Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Risk Management and Strategy

Safeguarding the Company’s information systems, assets, data, intellectual property and network infrastructure and ensuring that risks related to cybersecurity threats are appropriately managed is essential to maintaining a consistently high level of confidentiality, integrity and availability of our information systems; and the trust of our stakeholders, as well as meeting applicable regulatory requirements. We have implemented a multi-faceted cybersecurity risk management framework, which is integrated in our overall enterprise risk management system and processes.

Our cybersecurity team is tasked with assessing, identifying and managing risks related to cybersecurity threats and, is responsible for:

●

proactive detection and assessment of threats and vulnerabilities through vulnerability testing, penetration testing and attack simulation;

●

development of risk-based action plans to manage identified vulnerabilities and implementation of new protocols and infrastructure improvements;

●

cybersecurity incident investigations, with the assistance of third-party experts as required;

●

monitoring threats to sensitive data and unauthorized access to Company systems, with assistance of third-party data loss prevention software and a third-party security operations center;

●

developing and executing protocols to ensure that information regarding cybersecurity incidents is promptly shared with our chief information officer, executive leadership team, Audit Committee and Board, as appropriate, to allow for risk and materiality assessments and to consider disclosure and notice requirements;

●

developing and implementing periodic training on cybersecurity, information security and threat awareness; and

●

collaborating with law enforcement and other companies on cybersecurity incidents and best practices.

We also use third - party service providers to perform a variety of functions throughout our business such as hosting companies and contract research organizations. We manage cybersecurity risks associated with our use of these providers using several approaches, as deemed necessary, including security questionnaires, review of compliance reports, audits and the imposition of information security contractual obligations on vendors.

For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Item 3.D “Risk Factors” in this Annual Report on Form 20 - F.

Role of Management

Our chief information officer leads management’s assessment, identification and management of risks related to cybersecurity threats and reports directly to our Chief Executive Officer. The chief information officer receives regular briefings on cybersecurity matters including results of vulnerability testing and remediation, cyber incident response and progress on cybersecurity infrastructure initiatives.

Cybersecurity Risk Management Processes Integrated [Text Block]

Safeguarding the Company’s information systems, assets, data, intellectual property and network infrastructure and ensuring that risks related to cybersecurity threats are appropriately managed is essential to maintaining a consistently high level of confidentiality, integrity and availability of our information systems; and the trust of our stakeholders, as well as meeting applicable regulatory requirements. We have implemented a multi-faceted cybersecurity risk management framework, which is integrated in our overall enterprise risk management system and processes.

Our cybersecurity team is tasked with assessing, identifying and managing risks related to cybersecurity threats and, is responsible for:

●

proactive detection and assessment of threats and vulnerabilities through vulnerability testing, penetration testing and attack simulation;

●

development of risk-based action plans to manage identified vulnerabilities and implementation of new protocols and infrastructure improvements;

●

cybersecurity incident investigations, with the assistance of third-party experts as required;

●

monitoring threats to sensitive data and unauthorized access to Company systems, with assistance of third-party data loss prevention software and a third-party security operations center;

●

developing and executing protocols to ensure that information regarding cybersecurity incidents is promptly shared with our chief information officer, executive leadership team, Audit Committee and Board, as appropriate, to allow for risk and materiality assessments and to consider disclosure and notice requirements;

●

developing and implementing periodic training on cybersecurity, information security and threat awareness; and

●

collaborating with law enforcement and other companies on cybersecurity incidents and best practices.

We also use third - party service providers to perform a variety of functions throughout our business such as hosting companies and contract research organizations. We manage cybersecurity risks associated with our use of these providers using several approaches, as deemed necessary, including security questionnaires, review of compliance reports, audits and the imposition of information security contractual obligations on vendors.

Cybersecurity Risk Third Party Oversight and Identification Processes [Flag]

true

Cybersecurity Risk Board of Directors Oversight [Text Block]

Our Board recognizes the importance of robust cybersecurity management programs and is actively engaged in overseeing and reviewing the Company’s cybersecurity risk profile and exposures.

The responsibilities of the Board include reviewing the cybersecurity threat landscape facing the Company, as well as our strategy, policies and procedures to mitigate cybersecurity risks and any significant cybersecurity incidents. The Board also considers the impact of emerging cybersecurity developments and regulations that may affect the Company.

The Board meets periodically with relevant members of management, who provide reports on cybersecurity matters including, among others: recent external cybersecurity threats and attack trends; updates to threat monitoring processes; the composition of our cybersecurity team; cybersecurity awareness training and stress testing; cybersecurity strategy; cybersecurity metrics, assessments and peer ratings; and cybersecurity programs. The Board has also directed management to be informed promptly and of any investigation of a material cybersecurity incident. The Board may, from time to time, engage third party advisors and experts, and meet with the Company’s external advisors on cybersecurity matters, as appropriate.

Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]

●

developing and executing protocols to ensure that information regarding cybersecurity incidents is promptly shared with our chief information officer, executive leadership team, Audit Committee and Board, as appropriate, to allow for risk and materiality assessments and to consider disclosure and notice requirements;

The Board meets periodically with relevant members of management, who provide reports on cybersecurity matters including, among others: recent external cybersecurity threats and attack trends; updates to threat monitoring processes; the composition of our cybersecurity team; cybersecurity awareness training and stress testing; cybersecurity strategy; cybersecurity metrics, assessments and peer ratings; and cybersecurity programs. The Board has also directed management to be informed promptly and of any investigation of a material cybersecurity incident. The Board may, from time to time, engage third party advisors and experts, and meet with the Company’s external advisors on cybersecurity matters, as appropriate.

Cybersecurity Risk Management Positions or Committees Responsible [Flag]

true

Cybersecurity Risk Management Expertise of Management Responsible [Text Block]

The chief information officer receives regular briefings on cybersecurity matters including results of vulnerability testing and remediation, cyber incident response and progress on cybersecurity infrastructure initiatives.

Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag]

true