Company: AEHR
Filing Date: 2025-09-10
Form Type: DEF 14A
Source: 0001654954-25-010620
Chunk: 20

Company: AEHR TEST SYSTEMS
Filing Date: 2025-09-10
Form: DEF 14A
Chunk 20
---
, as appropriate, depending on the facts and circumstances outlined in the communication received.

Cybersecurity Governance

Managing cyber-risk is increasingly critical to corporate governance in today’s interconnected world. One of the key functions of our Board of Directors is informed oversight of our risk management processes, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee. The Audit Committee has primary responsibility for oversight of information security risks, including fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks, and provides regular updates to the Board on such matters. The Audit Committee receives regular reports from our Chief Operating Officer on, among other things, the Company’s cyber risks and threats, the status of projects to strengthen the Company’s information security systems, assessments of the Company’s security program and the emerging threat landscape. Information security risk is a significant oversight focus area for the Audit Committee, as well as the entire Board of Directors.

Our Chief Operating Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats. Over the course of fiscal year 2025, the Audit Committee received three separate cybersecurity briefings from our Chief Operating Officer. Our Chief Operating Officer, who leads a team responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, has extensive experience and background in information technology, cybersecurity, enterprise strategy, risk management. Additionally, our Chief Operating Officer chairs our Cybersecurity Incident Response Team, which is responsible for prevention, identification, containment, eradication and remediation of cybersecurity incidents. While we have not experienced a material information security (cybersecurity) incident, we maintain an information security (cybersecurity) risk insurance policy as a matter of good practice.

Our senior management devotes considerable time and resources to conducting regular evaluations of our systems and implementing necessary enhancements to our security infrastructure to better guard against evolving cybersecurity threats. Our Security Awareness Program includes training that reinforces our information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Company’s resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by Company-wide testing initiatives.

We have not, as of the date of this proxy statement, experienced any material cybersecurity