Cyber Risk Management and Strategy

At Graphite Bio, we recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management process in accordance with our risk profile and business that is informed by industry standards.

We leverage the support of third-party information technology and security providers, including for periodic security testing and vulnerability scanning, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks.

We maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents, and we have a process to assess the security practices of certain third-party vendors.

Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors’ data and systems. For more information about these risks, please refer to the section entitled “Risk Factors” in this Annual Report on Form 10-K.

Governance Related to Cybersecurity Risks

Our Chief Executive Officer, with the assistance of the Company’s third-party information technology providers, is responsible for the strategic leadership and direction of the Company’s cybersecurity program.

The Company’s audit committee has oversight over cybersecurity risks. With the input of other members of Company management and the Company’s information technology providers, the Chief Executive Officer provides periodic presentations to the audit committee on the Company’s cyber program, including updates on security testing and assessments, cyber risks, and related cyber strategy, as applicable.