Monolithic Power Systems MPWR · USD

Item 1C. Cybersecurity Cybersecurity Risk Management and Strategy We recognize it is imperative to diligently manage cybersecurity risks as defined in Item 106(a) of Regulation S-K. Such risks include operational risks of ransomware, phishing, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. We address cybersecurity risks in our business, technical operations, privacy and compliance operations and programs through a diversified approach including threat-monitoring and assessments by third-parties, adopting IT security ISO standards/governance, and proactive risk and compliance reviews. In order to defend against cybersecurity incidents, we carry out real-time cybersecurity threat monitoring of IT assets, perform penetration testing, audit applicable data policies and conduct directed employee training. We also monitor new technologies and existing and emerging laws and regulations related to data protection and information security and implement changes that help to mitigate risk. We maintain an insurance policy that provides certain coverage for losses we incur due to data breaches and other cybersecurity incidents. We implemented incident response and breach management processes consisting of four stages: 1) monitor for and identify cybersecurity incidents, 2) carry out security incident analysis, 3) contain and recover, and 4) improve with post-incident analysis. Such incident responses are governed by the Cybersecurity Steering Committee. We regularly engage external auditors to assess our internal cybersecurity programs and compliance and have been certified to conform to the requirements of ISO/IEC 27001. There are no identified cybersecurity threats that have materially affected or are reasonably likely to materially affect our results of operations, or financial condition as of the date of this Annual Report on Form 10-K. To date, we do not believe we have experienced any material information security breaches and have not incurred significant operating expenses related to information security breaches. See “Risk Factors” for more information on our cybersecurity risks.

Stock-Based Compensation The Company’s restricted stock units (“RSUs”) include time-based RSUs, RSUs with performance conditions (“PSUs”), and RSUs with market conditions (“MSUs”). The Company measures the cost of employee services received in exchange for an award of equity instruments based on the grant-date fair value of the award. The fair value of time-based RSUs is determined based on the grant date stock price. The fair value of all other awards, including PSUs that have a purchase price adjustment and MSUs, is determined based on the Monte Carlo simulation model. The valuation model considers inputs including stock price, expected volatility, expected term of awards, risk-free interest rate, and expected dividend yield. Expected volatility used in the model is determined based on historical volatility of the Company’s stock price for the period, which corresponds to the expected term of the awards, immediately preceding the granting of the awards. Compensation expense related to awards with service conditions is recorded on a straight-line basis over the requisite service period. Compensation expense related to awards subject to performance or market conditions is recognized over the requisite service period for each separately vesting tranche. For awards with market conditions, compensation expense is not reversed if the market conditions are not satisfied. For awards with performance conditions, the Company recognizes compensation expense when it becomes probable that the performance goals will be achieved. Management performs the probability assessment on a quarterly basis by reviewing external factors, such as macroeconomic conditions and analog industry revenue forecasts, and internal factors, such as our business and operational objectives and revenue forecasts. Changes in the probability assessment of achievement of the performance conditions are accounted for in the period of change by recording a cumulative catch-up adjustment as if the new estimate had been applied since the service inception date. Any previously recognized compensation expense is reversed if the performance conditions are not expected to be satisfied as a result of management’s assessment. The Company accounts for forfeitures of equity awards when they occur.