What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-30 compared with 2025-03-31 · 28 added, 26 removed, 24 unchanged (69% of the section changed)

13 unchanged sentences

is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us.

The full Board retains

oversight of cybersecurity because of its importance.

In the event of an incident, we intend to follow our detailed incident response

playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying

functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate.

Our Cybersecurity consultant has extensive

information technology and program management experience.

We have implemented a governance structure and processes to assess, identify,

manage, and report cybersecurity risks .

The full Board

retains oversight of cybersecurity because of its importance.

In the event of an incident, we intend to follow our detailed incident

response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including

notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate.

Our Cybersecurity consultant has

extensive information technology and program management experience.

We have implemented a governance structure and processes to assess,

identify, manage, and report cybersecurity risks

As a biotechnology company, we must comply with

extensive regulations, including requirements imposed by the Food and Drug Administration related to adequately safeguarding patient information

and reporting cybersecurity incidents to the SEC.

We work with our cybersecurity consultant on assessing cybersecurity risk and on policies

and practices aimed at mitigating these risks.

extensive regulations, including requirements imposed by the Food and Drug Administration related to adequately safeguarding patient

information and reporting cybersecurity incidents to the SEC.

We work with our cybersecurity consultant on assessing cybersecurity risk

and on policies and practices aimed at mitigating these risks.

We believe we are positioned to meet the requirements of the SEC.

In addition to following

SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe

enhance our ability to identify and manage cybersecurity risks.

to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which

we believe enhance our ability to identify and manage cybersecurity risks.

Third parties also play a role in our cybersecurity.

We engage third-party

services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best

practices to address new challenges.

Assessing, identifying, and managing cybersecurity related risks are factored into our overall business

We rely heavily on our vendors and suppliers to

deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely

We require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on

Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity

incident that could have a material adverse effect on us.

The costs related to cybersecurity threats or disruptions may not be fully insured.

third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting

on best practices to address new challenges.

Assessing, identifying, and managing cybersecurity related risks are factored into our overall

business approach.

We rely heavily on our vendors and suppliers

to deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially

adversely impact us.

We require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the

incident onus.

Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating

a cybersecurity incident that could have a material adverse effect on us.

The costs related to cybersecurity threats or disruptions may

not be fully insured.

See “Risk Factors” for a discussion of cybersecurity risks.

6 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments