Item 1B. Unresolved Staff Comments
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.
ITEM 1C. CYBERSECURITY
We recognize the critical importance of maintaining the safety and security of our systems and data and have a program for overseeing and managing cybersecurity and related risks, which is supported by both management and our Board of Directors.
Our cybersecurity functions are led by our Chief Scientist and Chief Operating Officer (“CSCOO”), who is one of the Company’s founders and reports to our Chief Executive Officer. Our CSCOO has delegated the overall responsibility for overseeing our cybersecurity management program and the protection and defense of our networks and systems to the Director of IT and Information Security (“DITIS”). The DITIS ’s relevant experience in cybersecurity includes over 25 years of extensive experience, including six years with us, and roles including Director of Information Technology and Chief Information Officer at various other companies. The DITIS manages a team of IT professionals with broad experience and expertise , including in cybersecurity threat assessments, corporate firewall installation and management, enterprise infrastructure engineering, and network analysis, and who also support our cybersecurity incident response and vulnerability management efforts.
Our Board is responsible for overseeing our enterprise risk management activities in general, and the Audit Committee of the Board (“Audit Committee”), also reviews the adequacy and effectiveness of our information security policies and practices and the internal controls regarding information security risks. The Audit Committee receives regular information security updates from management. The full Board receives an update on our risk management process and the risk trends related to cybersecurity at least annually from management.
We also consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy.
Our cybersecurity strategy includes but is not limited to the following key elements:
Risk Assessment and Management – We follow processes outlined in the international standard ISO 27001, an Information Security Management System (ISMS), which helps safeguard the confidentiality, integrity, and availability of information through a structured risk management process. We believe that this approach helps us to manage cybersecurity risks by using a structured framework. However, as with any risk management program, absolute assurance cannot be provided.
Technical Security Controls – We employ layered security controls, including firewalls, identity and access management software and/or multi-factor authentication requirements for access to internal applications, and encryption technologies.
Vendor Risk Management Program – We have implemented processes to oversee, identify and manage risks from cybersecurity threats associated with our use of third-party service providers. Our vendor risk management program establishes governance, processes and tools for managing various risks related to third-party service providers, including information security and supplier-related risks.
As of December 31, 2025, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A, — “Risk Factors”.
36
ITEM 2. PROPERTIES
Our corporate headquarters is located in leased office space located in El Dorado Hills, California. All of our facilities are substantially comprised of leased premises for office space.