Minerva Neurosciences, Inc. - (NERV)

10-K Filing Date: February 22, 2024
ITEM 1C. Cybersecurity

Risk management and strategy

We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, patient data, and data related to our clinical trials (“Information Systems and Data”).

The Company’s information security function and third-party service providers help identify, assess and manage the Company’s cybersecurity threats and risks, including through the use of the Company’s risk assessment process. The Company’s information security function and third-party service providers identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example:

•
automated tools;
•
subscribing to reports and services that identify cybersecurity threats;
•
analyzing reports of threats and actors;
•
conducting scans of the threat environment;
•
evaluating our and our industry’s risk profile;
•
evaluating threats reported to us;
•
conducting audits;
•
conducting threat assessments for internal and external threats;
•
conducting vulnerability assessments to identify vulnerabilities; and
•
using external intelligence feeds.

Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example:

•
our incident response plan;
•
incident detection and response processes;
•
a disaster recovery/business continuity plan;
•
encryption of certain data;
•
network security controls;
•
access controls;
•
asset management, tracking and disposal;
•
systems monitoring;
•
employee training;
•
penetration testing;
•
cybersecurity insurance; and
•
outsourced cybersecurity staff.

Our assessment and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management processes. For example, the Company's information security function works with management, including our Chief Operating Officer (“COO”) to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example:

•
our external IT service provider;
•
professional services firms, including legal counsel;
•
cybersecurity consultants;
•
managed cybersecurity service providers; and
•
penetration testing firms.

We use third-party service providers to perform a variety of functions throughout our business, such as application providers, contract research organizations and contract manufacturing organizations. As part of our vendor security due diligence and to manage cybersecurity risks associated with our use of certain vendors, we perform risk assessments on vendors and may include cybersecurity

66

obligations in our contracts with them. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor due diligence may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the provider.

For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including:

•
Our business and operations would suffer in the event of system failures; and
•
If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.

Governance

Our board of directors addresses the Company’s cybersecurity risk management as part of its general oversight function. The board of directors’ audit committee is responsible for overseeing Company’s cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our COO.

The COO is responsible for managing our information security function and overseeing our third-party information technology service providers. The COO is also responsible for helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy, communicating key priorities to relevant personnel, and approving budgets. Our outsourced Chief Technology Officer, who has over 20 years in executive-level IT and cybersecurity roles, is responsible for developing and implementing our technology environment and cybersecurity framework, helping the Company prepare for cybersecurity incidents, approving and implementing certain cybersecurity processes, and reviewing security assessments and other security-related reports.

Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the COO and Chief Financial Officer (“CFO”). The COO and CFO work with the other members of the Company’s incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company will report to the audit committee of the board of directors for certain cybersecurity incidents.

The audit committee receives periodic updates from the CFO and finance department concerning the Company’s significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various updates, summaries or presentations related to cybersecurity threats, risk and mitigation.

 

67

Back SEC Filing