Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
None.
Item 1C. Cybersecurity
We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect information belonging to our stakeholders from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, response plans, regular testing of our systems, and routine review of our policies and procedures to identify risks and adapt our practices. We engage certain external parties, including independent privacy assessors, computer security firms, and risk management and governance experts, to assist with assessing and managing our cybersecurity oversight functions.
91
TABLE OF CONTENTS
As of the date of this Annual Report, we have not experienced any cybersecurity incidents that resulted in a material effect on our business strategy, results of operations, or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. See Part I, Item 1A. “Risk Factors” in this Annual Report for additional information on cybersecurity risks we face.
The Audit Committee of the board of directors is responsible for reviewing and assessing the integrity of our information technology systems, processes and data, and meets with management on at least an annual basis to review and assess our cyber and technology-related risks, including network security, information security, and data privacy and protection, our technologies, policies, processes, and practices for assessing, monitoring, managing and mitigation those risks, and the steps management has taken to identify, assess, monitor, manage and mitigate those risks, among other matters.
Our Chief Business Operations Officer oversees our company-wide cybersecurity strategy, policy, standards, and processes across relevant departments. The Chief Business Operations Officer has over 15 years of experience overseeing key operational activities in the life sciences industry and works closely with our experienced information technology consulting firm, which helps to assess and prepare us and our employees to maintain awareness of cybersecurity risks, including email, web, and data security. Our outside information technology consultants have extensive experience designing, implementing, and running information technology and cybersecurity programs and processes using the National Institute of Standards and Technology Framework.
To deter and detect cyber threats, we provide all employees with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. To mitigate cybersecurity risks and bolster our employee-based cybersecurity programs, we monitor all user traffic and restrict access by country. In addition, access to web sites is filtered and monitored, and credentials for systems and services require multi-factor authentication whenever possible.