Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
None.
Item 1C. Cybersecurity
Risk Management and Strategy
In the ordinary course of our business, we collect and store proprietary, confidential, and sensitive data, including legally protected personal information, such as test results and other protected health information (PHI), credit card and other financial information, insurance information, and other personally identifiable information, as well as sensitive intellectual property and other proprietary business information, including that of our customers, payors and collaboration partners. We manage and maintain our applications and data utilizing a combination of on-site systems and cloud-based centers, and utilize internal resources and external security and infrastructure vendors to manage parts of our data centers. We are highly dependent on information technology networks and systems—our own as well as those of third-party vendors and their subcontractors—to securely process, transmit, and store a wide variety of information critical to our business, including research and development information, patient data, commercial information, and business and financial information. Our systems are designed to ensure that all sensitive data is stored appropriately in SOC 1 and SOC 2 compliant platforms.
Although we maintain measures designed to protect sensitive information from unauthorized access or loss of access, inappropriate use or disclosure, and inappropriate modification, our information technology systems and infrastructure, and those of our third-party service providers, strategic partners and other contractors, and their subcontractors or consultants, are inherently vulnerable to cybersecurity threats and, from time to time, experience such threats. As of the date of this Annual Report on Form 10-K, we are not aware of any material cybersecurity incidents or threats that have impacted our business. We continue to invest in the security and resiliency of our networks and to enhance internal controls and processes designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, see “Part I, Item 1A. Risk Factors” included elsewhere in this Annual Report on Form 10-K.
Risk Management Processes
87
Table of Contents
Our Information Security Steering Committee, led by our Vice President of Information Technology, who also serves as our Chief Information Security Officer, is responsible for the day-to-day execution of our information security strategy and operations. As appropriate, the Information Security Steering Committee coordinates cross-functionally across our information technology, engineering, legal, privacy, compliance, finance, people operations, and product teams to identify, assess, and address current and emerging cybersecurity risks.
We maintain a cybersecurity incident response plan that addresses key aspects of incident management, including detection, impact analysis, containment, mitigation, remediation, recovery, and longer-term measures designed to reduce the likelihood of future incidents. In carrying out this plan, the Information Security Steering Committee evaluates cybersecurity incidents, or multiple related incidents, against specified criteria and, if one or more such criteria are met, reports those incidents to management.
Our cybersecurity program is aligned with industry standards and best practices, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and SOC 2 standards. We use a variety of tools and methodologies to monitor and manage cybersecurity risks and regularly evaluate our cybersecurity posture through activities such as vulnerability scanning, penetration testing, and the use of threat intelligence feeds. Our Information Security Team conducts periodic exercises to assess preparedness for information security incidents, including cybersecurity events. In addition, we promote a company-wide culture of cybersecurity awareness through new employee onboarding and ongoing employee training and education, including periodic phishing simulations.
We engage external experts, including cybersecurity assessors, consultants, and auditors, to assist in evaluating and attesting to our risk management systems, including through an annual SOC 2 audit covering the security, availability, confidentiality, and processing integrity trust services criteria. In recognition of the risks associated with third-party service providers, we also conduct risk assessments of selected systems and third-party service providers on an ongoing basis.
Governance
Board Oversight
Cybersecurity is an important area of focus for our board of directors. The board of directors is responsible for oversight of information security and cybersecurity risks, and we believe the board has the appropriate skills and visibility into the design and operation of our data security practices to fulfill this responsibility effectively.
Our Chief Information Security Officer and other members of management provide updates on cybersecurity matters to the board of directors on a quarterly basis, with additional updates as warranted. The board of directors also receives a quarterly cybersecurity report from our Chief Information Security Officer.
Management
Our Information Security Team, led by our Vice President of Information Technology, who also serves as our Chief Information Security Officer, is accountable for the day-to-day execution of our information security strategy and operations, including enterprise-level information security risk strategy, identification, prioritization, and mitigation.
The Information Security Steering Committee, which provides general oversight of the Information Security Team, is led by our Vice President of Information Technology/Chief Information Security Officer and is comprised of members of Company management who collectively have experience and expertise in information technology, enterprise security and risk management, cybersecurity, engineering, privacy, data security, lab operations, quality, and healthcare compliance. The Information Security Steering Committee meets monthly, and more frequently as needed to review matters including updates on existing and emerging cybersecurity risks and threats; prioritization, mitigation, and remediation activities; the status of initiatives to strengthen our information security systems; assessments of our information security program and operations; and prioritized information security incidents, if any.