Contineum Therapeutics, Inc. 10-K

Item 1B. Unresolved Staff Comments. None. Item 1C. Cybersecurity. Risk Management and Strategy We maintain a proactive approach to identifying, assessing, and mitigating cybersecurity risks, which is integrated into our broader risk considerations and informed by industry best-practices. Our efforts include, but are not limited to, continuous monitoring of systems for vulnerabilities, deployment of advanced security tools for threat detection and response, and implementation of access controls and encryption to protect sensitive data. We maintain an official Incident Response Policy that outlines procedures for triage, containment, remediation, and recovery in the event of a cybersecurity incident. In addition, we conduct periodic employee training and phishing simulations to reinforce awareness and preparedness. In fiscal year 2025, and through the filing of this Annual Report on Form 10-K, we have not identified cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Cybersecurity Governance Oversight of cybersecurity resides with our management team, including our Chief Financial Officer, our Director, of IT & Cybersecurity with day-to-day management and execution of our cybersecurity program being a shared responsibilities between our Director of IT & Cybersecurity and our third-party managed cybersecurity services provider . Our Director of IT & Cybersecurity has over 25 years of experience in information technology and cybersecurity and reports directly to our Chief Financial Officer. Management monitors cybersecurity risks through regular briefings and reports generated from security tools. Our Board of Directors has delegated oversight of cybersecurity risk management to our Audit Committee, which reviews significant risk exposures and receives periodic updates from management. Any material cybersecurity incidents would be escalated in accordance with our Incident Response Policy and applicable disclosure procedures.