CHIMERIX INC 10-K Cybersecurity GRC - 2024-02-29

Page last updated on July 16, 2024

CHIMERIX INC reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-02-29 08:24:07 EST.

Filings

10-K filed on 2024-02-29

CHIMERIX INC filed a 10-K at 2024-02-29 08:24:07 EST
Accession Number: 0001117480-24-000005

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C. CYBERSECURITY Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to ongoing or previous clinical trials. (Information Systems and Data). Our CEO and CFO, along with our Legal, Quality Assurance (QA), and IT (Information Technology) departments help identify, assess and manage the Company’s cybersecurity threats and risks. The IT department works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating threats reported to us, internal and external audits, and utilizing trusted third parties to conduct vulnerability assessments to identify vulnerabilities. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, our incident response policy, incident detection and response procedures, encryption of certain data, network security controls, and data segregation across certain of our environments, access controls, physical security, systems monitoring, employee cybersecurity training, penetration testing conducted by third-parties, and maintaining cybersecurity insurance. Our assessment and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management processes. For example, the IT department works with management to prioritize our risk management processes and to mitigate cybersecurity threats that are more likely to lead to a material impact to our business. We use third-party service providers to assist us in identifying, assessing, and managing certain material risks from cybersecurity threats, including for example, data protection and privacy compliance professional service providers, external legal counsel, cybersecurity software providers, penetration testing firms, and managed cybersecurity service providers. We use third-party service providers to perform a variety of functions throughout our business, such as application providers, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We have a vendor qualification and management program designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For example, we may conduct vendor qualification audits that assess a potential third party’s cybersecurity risk potential. We may conduct a vendor risk assessment that evaluates the likelihood and potential impact of a cybersecurity threat involving the third-party service provider, based on factors such as the type and scope of services, the data processed, and the third-party service provider’s security practices. We may request security attestations and certifications to verify that the vendor has met the relevant industry standards and best practices for cybersecurity. We may establish security clauses in our agreements with third-party service providers that address such matters as the roles, responsibilities, and expectations of both parties regarding cybersecurity, such as the security policies and procedures, the incident response and notification expectations, the remediation measures to be adopted, the responsibility for losses associated with incidents. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the “Risks Related to Information Technology.” The Company has not experienced a cybersecurity threat that has materially affected the company. 51 Governance Our board of directors addresses the Company’s cybersecurity risk management as part of its general oversight function. The Board of Directors’ Audit Committee is responsible for overseeing Company’s cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director of Information Technology and Senior Manager of Information Technology. Combined they have more than 35 years of experience in IT and cybersecurity. They hold many industry certifications in areas including Risk Management, Cybersecurity, Digital Forensics, Networking, and Enterprise Architecture. Their previous positions include work in Security Operations Centers and cybersecurity consulting for Fortune 500 companies and critical infrastructure providers. The Information Technology and Legal departments are responsible for helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy and communicating key priorities to relevant personnel. The Senior Director of Information Technology, Senior Manager of Information Technology, and Assistant General Counsel are also responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Legal, the CFO, the CEO, and the IT department. Chimerix follows the cybersecurity incident response policy to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company’s incident response policy includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents. The Audit Committee of the Board of Directors receives quarterly reports from the Senior Director of IT concerning the Company’s significant cybersecurity threats and risk and the processes the Company has implemented (or plans to implement) to address them. The Audit Committee of the Board of Directors also may request various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

Company Information