Item 1C. Cybersecurity

 

Risk management and strategy

 

We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, lab equipment, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical studies and employees, or Information Systems and Data.

 

We engage an external Head of Information Technology consultant to work with the company, including the Chief Operating Officer, Chief Financial Officer, and Executive Leadership Team, to help identify, assess and manage the company’s cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, and evaluating threats reported to us.

 

Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan and/or incident response policy, data and information protection plans, network security and access controls for certain systems, encryption of data, systems monitoring, cyber insurance and employee training.

 

Our assessment and management of material risks from cybersecurity threats are integrated into the company’s overall risk management processes. For example, the Head of Information Technology works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

 

We may use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms (including legal counsel) and threat intelligence service providers.

 

To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, Software-as-a-Service (SaaS) platforms, managed services, cloud-based infrastructure, encryption and authentication technology, corporate productivity services, and other functions. We have certain vendor management processes to help manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, requiring their completion of written questionnaires regarding their services and data handling practices and conducting periodic re-assessments during their engagement.

 

For a description of the risks from cybersecurity threats that may materially affect the company and how they may do so, please see “Risk Factors – Risks Related to Employees, Managing Our Growth and Other Legal Matters.”

 

Governance

 

Our board of directors addresses the company’s cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for reviewing the company’s guidelines and policies with respect to risk assessment and risk management, including those related to assessment and mitigation of risks from cybersecurity threats.

 

---

Our cybersecurity risk assessment and management processes are implemented and maintained by certain company management, including our Head of IT, who holds a Microsoft Certification, and our Chief Operating Officer, who earned a Cybersecurity for Directors certificate from the Corporate Governance Institute.

 

Management is also responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the company’s overall risk management strategy, and communicating key priorities to relevant personnel. The Head of IT and Chief Operating Officer are responsible for helping prepare the company for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

 

Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances and designated risk level, including the Chief Financial Officer, Chief Executive Officer and/or full Executive Leadership Team, who participates in our disclosure controls and procedures. The Head of IT and Chief Operating Officer work with the company’s incident response team to help the company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company’s incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

 

The audit committee receives periodic reports from the Head of IT and Chief Operating Officer concerning the company’s significant cybersecurity threats and risk and the processes the company has implemented to address them. The audit committee also receives summaries or presentations related to the company’s information systems and data and cybersecurity threats, risk and mitigation.