What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-06-10 compared with 2025-06-26 · 42 added, 40 removed, 28 unchanged (75% of the section changed)

2 unchanged sentences

Risk management and strategy

We have implemented and maintain

various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical

computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual

property, confidential information that is proprietary, strategic or competitive in nature, information related to our clinical trials,

and information of our employees, or Information Systems and Data.

The Company’s Chief

Financial Officer, with assistance from our third-party cybersecurity vendors, is responsible for identifying, assessing, and managing

our cybersecurity threats and risks.

Together, they identify and assess risks from cybersecurity threats by monitoring and evaluating

our threat environment using various methods including, for example, automated tools, evaluating our and our industry’s risk profile,

conducting real-time monitoring of certain systems, and implementing escalation protocols with our third-party cybersecurity vendors.

We maintain various information

security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks,

third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential

information that is proprietary, strategic or competitive in nature, information related to our clinical trials, and information of our

employees, or Information Systems and Data.

The Company’s CEO/CFO, with

assistance from our third-party cybersecurity vendors, is responsible for identifying, assessing, and managing our cybersecurity threats

Together, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using

various methods including, for example, automated tools, evaluating our and our industry’s risk profile, conducting real-time monitoring

of certain systems, and implementing escalation protocols with our third-party cybersecurity vendors.

Depending on the environment,

16 unchanged sentences

including, for example, professional services firms, including legal counsel and certain cybersecurity service providers.

use third-party service providers to perform a variety of functions throughout our business, such as hosting companies and contract research

organizations.

We have a vendor management program to manage cybersecurity risks associated with our use of these providers.

includes conducting a risk assessment for certain vendors.

For a description of the risks from cybersecurity

threats that may materially affect the Company and how they may do so, see our risk factors under Part 1.

Risk Factors in this

Annual Report on Form 10-K , including “ If our information technology systems, or those of third parties with whom we work, or

our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to:

We use third-party service providers

to perform a variety of functions throughout our business, such as hosting companies and contract research organizations.

We have a vendor

management program to manage cybersecurity risks associated with our use of these providers.

The program includes conducting a risk assessment

for certain vendors.

For a description of the risks from cybersecurity threats that may materially affect the Company and how they may

do so, see our risk factors under Part 1.

Risk Factors in this Annual Report on Form 10-K, including “ If our information

technology systems, or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences

resulting from such compromise, including but not limited to:

regulatory investigations or actions;

2 unchanged sentences

reputational harm;

of revenue or profits;

loss of revenue or profits;

and other adverse consequences.

Our board of directors addresses

the Company’s cybersecurity risk management as part of its general oversight function.

The board of directors’ audit committee

is responsible for overseeing Company’s cybersecurity risk management processes, including oversight of mitigation of risks from

cybersecurity threats.

board of directors addresses the Company’s cybersecurity risk management as part of its general oversight function.

of directors’ audit committee is responsible for overseeing the Company’s cybersecurity risk management processes,

including oversight of mitigation of risks from cybersecurity threats.

Our cybersecurity risk assessment

and management processes are implemented and maintained by certain Company management, including the Chief Executive Officer , and Chief

Financial Officer.

The CFO is responsible for

hiring appropriate personnel (including selecting third-party cybersecurity vendors), helping to integrate cybersecurity risk considerations

into the Company’s overall risk management strategy, and communicating key priorities to relevant personnel.

The CFO is responsible

for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments

and other security-related reports.

Our cybersecurity incident

response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including

The CFO/CEO work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are

and management processes are implemented and maintained by certain Company management, including the CEO/CFO.

The CEO/CFO is

responsible for hiring appropriate personnel (including selecting third-party cybersecurity vendors), helping to integrate

cybersecurity risk considerations into the Company’s overall risk management strategy, and communicating key priorities to

relevant personnel.

The CEO/CFO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving

cybersecurity processes, and reviewing security assessments and other security-related reports.

Frakes does not hold

formal cybersecurity credentials or have dedicated prior professional experience in cybersecurity risk management, he is supported

in this function by qualified third-party cybersecurity service providers, upon whose specialized expertise the Company relies to

supplement management's assessment, identification, and oversight of material cybersecurity threats and risks.

Our cybersecurity incident response

plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including CEO/CFO.

The CEO/CFO works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified.

In addition, our incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity

The audit committee receives

periodic reports from the CFO concerning our significant cybersecurity threats and risk and the processes we have implemented to address

The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

The audit committee receives periodic

reports from the CEO/CFO concerning our significant cybersecurity threats and risks and the processes we have implemented to address them.

The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risks and mitigation.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments