conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Financial Officer, VP of Finance, and Controller to manage the risk assessment and mitigation process.

As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with finance, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings and email notifications.

We engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test and audit our safeguards. We maintain policies and processes to assess and manage risks relating to third-party service providers, based on the nature of the engagement with the third party and on the information and systems to which the third party will have access. We maintain policies to conduct due diligence before onboarding new service providers and maintain ongoing evaluations to ensure compliance with our security standards.

For additional information regarding whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, “Risk Factors,” in this Annual Report on Form 10-K, including the risk factor entitled “Cyber-attacks, system security risks and data protection issues could disrupt our internal operations and cause a reduction in revenue, increase in expenses, negatively impact our results of operation or result in other adverse consequences.”

Governance

​

One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee. The chair of our Audit Committee has experience in assessing and managing cybersecurity risk.

Our management committee on cybersecurity, which includes our Chief Financial Officer and members from finance and IT, is primarily responsible to assess and manage our material risks from cybersecurity threats. Our Chief Financial Officer has had supervisory responsibilities over IT for over 30 years and personally engages our employees in training for cybersecurity. Our lead IT Senior System Engineer has over 20 years of direct IT employment and is a Microsoft Certified System Engineer, a Cisco Certified Network Associate and a Sun Certified System Administrator. One of our Controllers has over 15 years of Sarbanes Oxley compliance training and auditing, including auditing compliance regarding IT. Our VP Finance and Corporate Controller has over 20 years as an employee of AXT and has a thorough understanding of our specific IT systems.

Our management committee on cybersecurity oversees our cybersecurity policies and processes, including those described in “Risk Management and Strategy” above. The processes by which our management committee on cybersecurity is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include regular communication and reporting from our IT manager, alerts and warnings through the use of technological tools and software and the results of cybersecurity systems testing from a third-party consultant.

45

​

Our Chief Financial Officer provides briefings to our Board of Directors and the Audit Committee regarding the Company’s cybersecurity risks and activities, including cybersecurity systems testing, activities of third parties, and the like.