PTC THERAPEUTICS, INC. 10-K Cybersecurity GRC - 2025-02-27

Page last updated on February 27, 2025

PTC THERAPEUTICS, INC. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2025-02-27 16:32:17 EST.

Filings

10-K filed on 2025-02-27

PTC THERAPEUTICS, INC. filed a 10-K at 2025-02-27 16:32:17 EST
Accession Number: 0001070081-25-000012

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity Cybersecurity Risk Management and Strategy As is the case for most companies, we are regularly subject to cyber-attacks and other cyber incidents and, therefore, cybersecurity is an important element of our overall enterprise risk management program. As part of our ordinary course of business, we collect, store and transmit large amounts of confidential information, including personal information, operational and financial transactions and records, clinical trial data and information relating to intellectual property, on internal information systems and through the information systems of collaborators and third-party vendors with whom we contract. We have a multilayered approach for assessing, identifying and managing cybersecurity risks, that is designed to help protect such information from internal and external cyber threats by understanding and seeking to mitigate risk while ensuring business resiliency. Our cybersecurity prevention methods include implementing the National Institute of Standards and Technology cybersecurity framework , instituting a training and compliance program on cybersecurity for all employees, completing a yearly external audit and penetration test, conducting vulnerability scans and remediations and monitoring threat intelligence feeds. As part of our overall risk management strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches. We also conduct security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This process involves third-party providers responding to cybersecurity questionnaires and information technology, or IT, security team meetings to review and assess the third-party providers security posture to confirm that the provider is ensuring the security, integrity, and availability of processed data. We have also established a global incident response management standard operating procedure, or GIRM. Our GIRM provides step-by-step instructions for managing any global incident which is disruptive of or interferes with the delivery and operation of our IT services and systems that are in use. Specifically, our GIRM provides direction as to how information with respect to a cybersecurity incident is communicated internally, including with our executive committee leadership team. As regulatory disclosure requirements regarding cybersecurity incidents and data privacy matters have become more prevalent, we have developed an incident workflow designed to monitor and evaluate if such disclosure requirements are triggered by an incident through the inclusion of members of our legal, data privacy and executive teams in the incident response process. We engage third parties, including independent privacy assessors, computer security firms and risk management and governance experts to enhance our cybersecurity oversight. For example, on an annual basis we run a penetration test of our systems, performed by a different external third party each year. We also regularly consult with these third parties on emerging industry trends. Based on an assessment using the previously described enterprise risk management program, we do not believe that there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have material affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial conditions. See " Our business and operations would suffer in the event of computer system failures, cyber-attacks or a deficiency in our, or our collaborators’ or third-party vendors’, cyber-security" in Part I, Item 1A. “Risk Factors” for additional information. Cybersecurity Governance and Oversight Our Board of Directors administers its cybersecurity risk oversight function primarily through the Audit Committee of the Board of Directors. In accordance with our Audit Committee Charter, our Chief Information Officer, or CIO, provides periodic updates to our Audit Committee regarding the Company’s cybersecurity and other technology risks, internal controls and procedures, including the Company’s plan to mitigate cybersecurity risk and respond to data breaches. The Audit Committee is also responsible for reviewing any related periodic public filing disclosures. The Board of Directors receives regular reports from the Audit Committee. Our CIO also presents directly to our Board of Directors on an annual basis on these matters. Our IT team is responsible for maintaining daily operations and ensuring the confidentiality, integrity and availability of data. Our CIO oversees a cybersecurity team that has over 15 years’ experience in cybersecurity along with advanced and undergrad degrees in cybersecurity, and industry recognized security certifications such as CISSP (Certified Information Systems Security Professional) and CISM (Certified Information Security Manager). Our CIO reports directly to our Chief Legal Officer, both of whom are members of our executive committee leadership team. Cybersecurity incident status updates are provided as necessary to the executive committee as set forth in our GIRM. In the event of a cybersecurity incident, our IT team is trained to follow our GIRM. In an effort to deter and detect cyber threats, we periodically provide all employees, including part-time and temporary employees, with data protection, cybersecurity and incident response and prevention training as part of our overall IT compliance program, which covers timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security. This training functions to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. For more information regarding the risks associated our cybersecurity program, see Item 1A. Risk Factors, “Our business and operations would suffer in the event of computer system failures, cyber-attacks or a deficiency in our, or our collaborators’ or third-party vendors’, cyber-security.”

Company Information