Elevation Oncology, Inc. - (ELEV)
10-K Filing Date: March 06, 2024
Item 1C. Cybersecurity
We recognize the critical importance of maintaining the trust and confidence of our all of our stakeholders. We are a virtual company, and our business depends on the efficient and uninterrupted operation of our information technology systems and those of our third-party CROs, CMOs and other vendors, contractors and consultants. Our Board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management (“ERM”). Our cybersecurity policies, standards, processes and practices are fully integrated into our ERM program and are based on recognized frameworks established by the Center for Internet Security Controls Framework and other applicable industry standards, with quarterly review and adjustment of safeguards for continuous improvement. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
Risk Management and Strategy
As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas:
| ● | Governance: As discussed in further detail under “Governance” below, our Board’s oversight of cybersecurity risk management is supported by our audit committee, which regularly interacts with our ERM function, our head of information technology and members of management. |
| ● | Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. |
| ● | Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including multifactor authentication, mobile device management, email filtering, firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. |
| ● | Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans to address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. This includes continuous security operations center monitoring of our systems and accounts. Furthermore, we maintain cyber liability insurance as an additional safeguard against a potential loss due to a cybersecurity incident. |
82
| ● | Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. |
| ● | Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also perform regular phishing campaigns among our employees and provide convenient solutions for our employees to report suspicious messages. |
We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, such as vulnerability management of both virtual network and physical laptops, regular security operations center reviews, regular Center for Internet Security scorecard reviews, user account audits of both employees and third parties and information technology general controls reviews. We also engage third parties to perform assessments on our cybersecurity measures to enable continuous improvement and adherence to best practices. The results of such assessments, audits and reviews are reported to the Audit Committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.
Governance
Our Board, in coordination with our audit committee, oversees our risk management process. The audit committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board and the audit committee will also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved. The audit committee regularly discusses our approach to cybersecurity risk management with our management team.
Our information technology personnel, in coordination with our management team, work collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee basis and appropriate third party contractors, our head of information technology and management monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and will report such threats and incidents to the Audit Committee when appropriate.
Our head of information technology has over a decade of information technology experience in the biopharmaceutical industry and oversees our cybersecurity program. He has experience developing and leading cybersecurity programs, including evaluating and implementing tools and technologies that enable defense and response capabilities, and developing critical cybersecurity procedures and training and awareness programs.
Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition.