Company: COHN
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001437749-25-007158
Chunk: 1240

Company: Cohen & Co Inc.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1A
Chunk 1240
---
 we violate the NYSE American listing requirements, our Common Stock may be delisted. If we fail to meet any of the NYSE American’s listing standards, our Common Stock may be delisted. In addition, our board may determine that the cost of maintaining our listing on a national securities exchange outweighs the benefits of such listing. A delisting of our Common Stock from the NYSE American may materially impair our stockholders’ ability to buy and sell our Common Stock and could have an adverse effect on the market price of, and the efficiency of the trading market for, our Common Stock. In addition, the delisting of our Common Stock could significantly impair our ability to raise capital.

﻿   

      35

ITEM 1B.  UNRESOLVED STAFF COMMENTS. 

﻿ 

None.﻿   

ITEM 1C. CYBERSECURITY

   Risk Management and Strategy
    
   The Company has processes in place to identify, assess, and monitor material risks from cybersecurity threats, which are part of the Company’s overall enterprise risk management process and have been embedded in the Company’s operating procedures, internal controls, and information systems.
    
   The Company’s comprehensive cybersecurity and information security framework includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. The framework leverages the National Institute of Standards and Technology Cyber Security Framework (“NIST CSF”) for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley for assessment of internal controls.
    
   The Company contracts with external firms to assess the Company’s cybersecurity controls relative to its peers using the NIST CSF. The Company also has a third-party risk management program that assesses risks from vendors and suppliers. In addition, the Company maintains business continuity and disaster recovery plans as well as a cybersecurity insurance policy.
    
   The Company has established cybersecurity and information security awareness training programs. Formal training on topics relating to the Company’s cybersecurity, data privacy, and information security policies and procedures is mandatory at least annually for all employees. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors, or safety issues. Based on role and location, some employees receive additional in-depth training to provide more comprehensive knowledge on potential risks related to their individual job responsibilities. Training is supplemented through regular Company communications with frequent updates to educate on the latest adversary trends and social engineering techniques. Certain employees also obtain industry