Item 1C. Cybersecurity

Risk Management and Strategy

To identify, assess and manage cybersecurity risks, we maintain an IT security/cybersecurity program (Cybersecurity Program), which includes policies, procedures, processes and administrative, physical and technical controls designed to protect, defend and mitigate effects to us from cybersecurity threats and incidents. For example, we provide recurring employee cybersecurity training to help our employees better understand cybersecurity threats, our policies, actions and approach to managing this type of risk and how they can help increase our security posture.

Our Cybersecurity Program also includes an incident response process that is overseen by our Vice President of Cybersecurity and supported by an internal team of cybersecurity specialists, with involvement from business, legal and

senior management as appropriate. Cybersecurity incidents are assessed, managed and escalated to senior management, as appropriate, in accordance with that process.

We evaluate and update our cybersecurity risk profile through ongoing assessment of the cybersecurity threat landscape and security monitoring. Our cybersecurity risk profile is used as an input to identify, assess and update our Cybersecurity Program, and associated priorities are updated as new risk information becomes available. Information security, including cybersecurity, is also integrated into our overall Enterprise Risk Management (ERM) program. As part of this program, a cross-functional team including members of senior leadership evaluates risks to the enterprise and develops and monitors associated mitigation plans.

We periodically engage third-party assessors, consultants, auditors and other firms to assess our Cybersecurity Program or portions thereof, including security testing, penetration testing, and tabletop exercises in order to validate the efficacy of our security controls and response capabilities. We also utilize external advisors and specialists, as appropriate, to support cybersecurity risk management and incident response activities.

Our supplier community (including suppliers of IT services and other third-party service providers) plays a large role in Qualcomm’s success, and we believe in engaging with our suppliers to help them protect against cybersecurity threats. We operate a supplier cybersecurity assurance program, which is integrated with our procurement processes and supported by the relevant groups within the legal organization, to assess and attempt to mitigate potential cybersecurity risks across our supplier community commensurate with their cybersecurity risk. Specifically, based on a risk classification of the supplier, our third-party risk management process includes steps such as the evaluation of a supplier’s security controls, posture and maturity as well as the identification and treatment of cybersecurity-related risks.

Notwithstanding our Cybersecurity Program as described above, we cannot anticipate, detect, repel or guarantee the effectiveness of our preventative measures against all cybersecurity threats, particularly because the techniques used are increasingly sophisticated and constantly evolving. Like many companies, we have encountered intrusions and attempts to gain unauthorized access to our IT systems or other attacks and incidents, and we have had third-party service providers who have encountered intrusions. However, during fiscal 2026, we did not identify any risks from cybersecurity threats that materially affected or are reasonably anticipated to materially affect our business strategy, results of operations or financial condition. For additional information about the cybersecurity risks we face, including how such risks could affect us in the future, see “Part I, Item 1A. Risk Factors” in this Annual Report, including the Risk Factors titled “Our business and operations could suffer in the event of security breaches of our IT systems, or other misappropriation of our technology, intellectual property or other proprietary or confidential information” and “Failures in our products, or in the products of our customers or licensees, including those resulting from security vulnerabilities, defects or errors, could harm our business.”

Governance

Our Board of Directors has primary responsibility for oversight of our risk management efforts, with support from its standing committees. In particular, the Audit Committee assists the Board of Directors in fulfilling its oversight responsibilities with respect to our Cybersecurity Program. As part of its oversight of IT security/cybersecurity matters, the Audit Committee receives cybersecurity updates on a quarterly basis and an IT security/cybersecurity briefing from management, typically including our Chief Information Officer (CIO) and Vice President of Cybersecurity, on at least a semi-annual basis. In addition to this regular reporting, significant cybersecurity threats or incidents may also be escalated on an as-needed basis through our organizational structure in accordance with our incident response process.

Key elements of our Cybersecurity Program, including defending against key cybersecurity threats and risks, are overseen by our CIO, Vice President of Cybersecurity, the Information Security and Risk Management (ISRM) organization and certain legal functions under the office of the General Counsel, which include subject matter experts focused on identifying and managing cybersecurity threats and consequences where technically feasible and commensurate with risk. Our CIO has over 30 years of experience in IT and telecommunications and previously held CIO or other IT leadership roles at other technology companies prior to joining Qualcomm. Our Vice President of Cybersecurity has over 20 years of experience in cybersecurity gained across numerous leadership roles in Qualcomm’s IT and Cybersecurity organization, including security architecture, risk and compliance, incident response, security operations and identity management. This experience is supplemented by the collective experience and expertise across the ISRM organization. Additional members of senior management, including our Chief Financial Officer and Chief Operating Officer, Chief Technology Officer, Chief Human Resources Officer and General Counsel, also support the Cybersecurity Program through regular reporting and review, and our executive leadership team receives annual updates on enterprise risks, including cybersecurity risks, as part of our ERM program.