QUICKLOGIC Corp 10-K cybersecurity disclosure (Item 1C), fiscal 2025

ITEM 1C. CYBERSECURITY

In July 2023, the SEC adopted a new rule, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure , which requires registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. For registrants, the final rules were effective September 5, 2023, with the new disclosures required beginning in annual reports for fiscal years ending on or after December 15, 2023. With respect to compliance with the incident disclosure requirements, all registrants other than smaller reporting companies must begin complying on December 18, 2023, with smaller reporting companies being given an additional 180 days, or June 15, 2024. The Company adopted these new cybersecurity disclosure requirements in the prior fiscal year, as detailed below.

The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners, and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized cybersecurity industry frameworks established by the National Institute of Standards and Technology, and other applicable industry standards. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Additionally, we utilize internal and external independent controls to monitor and mitigate the risk of these threats, including a Security Incident Response Plan ("SIRP") and periodic Information Technology training for all employees.

Cybersecurity Risk Management and Strategy

As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity risk management program includes the following key components:

•

Risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment.

•

The IT team including its executive leadership is in charge of managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to security incidents.

•

The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

•

The Company has in place an incident response and recovery plan that addresses the Company's response to a cybersecurity incident.

•

The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by external resources accessing the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third -party systems.

•

The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, EDR tools, and PEN test exercises that focus on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the executive management team and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits, and reviews.

We experienced a cyberattack in January 2023. We believe the incident has not had nor will have a material impact on our business, operations, ability to serve our customers, or financial results. At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. The impact of potential cybersecurity threats is difficult to predict, but one or more of them could result in the loss of information or capabilities, harm to individuals or property, damage to our reputation, loss of business, regulatory actions, and potential liability, any of which could have a material adverse effect on our financial position, results of operations and/or cash flows. These threats could lead to losses of sensitive information or capabilities, harm to personnel, infrastructure, or products, and/or damage to our reputation as well as our vendor's ability to perform on our contracts. See "Risk Factors - Cyberattacks, like our 2023 cybersecurity incident that was previously disclosed, can lead to disruption of business, reduced revenue, increased costs, liability claims, or harm to our reputation or competitive position."

Governance

The executive management team and the Board oversee the Company's ERM process, including the management of risks arising from cybersecurity threats. The executive management team and the Board each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The executive management team and the Board also receive prompt and timely information regarding any cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the executive management team and the Board discuss the Company's approach to cybersecurity risk management to monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time.

ITEM 1C. CYBERSECURITY

In July 2023, the SEC adopted a new rule, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure , which requires registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. For registrants, the final rules were effective September 5, 2023, with the new disclosures required beginning in annual reports for fiscal years ending on or after December 15, 2023. With respect to compliance with the incident disclosure requirements, all registrants other than smaller reporting companies must begin complying on December 18, 2023, with smaller reporting companies being given an additional 180 days, or June 15, 2024. The Company adopted these new cybersecurity disclosure requirements in the current fiscal year, as detailed below.

The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized cybersecurity industry frameworks established by the National Institute of Standards and Technology, and other applicable industry standards. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Additionally, we utilize internal and external independent controls to monitor and mitigate the risk of these threats, including a Security Incident Response Plan ("SIRP") and periodic Information Technology training for all employees.

Cybersecurity Risk Management and Strategy

As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity risk management program includes the following key components:

•

Risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment.

•

The IT team including its executive leadership is in charge of managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to security incidents.

•

The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

•

The Company has in place an incident response and recovery plan that addresses the Company's response to a cybersecurity incident.

•

The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by external resources accessing the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

•

The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, EDR tools, and PEN test exercises that focus on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the executive management team and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

We experienced a cyberattack in January 2023. We believe the incident has not had nor will have a material impact on our business, operations, ability to serve our customers, or financial results. At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. The impact of potential cybersecurity threats is difficult to predict, but one or more of them could result in the loss of information or capabilities, harm to individuals or property, damage to our reputation, loss of business, regulatory actions, and potential liability, any of which could have a material adverse effect on our financial position, results of operations and/or cash flows. These threats could lead to losses of sensitive information or capabilities, harm to personnel, infrastructure, or products, and/or damage to our reputation as well as our vendor's ability to perform on our contracts. See " Risk Factors - Cyberattacks, like our 2023 cybersecurity incident, can lead to disruption of business, reduced revenue, increased costs, liability claims, or harm to our reputation or competitive position."

Governance

The executive management team and the Board oversee the Company's ERM process, including the management of risks arising from cybersecurity threats. The executive management team and the Board each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The executive management team and the Board also receive prompt and timely information regarding any cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the executive management team and the Board discuss the Company's approach to cybersecurity risk management to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time.