Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments.
None.
Item 1C. Cybersecurity.
We believe cybersecurity risk management is an
important part of its overall risk management efforts. The Company has a policy of transparency regarding our data collection, use, retention
and sharing practices, and it is our commitment to implement appropriate technical security measures to protect all Company stakeholders
and manage third party risk.
Our operations may, in some cases, involve the
storage, transmission and other processing of customer and research data or sales information. Cyberattacks and other malicious internet-based
activity continue to increase, and cloud-based platform providers of services are expected to continue to be targeted. Threats include
traditional computer “hackers,” malicious code (such as viruses and worms), phishing attacks, employee theft or misuse and
denial-of-service attacks, and use of artificial intelligence. We have not experienced cyberattacks in the past, and there can be no guarantee
that in the future such cyberattacks will not be material. We maintain an information security program that is comprised of policies and
controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats
that are not fully mitigated, and we continuously work to enhance our information security program and risk management efforts. In addition,
cybersecurity incidents could have material adverse effects on our business strategy, financial condition, and results of operations (e.g.,
a significant breach could result in direct financial losses due to fraud, system downtime impacting revenue generation, increased compliance
costs or contractual liabilities with third-party vendors and customers).
Depending on the environment and system, we implement
and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate
material risks from cybersecurity threats, including, for example, periodic cybersecurity testing and cybersecurity awareness training
for employees.
The Company is actively engaged in identifying
and managing cybersecurity risks. Protecting company data, non-public customer and employee data, and the systems that collect, process,
and maintain this information is deemed critical.
We use third-party service providers to perform
a variety of functions throughout our business, including manufacturing our product candidates and assisting with R&D activities.
Depending on the nature of the services provided, the sensitivity of the systems and data at issue, and the identity of the provider,
our vendor contracting processes may include imposing certain contractual provisions related to privacy and cybersecurity.
In addition, the Board will oversee any cybersecurity
risk management framework and a dedicated committee of the Board or an officer appointed by the Board will review and approve any cybersecurity
policies, strategies and risk management practices. The Board (or designated committee or officer) will receive periodic updates on cybersecurity
risks, including emerging threats, mitigation efforts and incident response activities. The updates will be provided at least annually,
or more frequently as needed, to ensure cybersecurity risks are appropriately managed and integrated into our broader risk oversight strategy.
Cybersecurity Risk
In 2023, the SEC adopted new
rules to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incidents by public companies
that are subject to the reporting requirements of the Exchange Act. These require current disclosure about material cybersecurity incidents,
as well as requiring periodic disclosures about a public company’s processes to assess, identify, and manage material cybersecurity
risks, management’s role in assessing and managing material cybersecurity risks, and the board of directors’ oversight of
cybersecurity risks. If we fail to comply with these rules, we could be subject to various regulatory sanctions, including
financial penalties.
46
State regulators have been increasingly active
in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain
financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including
data encryption requirements. Many states have also recently implemented or modified their data breach notification, information security
and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring
developments where our customers are located.
Risks and exposures related to cybersecurity attacks,
including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature
and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking, and other technology-based
products and services by us.
Governance
The Board, in coordination with the Audit Committee,
oversees the Company’s processes for assessing and managing risk. The Board and Audit Committee may review the measures implemented
by the Company to identify and mitigate data protection and cybersecurity risks. The Company’s Audit Committee is also responsible
for overseeing cybersecurity risk and are informed in a timely manner of any incidents considered potentially serious, together with details
on the prevention, detection, mitigation and remediation of such incidents.
Risks from Cybersecurity Threats
As of the date of this Annual Report, we are
not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect
the Company, including our business strategy, results of operations, or financial condition. However, we cannot provide assurance that
we will not experience any such event in the future.