Item 1B. Unresolved Staff Comments
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.
ITEM 1C. CYBERSECURITY
We believe cybersecurity is critical to achieving
our drug development advancements. As a biotechnology company, we face a multitude of cybersecurity threats that range from attacks common
to most industries, such as ransomware and denial-of service. Our suppliers, subcontractors, and business partners face similar cybersecurity
threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance,
and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.
Our Board of Directors oversees management’s
processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives.
Senior leadership regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors
is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board
retains oversight of cybersecurity because of its importance. In the event of an incident, we intend to follow our detailed incident
response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including
notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Our Cybersecurity consultant has
extensive information technology and program management experience. We have implemented a governance structure and processes to assess,
identify, manage, and report cybersecurity risks
- 70 -
As a biotechnology company, we must comply with
extensive regulations, including requirements imposed by the Food and Drug Administration related to adequately safeguarding patient
information and reporting cybersecurity incidents to the SEC. We work with our cybersecurity consultant on assessing cybersecurity risk
and on policies and practices aimed at mitigating these risks. We believe we are positioned to meet the requirements of the SEC. In addition
to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which
we believe enhance our ability to identify and manage cybersecurity risks. Third parties also play a role in our cybersecurity. We engage
third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting
on best practices to address new challenges. Assessing, identifying, and managing cybersecurity related risks are factored into our overall
business approach.
We rely heavily on our vendors and suppliers
to deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially
adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the
incident onus. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating
a cybersecurity incident that could have a material adverse effect on us. The costs related to cybersecurity threats or disruptions may
not be fully insured. See “Risk Factors” for a discussion of cybersecurity risks.
ITEM 2. PROPERTIES
Our principal address is 4300 El Camino Real,
Suite 210, Los Altos, CA 94022. We believe our facilities are adequate to meet our current needs, although we may seek to negotiate new
leases or evaluate additional or alternate space for our operations. We believe appropriate alternative space would be readily available
on commercially reasonable terms.