Company: COHU
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001437749-25-004612
Chunk: 49

Company: COHU INC
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1
Chunk 49
---
 design and operational effectiveness of security controls. We also regularly obtain system and organization control (“SOC”) reports from our service providers (“SOC 2”). Members of our corporate information security organization receive information exchanges from their professional networks and attend training, webinars, and conferences to stay up to date on both trends and system-specific updates. In addition, all Cohu employees are required to complete continuous security awareness training including annual training, weekly testing and frequent notifications regarding updates on trends or types of attacks, each of which are designed to promote a company-wide culture of cybersecurity risk awareness and management.

In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents, including penalties and settlements, were immaterial. As a result, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, our results of operations or financial condition. Notwithstanding the measures we take to assess, identify, and manage cybersecurity risks, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us and we may experience such incidents in the future and the scope and impact of any such future incidents cannot be predicted. For a discussion of how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, may materially affect or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, see the risk factor entitled “Our business and operations could suffer in the event of cybersecurity breaches within our operational systems or products”.

Governance

Role of the Board of Directors and the Audit Committee

As part of the Board’s role in overseeing our enterprise risk management program, which includes our cybersecurity risk management, the Board is responsible for exercising oversight of management’s identification and management of, and planning for, material cybersecurity risks that may reasonably be expected to have an adverse effect on us. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee is informed of the Company’s cybersecurity risk management and receives an overview of its cybersecurity program from management at least annually, which typically includes a table top simulation and covers topics including, among others, recent cybersecurity risk landscape and trends, data security posture, results from third-party assessments, training and vulnerability testing, our incident response plan, material cybersecurity risks, whether developing or actual, as well as the steps management has taken to respond to such risks, emerging cybersecurity regulations,