Risk Management and Strategy

The Company’s cybersecurity program is focused on the following key areas:

Governance: The Board of Directors’ oversight of cybersecurity risk management is supported by the Audit Committee of the Board of Directors (the “Audit Committee”), which regularly interacts with our Head of IT and our executive management team.

Collaborative Approach: We have implemented a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

Incident Response and Recovery Planning: We have established and maintain incident response and recovery plans to address our response to a cybersecurity incident. We use a manage, detection, and response (MDR) partner to provide threat detection and response capabilities. We also utilize security consultants including a vCISO to assess and continuously improve our cybersecurity program.

Third Party Risk Management: We strive to proactively manage third party risks to minimize any adverse effects on our business that may arise due to a cybersecurity incident affecting third party systems and vendors. Although we rely on third party vendors to manage and maintain their own cybersecurity defense programs, we continue to improve on our vendor risk management program to assess our exposure to these external cybersecurity risks, including the use of external security rating services and by evaluating vendor responses to our cybersecurity questionnaire.

Education and Awareness: We provide mandatory training and resources for personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

We engage in the periodic assessment and testing of our cybersecurity program. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. These activities may be performed by external cybersecurity and application security professionals.

We recognize the critical importance of maintaining the trust and confidence of all of our stakeholders. Our business depends on the efficient and uninterrupted operation of our information technology systems and those of our third party CROs, CMOs, or other vendors, contractors or consultants.

Governance

In connection with the Spin-Off, we entered into a Transition Services Agreement with First Tracks Biotherapeutics. Under the terms of the agreement, First Tracks Biotherapeutics provides critical information technology infrastructure and comprehensive cybersecurity services, including network security monitoring and threat detection, for an interim period expected to last up to twelve months. While we temporarily rely on the services provided by First Tracks Biotherapeutics, we maintain responsibility for assessing and managing our cybersecurity risks.