Xencor Inc 10-K Cybersecurity GRC - 2024-02-28

Page last updated on July 16, 2024

Xencor Inc reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-02-28 21:16:39 EST.

Filings

10-K filed on 2024-02-28

Xencor Inc filed a 10-K at 2024-02-28 21:16:39 EST
Accession Number: 0001326732-24-000006

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity The Company’s Board of Directors, in coordination with the Audit Committee of the Board of Directors (the Audit Committee), is responsible for overseeing the Company’s risk management and information technology programs of which cybersecurity is a critical element. Management is responsible for the administration of the Company’s cybersecurity policies, standards, procedures and practices. The Company’s cybersecurity policies, standards, procedures, and practices are based on the Center for Internet Security (CIS) Critical Security Controls, a framework for companies to establish and evaluate cybersecurity policies, procedures and practices. The Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company’s information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they arise. Cybersecurity Risk Management and Strategy The Company’s cybersecurity risk management strategy focuses on several issues: Identification and Reporting: The Company has implemented a comprehensive approach to assessing, identifying and managing material cybersecurity threats and incidents. The Company’s program includes controls and procedures to timely identify, classify and escalate certain cybersecurity incidents to provide management visibility and allow for direction from management as to the public disclosure and reporting of material incidents in a timely manner. Technical Safeguards: The Company implements current information technologies to support its cybersecurity practices. These technologies are designed to protect the Company’s information systems from cybersecurity threats and include: email and internet protection, firewall and network security, intrusion detection and prevention systems, anti-malware endpoint detection and response, security event monitoring and alerting, high availability and replication, system configuration and asset management , backup and restoration processes, vulnerability and patch management, identity and access management and data encryption. These technologies and controls are continuously evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as audits by third party specialists and certifications. Incident Response and Recovery Planning: The Company has established and maintains a comprehensive incident response plan, designed to address the Company’s response to a cybersecurity incident. Cross-functional members of the Company comprise the Incident response team to respond and disclose material incidents. The incident response plan 48 defines pre-incident activities and preparation, classification of incidents, response team internal and external contacts, process flow of the response team, escalation of incidents to outside entities and law enforcement and frequency of review of the incident response plan. The Company conducts regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, contractors, consultants and other external users of the Company’s systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on the Company’s cybersecurity systems. Third parties are regularly assessed to determine the need for cybersecurity auditing based on risk evaluation. Education and Awareness: The Company provides regular, mandatory training and assessment for all levels of employees regarding cybersecurity threats as a means to equip the Company’s employees with effective tools to address cybersecurity threats, and to communicate the Company’s evolving information security policies, standards, processes, and practices. The Company conducts periodic assessment and testing of the Company’s policies, standards, processes, and practices including audits by independent third party specialists in a manner intended to address cybersecurity threats and events. Policies are reviewed and revised on a frequent basis for relevance and to maintain compliance. The results of such assessments, audits, and reviews are evaluated by management and reported to the Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews. Governance The Board, in coordination with the Audit Committee, oversees the Company’s risk management and information technology programs, including the management of cybersecurity threats. The Audit Committee receives regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by the Company’s peers and third parties. The Audit Committee also receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Audit Committee discusses the Company’s approach to overseeing cybersecurity threats with the Company’s head of Information Technology and other members of senior management. The head of IT, in coordination with senior management, including the CFO, works collaboratively across the Company to implement a program designed to protect the Company’s information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company’s incident response and recovery plans. To facilitate the success of the Company’s cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the head of IT and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate. Material Affects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

Company Information