident to the relevant authorities, as may be required by applicable regulation.

Governance

Our Board of Directors recognizes the importance of managing the risk of