We engage third-party service providers to assist us in assessing, monitoring and managing cybersecurity risks and the effectiveness of our cybersecurity processes and controls. We and our third-party service providers utilize managed detection and response services to monitor our technology infrastructure and information systems for potential cybersecurity threats. We also provide cybersecurity awareness training to employees regarding cybersecurity threats and their responsibilities in identifying, preventing and responding to potential cybersecurity incidents.

Because we rely on third-party service providers, contractors, consultants, collaborators and other third parties in conducting our business, cybersecurity incidents affecting the information systems of such third parties could also adversely affect us. We seek to assess and manage cybersecurity risks associated with third-party service providers as appropriate based on the nature of the services provided and the information systems or data involved. However, our ability to monitor and control cybersecurity risks associated with third parties is limited, and there can be no assurance that cybersecurity measures implemented by us or our third parties will prevent or mitigate all cybersecurity threats or incidents.

During the last two fiscal years, we have not identified any cybersecurity threats or incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition. However, cybersecurity threats are evolving and becoming increasingly sophisticated, and we cannot eliminate all cybersecurity risk or provide assurance that we will not experience a material cybersecurity incident in the future or that we have not experienced an undetected cybersecurity incident. For additional information regarding cybersecurity risks, see Item 1A. “Risk Factors—Our internal computer systems, or those of our third-party contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs.”

Management’s role. Our Executive Vice President, Chief Financial Officer and Chief Operating Officer, Stephen T. Wills, is the member of management responsible for assessing and managing material risks from cybersecurity threats and for implementing and maintaining our cybersecurity risk management processes. Mr. Wills does not have formal training in information security. His relevant experience consists of nearly 30 years as our Chief Financial Officer, and 15 years as our Chief Operating Officer, with responsibility for our financial reporting systems, disclosure controls and procedures and internal control over financial reporting and for the selection and oversight of the third-party providers on which we rely for information technology and cybersecurity. Management, including Mr. Wills, works with our third-party information technology and cybersecurity service providers in monitoring our information systems, evaluating cybersecurity threats and responding to cybersecurity incidents. Material cybersecurity matters, if identified, are reported to the audit committee and, as appropriate, the board of directors.