Oruka Therapeutics, Inc. 10-K

Item 1B. Unresolved Staff Comments. None. Item 1C. Cybersecurity. We collect, use, store, and transmit confidential, sensitive, proprietary, personal, and health-related information in the ordinary course of our business. As such, we leverage third-party information technology service providers who have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our information technology systems, including critical computer networks, third party hosted services, communications systems, hardware and software, and our data residing on these systems. Our Senior Vice President, Finance is responsible for overseeing these third-party service providers and processes. Cybersecurity risks are identified by monitoring and evaluating our threat environment, and then assessed by various methods, for example, by manual and automated tools designed to identify and combat cybersecurity threats, analyzing reports of threats, conducting scans and assessments of the threat environment and to identify vulnerabilities, the use of detection and response services and conducting reviews of third-party service providers, among other things. Depending on the threat environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including, for example, physical security and access controls, asset management, systems monitoring, incident detection and response, risk assessment, the implementation of security standards and certifications, encryption of data, network security controls, and a recovery/business continuity plan, among other mitigation tactics. Our recovery/business continuity plan is designed to mitigate and remediate identified cybersecurity incidents and escalate certain incidents as appropriate to management and the Audit Committee. We plan to conduct due diligence on and audits of key technology vendors, contract research organizations, and other third-party contractors and suppliers. Additionally, we conduct periodic employee training that covers cyber and information security, among other topics. Our assessment and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management process. Our Senior Vice President, Finance, who reports directly to the Chief Executive Officer, together with our senior management, is responsible for assessing and managing cybersecurity risks with support from our third-party information technology service providers that employ information technology consultants with over 20 years of experience managing cybersecurity programs. Our cybersecurity program aligns to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and is consistently updated as NIST recommendations change year over year. Our Senior Vice President, Finance, together with our senior management and other employees works closely with our information technology service providers to evaluate material cybersecurity threats against our overall business objectives as part of our cybersecurity incident response. The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage and mitigate those risks. The Audit Committee has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President, Finance. The Board also receives updates from management and the Audit Committee on cybersecurity risks on a regular basis. In the last fiscal year, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks or threats that, if realized, are reasonably likely to materially affect us. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our “Risk Factors” under Part 1 Item 1A. Risk Factors, in this Annual Report on Form 10-K. Item 2. Properties. Our corporate headquarters are in Menlo Park, California and we have an additional office in Waltham, Massachusetts. Our lease for our Menlo Park headquarters expires on September 30, 2027 and our lease for our Waltham office expires in 2029. We believe our current facilities are sufficient for our needs for the foreseeable future.