XML 48 R31.htm IDEA: XBRL DOCUMENT v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We have implemented and maintain a cybersecurity program that includes various processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software (collectively, "Information Systems"), and our critical data, including clinical trial and candidate data, intellectual property, and confidential information that is proprietary, strategic or competitive in nature (collectively with Information Systems, "Information Systems and Data").
Our program is designed and assessed using the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which guides our approach to identifying, assessing, and managing material cybersecurity risks relevant to our business. While we use this framework to inform our cybersecurity practices, this does not imply compliance with any particular technical standards, specifications, or requirements.
Under this framework, our information security function, led by our Chief Information Officer, helps to identify, assess and manage the Company’s cybersecurity threats and risks. Key elements of our cybersecurity risk management program include but are not limited to the following efforts. We conduct assessments to help identify and assess material risks from cybersecurity threats to our critical systems and information. We monitor and evaluate our threat environment using various methods including, for example deploying automated tools in certain environments, subscribing to and analyzing reports and services that identify certain cybersecurity threats, conducting scans of certain aspects of our threat environment, evaluating certain threats that are reported to us, conducting internal and external audits and internal threat assessment of certain environments, engaging third parties to conduct threat assessments, and conducting vulnerability assessments.
We also engage third-party providers, where appropriate, to periodically assess certain of our internal controls and processes for information security. Further, we take certain measures to mitigate cybersecurity risks, including, for example, cybersecurity awareness training for employees and management, periodic testing through simulated "phishing" campaigns (and require remedial training based on results) and the adoption of an incident response plan that includes procedures for responding to cybersecurity incidents, a vulnerability management policy and a business recovery plan.
Furthermore, our information security team works with a security committee (the "Security Committee") to manage our cybersecurity risk management processes, our security controls, and our response to cybersecurity incidents. We use third-party service providers to perform a variety of functions throughout our business, such as CROs and CMOs. Under our information security function, we perform risk and security assessments for certain key vendors that involves a review of the vendor’s written security program. Depending on the nature of the services provided, the vendor's criticality to our operations and the vendor's respective risk profile, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the vendor.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
We have implemented and maintain a cybersecurity program that includes various processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software (collectively, "Information Systems"), and our critical data, including clinical trial and candidate data, intellectual property, and confidential information that is proprietary, strategic or competitive in nature (collectively with Information Systems, "Information Systems and Data").
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Our board of directors considers cybersecurity risk management as part of its general oversight function and has delegated to the Audit Committee oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management programs.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our board of directors considers cybersecurity risk management as part of its general oversight function and has delegated to the Audit Committee oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management programs.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
Our CIO chairs our Security Committee, which helps to identify, assess and manage our material cybersecurity threats and risks. Our CIO has over 20 years of strategic and operational IT/cybersecurity leadership experience and multiple cybersecurity certifications, from leading security organizations, such as (ISC)2, Cloud Security Alliance, Cisco Security, Microsoft Security. Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal personnel; threat intelligence and other information obtained from public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.
Cybersecurity Risk Role of Management [Text Block]
The Audit Committee receives periodic reports from management, specifically our Chief Information Officer (“CIO”), on our information security program and cybersecurity risks. In addition, management updates the Audit Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.
Our CIO chairs our Security Committee, which helps to identify, assess and manage our material cybersecurity threats and risks. Our CIO has over 20 years of strategic and operational IT/cybersecurity leadership experience and multiple cybersecurity certifications, from leading security organizations, such as (ISC)2, Cloud Security Alliance, Cisco Security, Microsoft Security. Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal personnel; threat intelligence and other information obtained from public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
Our CIO chairs our Security Committee, which helps to identify, assess and manage our material cybersecurity threats and risks. Our CIO has over 20 years of strategic and operational IT/cybersecurity leadership experience and multiple cybersecurity certifications, from leading security organizations, such as (ISC)2, Cloud Security Alliance, Cisco Security, Microsoft Security. Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal personnel; threat intelligence and other information obtained from public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CIO has over 20 years of strategic and operational IT/cybersecurity leadership experience and multiple cybersecurity certifications, from leading security organizations, such as (ISC)2, Cloud Security Alliance, Cisco Security, Microsoft Security.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
Our CIO chairs our Security Committee, which helps to identify, assess and manage our material cybersecurity threats and risks. Our CIO has over 20 years of strategic and operational IT/cybersecurity leadership experience and multiple cybersecurity certifications, from leading security organizations, such as (ISC)2, Cloud Security Alliance, Cisco Security, Microsoft Security. Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal personnel; threat intelligence and other information obtained from public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true