13 unchanged sentences
risk management;
+Added: use of AI applications;
and vendor risk and management, which leverages and coordinates with procedures in place for the accounting payable process.
−Removed: We have established physical, electronic, and organizational measures to safeguard and secure our systems to prevent a data compromise.
−Removed: These approaches vary in maturity across our business and we work to continually improve them.
+Added: In the year ended December 31, 2025, the Company undertook a data migration to move our data storage and shared files to a SharePoint-based data storage system, which offers a secure, cloud-based document management system that enhances collaboration, organization, and security through centralized storage.
+Added: Key advantages for cybersecurity include facilitating efficient workflows and remote work.
+Added: Recent security issues, such as the active exploitation of critical vulnerabilities, have highlighted the risks of on-premises servers, particularly as it relates to ransomware and remote exploitation.
+Added: The data migration project was a project undertaken to improve our information systems, as such the term is defined in Item 106(a) of Regulation S-K is scheduled on 2024 IT plan.
+Added: We anticipate that our data migration project will be completed in Q2 2026.
Our approach includes, among other things:
−Removed: • conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K is scheduled on 2024 IT plan;
+Added: • conducting limited, point-in-time network and endpoint security controls;
• requiring regular cybersecurity training programs for employees, management and directors;
1 unchanged sentence
• leveraging the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident;
−Removed: • operating threat intelligence processes designed to model and research our adversaries;
−Removed: • conducting regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats;
+Added: • conducting firm-wide annual training exercises for employees and contractors with access to the Company’s system to raise awareness to possible threats such as phishing email simulations;
• maintaining copies of production data in two separate locations;
• running a backup for our data on a daily basis and these files are held for several months;
−Removed: • testing the backup and recovery systems frequently;
−Removed: • employing a multi-factor authorization for employees who are working remotely, in order to mitigate risks of compromising email accounts;
+Added: • testing the backup and recovery systems;
+Added: • employing a multi-factor authorization in order to mitigate risks of compromising email accounts;
• holding an insurance policy to mitigate risks for cybersecurity incidents.
Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all Company risks.
−Removed: As part of this process, appropriate HCWB personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigation.
+Added: As part of this process, appropriate our personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigation.
A key element of managing cybersecurity risk is the ongoing assessment and testing of our processes and practices through auditing, assessments, drills and other exercises focused on evaluating the sufficiency and effectiveness of our risk mitigation.
2 unchanged sentences
Our policy is to conduct an annual cybersecurity assessment and make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.
−Removed: For the year ended December 31, 2024, the findings of our annual cybersecurity assessment indicated that HCW Biologics has implemented several key security measures, including documented policies, data encryption, unique user identifiers, DNS filtering, and anti-malware tools.
−Removed: We are in the proactive range for compliance with SEC cybersecurity guidelines, that is, we can address common attacks and current threats.
−Removed: For the year ending December 31, 2025, the Company has launched projects to improve our controls, particularly for logging and monitoring and vulnerability assessments.
−Removed: We currently leverage an AI-driven endpoint threat detection and prevention system.
+Added: Upon completion of the data migration project, the Company will make further improvements to improve our controls, particularly for logging and monitoring and vulnerability assessments.
To strengthen our cybersecurity posture, we intend to implement a Security Information and Event Management (SIEM) solution that will aggregate and analyze logs from all critical infrastructure, including network, cloud, and endpoint security platforms.
We also intend to expand our vulnerability management process to ensure regular assessments of public-facing systems and network devices.
−Removed: We are currently conducting a data migration project is expected to enhance the Company’s security posture and resilience against potential threats, in compliance with SEC guidelines.
For the year ended December 31, 2025, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.
4 unchanged sentences
Our Audit Committee of our Board of Directors is responsible for the oversight of risks from cybersecurity threats.
−Removed: At least annually, th e Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as
−Removed: the steps management has taken to respond to such risks.
+Added: At least annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.
In such sessions, the Audit Committee generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing our ability to mitigate those risks, and discusses such matters with our Operations Administrator, who is supported by Compass MSP, a leading provider of technology managed services.
7 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.