Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
Not applicable.
Item 1C. Cybersecurity
Risk Management and Strategy
We have established certain processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology functions and are designed to help protect our information, assets and operations from internal and external cyber threats.
Our cybersecurity risk management program is informed by recognized industry frameworks (e.g., NIST Cybersecurity Framework) which includes a risk assessment methodology designed to escalate cybersecurity risks to the appropriate channels within our organization to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise information technology (“IT”) environment. The IT and legal departments help identify, assess and manage our cybersecurity threats and risks. The IT department, in coordination with the legal department, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including evaluating threats reported to us, conducting audits, performing threat assessments, conducting vulnerability assessments and penetration tests.
Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including an incident response plan that we periodically review and test to ensure it is well understood and the processes are being properly followed. The incident response plan includes procedures for responding to cybersecurity incidents and escalating cybersecurity incidents to cross-functional teams, management and our Board of Directors. Other controls include business continuity plans, encryption of data, network security controls, systems monitoring, mandatory annual employee training, and cybersecurity insurance. Our assessment and management of material risks from cybersecurity threats are integrated into our risk management protocols. Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, including the involvement of cross-functional teams and, depending on the nature and severity of an incident, an escalation path to notify our executive and senior management teams and our Board of Directors. Material cybersecurity incidents are escalated to the Audit Committee and, as appropriate, the Board of Directors.
We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including professional service firms, legal counsel, cybersecurity software providers and managed cybersecurity service providers. We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations and supply chain resources. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment which may include security questionnaires, review of System and Organization Controls reports, contractual requirements, and
104
Table of Co ntents
periodic reassessments designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.
We do not believe that there are currently any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding risks we face, please refer to Part I, Item 1A “Risk Factors—Risks Related to Employee Matters, Managing Growth, Public Health and Information Technology—Security breaches and other disruptions to our information technology structure could compromise our information, disrupt our business and expose us to liability, which would cause our business and reputation to suffer” of this Annual Report on Form 10-K.
Governance
Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee of our Board oversight of cybersecurity and other information technology risks. The Audit Committee of our Board of Directors oversees our cybersecurity and data privacy risk management activities, and reports to the Board regarding such oversight as appropriate. The Audit Committee receives updates from management, including our Head of IT, regarding cybersecurity matters not less than twice per year, and is notified between such updates regarding any significant new cybersecurity threats or incidents.
Our Head of IT , who reports to our Chief Technical and Quality Officer and is a member of our senior leadership team, has primary responsibility for day-to-day management of our cybersecurity risk management program, including leading a dedicated team of IT professionals to monitor and assess cybersecurity risks, and is responsible for strategic leadership of our cybersecurity risk management program. The Head of IT role is currently held by an individual who has over 15 years of professional IT management experience in the life sciences industry. The Head of IT collaborates closely and regularly with an external consulting firm that provides a fractional Chief Information Security Officer, who has over 25 years of experience, including in senior information technology and cybersecurity management positions. Our Head of IT provides regular updates on our cybersecurity risk to our executive leadership team and other management responsible for IT and cybersecurity risk management.
Item 2. Properties.
We lease 59,783 square feet of office and laboratory space in Cambridge, Massachusetts under a lease that expires in October 2028. We believe that our facilities are sufficient to meet our current needs and that suitable additional space will be available as and when needed .