Company: VERA
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-029969
Chunk: 115

Company: Vera Therapeutics, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 115
---
-party partners to provide other products, services, parts, or otherwise to operate our business. Our ability to monitor these third parties’ cybersecurity practices is limited, and these third parties may not have adequate information security measures in place. If our third-party partners experience or have experienced a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party partners fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of our third-party partners). We may not, however, detect and remediate all such vulnerabilities including on a timely basis. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident.

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our 

86

sensitive information or our information technology systems, or those of the third-party partners. A security incident or other interruption could disrupt our ability (and that of our third-party partners (such as contract research organizations and clinical trial sites)) to provide our products or services. We may expend significant resources or modify our business activities (including our clinical trial activities) in an effort to protect against security incidents. Additionally, certain data privacy and security obligations may require us to implement and maintain specific security measures, industry-standard or reasonable security measures to protect our information technology systems and sensitive information. 

Applicable data privacy and security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators and investors, of security incidents. Such disclosures are costly, and the disclosures or the failure to comply with such requirements could lead to adverse consequences. Security incidents or perceived security incidents may result in material adverse consequences. These consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting