XML 57 R38.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials, clinical candidates, and proprietary molecules, or Information Systems and Data.

Our information security function, led by our Chief Information Officer, and supported by members of our Information Technology (IT) and Quality Assurance teams, helps identify, assess, and manage the cybersecurity threats and risks to our IT infrastructure. These teams works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example: manual and automated tools (including cybersecurity software for incident detection and response); subscribing to and analyzing reports that identify cybersecurity threats; conducting scans of our threat environment; evaluating threats reported to us; working with third parties to conduct vulnerability assessments; and conducting risk assessments.

The Chief Information Officer reviews the cybersecurity risks identified by the information security function and the related action plan, before presenting it to the Chief Financial Officer and to the Risk Management committee, which is composed of the members of our management’s executive committee, generally twice per year, and to the Audit committee.

Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program.

We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example certain professional services firms, threat intelligence providers, cybersecurity consultants, cybersecurity software and managed service providers, and penetration testing firms.

We use third-party service providers to perform a variety of functions throughout our business, application providers, hosting companies, CROs and CMOs. We leverage contractual obligations related to data protection on certain of our vendors and seek to prioritize established vendors who may have such data protection measures in place.

For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 20-F, including the risk factor entitled “If our data or our information technology systems, or those of third parties with whom we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]

Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program.

Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors’ audit committee is responsible for overseeing our risk management processes generally, including oversight and mitigation of risks from cybersecurity threats.

The audit committee, which will now work in coordination with the corporate social responsibility committee, has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation which may be presented to the audit committee by the Chief Financial Officer and the Head of Internal Control.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The board of directors’ audit committee
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]

The audit committee, which will now work in coordination with the corporate social responsibility committee, has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation which may be presented to the audit committee by the Chief Financial Officer and the Head of Internal Control.

Cybersecurity Risk Role of Management [Text Block]

Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Information Officer and IT and security committee, which includes senior management including our CEO and Chief Financial Officer. Our Chief Information Officer has 7 years of experience in cybersecurity and information security, including prior roles as a cybersecurity consultant, engineer, and chief information security officer.

Our Chief Information Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer, under the supervision of the Chief Executive Officer, is responsible for approving budgets, reviewing our preparation for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports, proposed and prepared by the Chief Information Officer. As part of our management’s oversight, cybersecurity incidents are escalated the Chief Information Officer, and depending on the circumstances, may be raised to additional members of our management, as appropriate.

Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Company management, including our Chief Information Officer and IT and security committee, which includes senior management including our CEO and Chief Financial Officer.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our Chief Information Officer has 7 years of experience in cybersecurity and information security, including prior roles as a cybersecurity consultant, engineer, and chief information security officer.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our Chief Information Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer, under the supervision of the Chief Executive Officer, is responsible for approving budgets, reviewing our preparation for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports, proposed and prepared by the Chief Information Officer. As part of our management’s oversight, cybersecurity incidents are escalated the Chief Information Officer, and depending on the circumstances, may be raised to additional members of our management, as appropriate.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true