XML 43 R27.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. Our enterprise risk management system incorporates risks from cybersecurity threats alongside other risks to the Company. Our information technology team oversees and implements a range of tools and services designed to minimize the risk or impact of any breach or unauthorized disclosure of our confidential and sensitive data. These tools and services include, from time to time:

monitoring emerging data protection laws and best practices regarding application security, access management, device protection, network management, and data loss prevention and recovery and implementing responsive changes to our processes;
undertaking periodic reviews of our partner-facing policies and statements related to cybersecurity;
utilizing intrusion detection and monitoring applications and multifactor authentication;
conducting periodic table-top exercises with management, including our Executive Director, Corporate Information Systems, and testing of our data security, incident response policies and procedures;
conducting periodic cybersecurity management and incident training for employees, including simulated phishing campaigns, which provide education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses; and
requiring employees, as well as third-parties who provide services on our behalf, to treat information and data with care.

We also maintain an enterprise-wide incident response plan designed to secure the enterprise, mitigate the impact of a cybersecurity incident, recover and restore normal business operations, prevent similar future incidents and comply with applicable regulatory obligations arising from an incident. Management, including our Executive Director, Corporate Information systems, collaborates with our information technology team and technical partners to review at least annually our enterprise-wide incident response plan. Periodically, we engage assessors, consultants, auditors and other third parties, including by conducting exercises with an external partner to stress test our data security systems and practice company-wide response tactics. Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers, and third-party risks are included within our enterprise risk management program. In the event of a suspected or actual cybersecurity event, we have partnered with a globally recognized digital forensics investigation firm and outside counsel to provide services and support on a real-time basis to analyze any breach and secure both our data and information systems.

Despite our security measures, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For a discussion of how any risks from cybersecurity threats could materially affect the Company, including our business strategy and results of operations, see “Risk Factors – A cyber security incident or data privacy issue could result in a loss of confidential data, give rise to remediation and other expenses, expose us to liability under HIPAA, consumer protection and privacy laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business,” which is incorporated by reference into this Item 1C.

In the three most recently completed fiscal years and as of the date of this Annual Report on Form 10-K, we have not experienced any material cybersecurity incidents. Additionally, we do not believe any previous cybersecurity incidents we may have experienced are reasonably likely to materially affect us. This includes cybersecurity incidents resulting in penalties and settlements, of which there were none.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. Our enterprise risk management system incorporates risks from cybersecurity threats alongside other risks to the Company. Our information technology team oversees and implements a range of tools and services designed to minimize the risk or impact of any breach or unauthorized disclosure of our confidential and sensitive data.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
The Audit Committee of our Board oversees our risk management process, which includes risks from cybersecurity threats. The Audit Committee receives reports from management at least semi-annually, and more frequently if necessary, with respect to risks from cybersecurity threats. The Audit Committee also reviews cybersecurity and data security risks and mitigation strategies, along with program assessments, planned improvements and the status of information technology initiatives. The entire Board receives annual training from outside experts concerning the current global cybersecurity threat landscape and corporate best practices for mitigating cybersecurity risks, as well as the Board’s legal, regulatory and fiduciary responsibilities from a cybersecurity standpoint. Additionally, the Board was engaged with management and outside experts throughout 2022, 2023 and 2024 in overseeing the development of the Company’s Enterprise Incident Response Plan. This plan is reviewed and updated on an annual basis.

Our Executive Director, Corporate Information Systems, along with our Chief Legal Officer, Information Technology management team, and Chief Operating Officer, oversees our approach to cybersecurity and is responsible for assessing and managing material risks associated with cybersecurity threats. Our Executive Director, Corporate Information Systems has over 20 years of experience in the life science industry, including a focus in the past four years on information technology management. Additionally, his academic background includes advanced degrees in the life sciences and he brings a strong track record of managing cyber incident responses and related activities. In this role, our Executive Director, Corporate Information Systems works closely with an internal team that includes resources with various cybersecurity certifications and leverages the support of our external information security firm, technology partners and an industry-leading intelligence platform. Our Executive Director manages and leads the internal Information Technology team to maintain, update and enhance the Company’s technology infrastructure and corresponding safety measures, as well as to ensure that appropriate safety measures are implemented to protect against evolving cybersecurity threats.

Our Executive Director, Corporate Information Systems is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy processes described above, including the operation of our Enterprise Incident Response Plan. Our
Chief Legal Officer works closely with him and reports regularly to the Board and to the Audit Committee of the Board, covering the risks from cybersecurity threats.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee of our Board oversees our risk management process, which includes risks from cybersecurity threats.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee of our Board oversees our risk management process, which includes risks from cybersecurity threats. The Audit Committee receives reports from management at least semi-annually, and more frequently if necessary, with respect to risks from cybersecurity threats. The Audit Committee also reviews cybersecurity and data security risks and mitigation strategies, along with program assessments, planned improvements and the status of information technology initiatives. The entire Board receives annual training from outside experts concerning the current global cybersecurity threat landscape and corporate best practices for mitigating cybersecurity risks, as well as the Board’s legal, regulatory and fiduciary responsibilities from a cybersecurity standpoint.
Cybersecurity Risk Role of Management [Text Block]
Our Executive Director, Corporate Information Systems, along with our Chief Legal Officer, Information Technology management team, and Chief Operating Officer, oversees our approach to cybersecurity and is responsible for assessing and managing material risks associated with cybersecurity threats. Our Executive Director, Corporate Information Systems has over 20 years of experience in the life science industry, including a focus in the past four years on information technology management. Additionally, his academic background includes advanced degrees in the life sciences and he brings a strong track record of managing cyber incident responses and related activities. In this role, our Executive Director, Corporate Information Systems works closely with an internal team that includes resources with various cybersecurity certifications and leverages the support of our external information security firm, technology partners and an industry-leading intelligence platform. Our Executive Director manages and leads the internal Information Technology team to maintain, update and enhance the Company’s technology infrastructure and corresponding safety measures, as well as to ensure that appropriate safety measures are implemented to protect against evolving cybersecurity threats.

Our Executive Director, Corporate Information Systems is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy processes described above, including the operation of our Enterprise Incident Response Plan. Our
Chief Legal Officer works closely with him and reports regularly to the Board and to the Audit Committee of the Board, covering the risks from cybersecurity threats.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our Executive Director, Corporate Information Systems, along with our Chief Legal Officer, Information Technology management team, and Chief Operating Officer, oversees our approach to cybersecurity and is responsible for assessing and managing material risks associated with cybersecurity threats.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our Executive Director, Corporate Information Systems has over 20 years of experience in the life science industry, including a focus in the past four years on information technology management. Additionally, his academic background includes advanced degrees in the life sciences and he brings a strong track record of managing cyber incident responses and related activities.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Our Chief Legal Officer works closely with him and reports regularly to the Board and to the Audit Committee of the Board, covering the risks from cybersecurity threats.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true