XML 57 R33.htm IDEA: XBRL DOCUMENT v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
First Solar maintains a cyber risk management program designed to identify, assess, and manage cybersecurity risks. The underlying controls of the cyber risk management program incorporate recognized best practices and standards for cybersecurity, including guidance from the National Institute of Standards and Technology (“NIST”) cybersecurity framework. Our cyber risk management program includes various risk assessments that are completed on a regular basis, including (i) information security controls assessments with internal and external audit partners, (ii) architectural and technical assessments with third-party experts, (iii) internal and external penetration testing with third-party service providers, (iv) continuous cyber risk register reviews, and (v) risk prioritization with our executive officers. The identification of cybersecurity risks is aided by a technical toolset as well as threat hunting and counterintelligence services provided by third-party service providers. These risk assessments and the technical toolset inform our information security roadmap, which allocates resources toward strategic initiatives to mitigate, transfer, and/or reduce cybersecurity risks. Our associates receive cybersecurity awareness communications, engage in annual cybersecurity training, and are exposed to periodic phishing simulation exercises with targeted training. Additionally, confidential information protection training is regularly provided to associates who have access to personally identifiable information, reside in certain jurisdictions, or have privileged access.

Third-party risk management at First Solar includes screening processes to evaluate the information security programs and capabilities of our vendors, including periodic reviews of vendor control assessments, such as System and Organization Controls (“SOC”) 2 Type 2 reports, which are supplemented by end-user controls performed by First Solar associates. These processes enable us to oversee and identify potentially material risks from cybersecurity threats associated with our use of third-party service providers.

The Head of Cyber Security oversees the cybersecurity team, which assesses and manages cybersecurity risks at First Solar as part of our information security program. The Head of Cyber Security and our cybersecurity team members collectively hold certifications in cyber-risk oversight from the National Association of Corporate Directors, Certified Systems Security Officer and Certified Information Systems Manager credentials, and Certified Information Systems Security Professional and Systems Security Certified Practitioner credentials. The Head of Cyber Security, who has over 20 years of information security experience, reports to the Chief Information Officer. Our Chief Information Officer has 26 years of information technology experience, including 19 years in leadership roles at First Solar. They regularly brief the executive leadership team and, at least quarterly, brief the audit committee of the board of directors on cybersecurity matters.

The cybersecurity risks identified as part of our information security program are integrated into our enterprise risk management program. The audit committee reviews the integration of our cybersecurity controls and procedures with our overall risk management systems and processes, and reviews and discusses with management First Solar’s major information security risks (including cybersecurity) and the steps management has taken to monitor, control, and limit such exposures and risks. An Information Security Steering Committee, which is comprised of executive leadership, serves in an advisory capacity regarding the implementation, support, and management of the information security program and compliance with applicable state and federal laws and regulations. This committee aligns business initiatives, material digital risks, risk tolerance levels, and security requirements with the information security roadmap.

The cybersecurity team actively manages cybersecurity threats and incidents through comprehensive technical tooling, reporting, partnerships, and processes. Intrusion prevention, detection, and response systems, access management systems, and incident and vulnerability management systems are all examples of technical tools employed by First Solar’s cybersecurity team to protect our information and operational technology environment.
Our incident response plan includes specific criteria for determining the potential impact of an identified cybersecurity incident and defined escalation protocols to determine which internal and external stakeholders should be involved and the appropriate communication channels, including considerations of any reporting based on regulatory requirements. Further, at least annually, certain key members from our cybersecurity team engage in cybersecurity tabletop exercises alongside certain members of both our executive team and board of directors, which are designed to simulate a cybersecurity threat or incident to test First Solar’s incident response plan. Cybersecurity incidents are evaluated on a case-by-case basis and are categorized as low, moderate, or high impact incidents depending on qualitative and quantitative factors, including, but not limited to, their operational impact, degree of compromise, legal or regulatory impacts, and data disclosure impacts. The audit committee of the board of directors is notified if a potentially material incident is identified and reviews our response to material cybersecurity incidents, including disclosure considerations and the engagement of forensic and other technology experts to ascertain the extent of the incident, remediation actions, and responsive measures to prevent or mitigate future incidents.

