Cybersecurity Risk Management, Strategy, and Governance |
12 Months Ended |
|---|---|
Dec. 31, 2025 | |
| Cybersecurity Risk Management, Strategy, and Governance [Line Items] | |
| Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Item 1C. Cybersecurity We recognize the critical importance of cybersecurity in our overall enterprise risk management program. We have developed and implemented a comprehensive and cross-functional cybersecurity risk management program intended to protect the confidentiality, security, and availability of the information we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents. Our board of directors and management team monitor and evaluate cybersecurity risk on an ongoing basis. Risk Management and Strategy Our cybersecurity risk management program is focused on the following key areas: 1. Governance: As described under “Governance” below, our board of directors oversees cybersecurity risk management in coordination with the audit committee of our board of directors, which regularly interacts with our management team, including our Chief Executive Officer, our General Counsel, our Senior Vice President, Finance, and our Senior Director, Head of IT, or Head of IT. 2. Cross-Functional Approach: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. 3. Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, data security, regular maintenance and patching and access controls which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. 4. Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. 5. Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We have implemented communication channels with our key third-party vendors to communicate regarding potential cybersecurity risks and incidents. 6. Training and Awareness: We provide regular training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. Additionally, we regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our audit committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any cybersecurity threats, that have materially affected or are likely to affect us, including our business strategy, results of operations or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the “Risk Factors” disclosures in Item 1A of this Annual Report on Form 10-K.
Governance Our board of directors, in coordination with our audit committee, oversees our enterprise risk management program, including cybersecurity risk management. On a regular basis, our audit committee discusses our cybersecurity risk management program with our Head of IT and other senior leaders. Our audit committee receives regular reports from our Head of IT on cybersecurity and information technology, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technology trends and information security considerations arising with respect to our peers and third parties. Our full board of directors receives reports from our audit committee on its cybersecurity risk management activities and updates from our management team on our cybersecurity risk management. Our management team, including our Head of IT and our Senior Vice President, Finance, has primary responsibility for developing and managing our overall cybersecurity risk management program. Our Head of IT supervises our internal cybersecurity personnel and our third-party cybersecurity vendors and consultants. Our management team has over 20 years of experience managing risks, including cybersecurity risks, at biotechnology companies and interacting with boards, and our Head of IT has served in various roles in information technology and information security for over 20 years. Our Head of IT works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, cross-functional teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Head of IT monitors the prevention, detection, escalation, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to our audit committee when appropriate. |
| Cybersecurity Risk Management Third Party Engaged [Flag] | true |
| Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false |
| Cybersecurity Risk Board of Directors Oversight [Text Block] | Governance Our board of directors, in coordination with our audit committee, oversees our enterprise risk management program, including cybersecurity risk management. On a regular basis, our audit committee discusses our cybersecurity risk management program with our Head of IT and other senior leaders. Our audit committee receives regular reports from our Head of IT on cybersecurity and information technology, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technology trends and information security considerations arising with respect to our peers and third parties. Our full board of directors receives reports from our audit committee on its cybersecurity risk management activities and updates from our management team on our cybersecurity risk management. Our management team, including our Head of IT and our Senior Vice President, Finance, has primary responsibility for developing and managing our overall cybersecurity risk management program. Our Head of IT supervises our internal cybersecurity personnel and our third-party cybersecurity vendors and consultants. Our management team has over 20 years of experience managing risks, including cybersecurity risks, at biotechnology companies and interacting with boards, and our Head of IT has served in various roles in information technology and information security for over 20 years. Our Head of IT works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, cross-functional teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Head of IT monitors the prevention, detection, escalation, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to our audit committee when appropriate. |
| Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our board of directors, in coordination with our audit committee, oversees our enterprise risk management program, including cybersecurity risk management. |
| Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our audit committee receives regular reports from our Head of IT on cybersecurity and information technology, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technology trends and information security considerations arising with respect to our peers and third parties. Our full board of directors receives reports from our audit committee on its cybersecurity risk management activities and updates from our management team on our cybersecurity risk management. |
| Cybersecurity Risk Role of Management [Text Block] | Our management team, including our Head of IT and our Senior Vice President, Finance, has primary responsibility for developing and managing our overall cybersecurity risk management program. Our Head of IT supervises our internal cybersecurity personnel and our third-party cybersecurity vendors and consultants. Our management team has over 20 years of experience managing risks, including cybersecurity risks, at biotechnology companies and interacting with boards, and our Head of IT has served in various roles in information technology and information security for over 20 years. Our Head of IT works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, cross-functional teams throughout the company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Head of IT monitors the prevention, detection, escalation, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to our audit committee when appropriate. |
| Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true |
| Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Our management team, including our Head of IT and our Senior Vice President, Finance, has primary responsibility for developing and managing our overall cybersecurity risk management program. Our Head of IT supervises our internal cybersecurity personnel and our third-party cybersecurity vendors and consultants. |
| Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our management team has over 20 years of experience managing risks, including cybersecurity risks, at biotechnology companies and interacting with boards, and our Head of IT has served in various roles in information technology and information security for over 20 years. |
| Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Through ongoing communications with these teams, the Head of IT monitors the prevention, detection, escalation, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to our audit committee when appropriate. |
| Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true |