SANGAMO THERAPEUTICS, INC 10-K Cybersecurity GRC - 2024-03-13

Page last updated on July 16, 2024

SANGAMO THERAPEUTICS, INC reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-03-13 07:47:35 EDT.

Filings

10-K filed on 2024-03-13

SANGAMO THERAPEUTICS, INC filed a 10-K at 2024-03-13 07:47:35 EDT
Accession Number: 0001628280-24-010788

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C - CYBERSECURITY Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature (“Information Systems and Data”). Our cybersecurity risk management program includes a risk assessment methodology designed to escalate cybersecurity risks to the appropriate channels within our organization in order to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment. The information technology and legal departments help identify, assess and manage Sangamo’s cybersecurity threats and risks. The information technology department, in coordination with the legal department, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and Sangamo’s risk profile using various methods including, for example, evaluating threats reported to us, conducting audits, performing threat assessments, and conducting vulnerability assessments to identify vulnerabilities. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan that includes procedures for responding to cybersecurity incidents and escalating cybersecurity incidents to cross-functional teams, management and our board of directors, business continuity plans, encryption of data, network security controls, systems monitoring, employee training, and cybersecurity insurance. Our assessment and management of material risks from cybersecurity threats are integrated into our risk management protocols. Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, including the involvement of cross-functional teams and, depending on the nature and severity of an incident, an escalation path to notify our executive and senior management teams and our board of directors. For example, the information technology department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms, including legal counsel, cybersecurity software providers and managed cybersecurity service providers. We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors included in Part I, Item 1A. “Risk Factors” of this Annual Report on Form 10-K, including “Risk Factors- If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm and other adverse consequences.” Governance Our board of directors addresses Sangamo’s cybersecurity risk management as part of its general oversight function. The board of directors’ audit committee is responsible for overseeing Company’s cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President, Information Technology, who has over 20 years of technology experience which includes extensive cybersecurity implementation and oversight. Our Vice President, Information Technology, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Vice President, Information Technology is responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our Chief Financial Officer is responsible for approving budgets related to the foregoing. Our cybersecurity incident response and vulnerability management protocol is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the executive leadership team. The executive leadership team works with the incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management protocol includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents. The Audit Committee of our Board of Directors receives periodic reports from the Vice President, Information Technology, concerning the Sangamo’s significant cybersecurity threats and risk and the processes we have implemented to address them. The Board of Directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

Company Information