Company: ACHV
Filing Date: 2025-03-11
Form Type: 10-K
Source: 0000950170-25-036831
Chunk: 104

Company: ACHIEVE LIFE SCIENCES, INC.
Filing Date: 2025-03-11
Form: 10-K
Item: Item 1C
Chunk 104
---
Cybersecurity Risk Management and StrategyOur process for managing cybersecurity risk is comprised of technologies, controls, and procedures designed to detect, assess, and manage threats and control access. We utilize a variety of systems, software, and services including firewalls, network and endpoint monitoring, anti-malware, detection and response, patch management, and backups to mitigate, identify, analyze, and respond to identified vulnerabilities and incidents in a timely manner.We evaluate our security posture on an ongoing basis via vulnerability scans, penetration testing, and threat intelligence monitoring. We periodically conduct third-party security assessments and regularly evaluate our processes against industry standard security frameworks. We conduct regular security training to elevate awareness and foster a security conscious culture among all employees.We leverage third party service providers and solutions in many aspects of our operations. Our vendor management and oversight procedures include assessment of cyber security risk.We do not believe there are any currently known cybersecurity risks that are reasonably likely to materially impact our business strategy, operations, or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding cybersecurity risks that we face and the related potential impacts on our business, see the risk factor titled “Our internal computer systems, or those of our third-party collaborators or other service providers, may fail or suffer security breaches and cyber-attacks, which could result in a material disruption of our development programs.”Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of increasing focus for our board of directors, or Board, and management.The Audit Committee of our Board, or Audit Committee, is responsible for the oversight of risks from cybersecurity threats. At least annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Audit Committee are also encouraged to regularly engage in 

52

ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Potential material cybersecurity threat risks are also considered during Board meeting discussions of important matters like risk management, business continuity planning, and other relevant matters. Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management