Company: COHN
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001437749-25-007158
Chunk: 1482

Company: Cohen & Co Inc.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1B
Chunk 1482
---
 measure the Company’s NIST CSF maturity level.
    
   No risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition.

   Governance
    
   Role of the Board and Management
    
   The Company’s board recognizes the importance of cybersecurity in safeguarding the Company’s sensitive data. The board is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage, and mitigate risk, at least annually. The board has delegated responsibility for oversight of the Company’s cybersecurity, information security framework, and risk management to the Company’s management cybersecurity committee (the “Cybersecurity Committee”).
    
   Pursuant to its charter, the Cybersecurity Committee must consist of at least four members of the Company’s executive management team, which shall include the Company’s director of technology, chief operating officer, chief compliance officer, and chief financial officer, each of whom is required to have working familiarity, knowledge, and competencies in relevant areas, including data privacy, public policy, information technology (“IT”) strategy, IT development and deployment, or IT risk assessment and management, including information security management. In addition, the Company’s director of technology has formal education in IT and extensive experience working in and leading the Company’s information systems and technology function. 
    
   The principal responsibilities and duties of the Cybersecurity Committee, pursuant to its written charter, are to:
    
     ●  Review and provide oversight on the effectiveness of the Company’s information security and privacy policies and procedures with respect to its products and services and internal-use information technology systems; 

     ●  Review and provide oversight on the policies and procedures of the Company in preparation for responding to any material information security or privacy incidents; 

     ●  Review and provide oversight on the Company’s disaster recovery, business continuity, and business resiliency capabilities, including escalation protocols, relating to its customer-facing products and services and internal-use IT systems; 

     ●  Review annually the appropriateness and adequacy of the Company’s cyber-insurance coverage; 

     ●  Review and provide oversight on the policies and procedures of the Company with respect to data privacy, and oversee the Company’s compliance with applicable data privacy and cybersecurity laws and regulations; 

     ●  Evaluate the Cybersecurity Committee’s composition and