Company: SRPT
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-029973
Chunk: 0

Company: Sarepta Therapeutics, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1B
Chunk 0
---
-67-

None.

Item 1C. CybersecurityProgram DetailsOur information security program is developed using industry standards and best practices as a guide, including the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework. The program includes regular internal evaluations, including annual penetration tests and monthly vulnerability scans, as well as evaluations by external vendor partners in support of our operations model. The results of these evaluations are regularly shared with senior management and the Audit Committee of the Board of Directors (the “Audit Committee”), where appropriate.We have developed and implemented a cybersecurity risk management program intended to protect the Confidentiality, Integrity, and Availability (“CIA”) of our critical systems and information. Our cybersecurity risk management program is integrated into our overall enterprise risk management processes and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: •A layered defense approach with controls deployed that seek to meet the requirements of the NIST Cybersecurity Framework.•Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. •A security team principally responsible for managing (a) our cybersecurity risk assessment processes, (b) our security controls, and (c) our response to cybersecurity incidents. •The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls as part of our operational security model. •A threat intelligence function that informs our cybersecurity and IT personnel about new vulnerabilities and risks that require timely intervention or remediation. •Cybersecurity awareness training of our employees, incident response personnel, and senior management. •A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents. •A third-party risk management process for service providers, suppliers, and vendors.   As of the date of this Annual Report, we have not experienced any material cybersecurity incidents, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents.OversightThe Audit Committee oversees our information technology systems and related cybersecurity program. Our cybersecurity program is managed by our dedicated Chief Information Security Officer (the “CISO”), reporting directly to the Company’s Chief Information Officer (the “CIO”), whose team is responsible for leading the Company’s cybersecurity policies and procedures. Our CIO has over 25 years of experience and has served in a variety of information systems leadership roles in the life sciences industry supporting