XBiotech Inc. 10-K Cybersecurity GRC - 2025-03-18

Page last updated on March 19, 2025

XBiotech Inc. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2025-03-18 15:36:45 EDT.

Filings

10-K filed on 2025-03-18

XBiotech Inc. filed a 10-K at 2025-03-18 15:36:45 EDT
Accession Number: 0001171843-25-001527

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C. CYBERSECURITY We employ processes and tools for assessing, identifying, and managing material risks from cybersecurity threats. These processes and tools are intended to help protect our information assets from internal and external threats and protect the integrity and confidentiality of our data. Our processes and tools include procedural and technical safeguards, response plans, and reviews of our policies. We employ experienced information technology personnel to deploy and oversee these safeguards and to consult with members of our senior management team, including our Chief Executive Officer and our Principal Financial Officer and Principal Accounting Officer, regarding cybersecurity matters when appropriate. Our Audit Committee is provided an opportunity during each quarterly meeting to inquire regarding material cybersecurity threats, deficiencies, and other issues in discussion with members of management. We provide all employees and consultants with cybersecurity and prevention training. Although we develop and maintain processes and tools designed to prevent cybersecurity threats from occurring, and to identify and mitigate threats, the possibility of these events occurring cannot be eliminated entirely. As we engage in more electronic transactions, rely more on cloud-based information systems, and utilize outside vendors or service providers that have access to our electronic information, the related security risks will increase, and we will likely need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our information technology systems will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational harm. As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including because of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. 32

Company Information