Company: SNPS
Filing Date: 2025-12-22
Form Type: 10-K
Source: 0000883241-25-000028
Chunk: 69

Company: SYNOPSYS INC
Filing Date: 2025-12-22
Form: 10-K
Item: Item 1C
Chunk 69
---
Item 1C.     Cybersecurity

Cybersecurity Risk Management and Strategy

We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We maintain a cybersecurity program and incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things:•Security and privacy reviews designed to identify risks from new features, software, suppliers, and vendors; • A vulnerability management program designed to identify software vulnerabilities;•A variety of tools designed to monitor our networks, systems, and data for suspicious activity;•An internal red team program that simulates cyber threats, enhancing our ability to fix vulnerabilities before they are exploited by threat actors;•A threat intelligence program designed to model and research our adversaries; •Products and services to structure, test, and assess the rigor of our software security practices;•A variety of privacy, cybersecurity, and incident response trainings and simulations, including mandatory yearly training for all employees, additional training for all Information Technology and Information Security personnel, and regular controlled penetration testing and cyber incident exercises to test the robustness of our data security protections and incident response readiness; •For suppliers and service providers, pre-engagement risk-based diligence, contractual security and notification provisions, and ongoing monitoring as appropriate; and•Maintaining cyber liability insurance that covers certain liabilities related to data breaches and related incidents.Synopsys’ cybersecurity policies and procedures are intended to align with multiple industry-recognized frameworks, including the National Institute of Standards and Technology Cyber Security Framework (NIST CSF) and the ISO/International Electrotechnical Commission (IEC) 27001 Information Security Management Framework. In addition, some Synopsys products are ISO27001 and/or SOC2 Type 2 certified. Our internal audit department regularly assesses our conformity with these frameworks. We track our NIST