As a result of ongoing monitoring, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, financial condition, or results of operations during the period covered by this filing. Notwithstanding the cybersecurity processes and procedures described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, or results of operations. While we maintain cybersecurity insurance, the costs related to cybersecurity incidents, including information and security breaches, or other disruptions may not be fully insured. For further information regarding the risks to us associated with cybersecurity incidents and other events, including information and security breaches, and how such risks may affect the Company, see the Risk Factor entitled, “Cybersecurity incidents or information or security breaches, or those of third parties with which we do business, could have a material adverse effect on our business, financial condition, and results of operations.”
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] The cybersecurity risks identified as part of our information security program are integrated into our enterprise risk management program.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] As a result of ongoing monitoring, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, financial condition, or results of operations during the period covered by this filing.
Cybersecurity Risk Board of Directors Oversight [Text Block]
The Head of Cyber Security oversees the cybersecurity team, which assesses and manages cybersecurity risks at First Solar as part of our information security program. The Head of Cyber Security and our cybersecurity team members collectively hold certifications in cyber-risk oversight from the National Association of Corporate Directors, Certified Systems Security Officer and Certified Information Systems Manager credentials, and Certified Information Systems Security Professional and Systems Security Certified Practitioner credentials. The Head of Cyber Security, who has over 20 years of information security experience, reports to the Chief Information Officer. Our Chief Information Officer has 26 years of information technology experience, including 19 years in leadership roles at First Solar. They regularly brief the executive leadership team and, at least quarterly, brief the audit committee of the board of directors on cybersecurity matters.

The cybersecurity risks identified as part of our information security program are integrated into our enterprise risk management program. The audit committee reviews the integration of our cybersecurity controls and procedures with our overall risk management systems and processes, and reviews and discusses with management First Solar’s major information security risks (including cybersecurity) and the steps management has taken to monitor, control, and limit such exposures and risks. An Information Security Steering Committee, which is comprised of executive leadership, serves in an advisory capacity regarding the implementation, support, and management of the information security program and compliance with applicable state and federal laws and regulations. This committee aligns business initiatives, material digital risks, risk tolerance levels, and security requirements with the information security roadmap.

The cybersecurity team actively manages cybersecurity threats and incidents through comprehensive technical tooling, reporting, partnerships, and processes. Intrusion prevention, detection, and response systems, access management systems, and incident and vulnerability management systems are all examples of technical tools employed by First Solar’s cybersecurity team to protect our information and operational technology environment.
Our incident response plan includes specific criteria for determining the potential impact of an identified cybersecurity incident and defined escalation protocols to determine which internal and external stakeholders should be involved and the appropriate communication channels, including considerations of any reporting based on regulatory requirements. Further, at least annually, certain key members from our cybersecurity team engage in cybersecurity tabletop exercises alongside certain members of both our executive team and board of directors, which are designed to simulate a cybersecurity threat or incident to test First Solar’s incident response plan. Cybersecurity incidents are evaluated on a case-by-case basis and are categorized as low, moderate, or high impact incidents depending on qualitative and quantitative factors, including, but not limited to, their operational impact, degree of compromise, legal or regulatory impacts, and data disclosure impacts. The audit committee of the board of directors is notified if a potentially material incident is identified and reviews our response to material cybersecurity incidents, including disclosure considerations and the engagement of forensic and other technology experts to ascertain the extent of the incident, remediation actions, and responsive measures to prevent or mitigate future incidents.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] audit committee of the board of directors
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Head of Cyber Security, who has over 20 years of information security experience, reports to the Chief Information Officer. Our Chief Information Officer has 26 years of information technology experience, including 19 years in leadership roles at First Solar. They regularly brief the executive leadership team and, at least quarterly, brief the audit committee of the board of directors on cybersecurity matters
Cybersecurity Risk Role of Management [Text Block] The Head of Cyber Security oversees the cybersecurity team, which assesses and manages cybersecurity risks at First Solar as part of our information security program.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Head of Cyber Security, who has over 20 years of information security experience, reports to the Chief Information Officer.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The Head of Cyber Security and our cybersecurity team members collectively hold certifications in cyber-risk oversight from the National Association of Corporate Directors, Certified Systems Security Officer and Certified Information Systems Manager credentials, and Certified Information Systems Security Professional and Systems Security Certified Practitioner credentials. The Head of Cyber Security, who has over 20 years of information security experience, reports to the Chief Information Officer.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
The cybersecurity team actively manages cybersecurity threats and incidents through comprehensive technical tooling, reporting, partnerships, and processes. Intrusion prevention, detection, and response systems, access management systems, and incident and vulnerability management systems are all examples of technical tools employed by First Solar’s cybersecurity team to protect our information and operational technology environment.
Our incident response plan includes specific criteria for determining the potential impact of an identified cybersecurity incident and defined escalation protocols to determine which internal and external stakeholders should be involved and the appropriate communication channels, including considerations of any reporting based on regulatory requirements. Further, at least annually, certain key members from our cybersecurity team engage in cybersecurity tabletop exercises alongside certain members of both our executive team and board of directors, which are designed to simulate a cybersecurity threat or incident to test First Solar’s incident response plan. Cybersecurity incidents are evaluated on a case-by-case basis and are categorized as low, moderate, or high impact incidents depending on qualitative and quantitative factors, including, but not limited to, their operational impact, degree of compromise, legal or regulatory impacts, and data disclosure impacts. The audit committee of the board of directors is notified if a potentially material incident is identified and reviews our response to material cybersecurity incidents, including disclosure considerations and the engagement of forensic and other technology experts to ascertain the extent of the incident, remediation actions, and responsive measures to prevent or mitigate future incidents.