Company: SUPN
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001356576-25-000017
Chunk: 107

Company: SUPERNUS PHARMACEUTICALS, INC.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 2
Chunk 107
---
ITEM 1C.     CYBERSECURITY.

Cybersecurity

Our business depends on information technology systems and networks, which we protect from cyber threats that could harm our data, operations, and reputation. We have invested in security measures designed to safeguard the data of our customers and employees, prevent, detect, and respond to cyberattacks, and comply with data privacy requirements.

Cybersecurity Governance

66

Table of ContentsITEM 1A. RISK FACTORS.

Our approach to cybersecurity begins with our responsibility for strong governance and controls. Security begins at the top of our organization, where Company leadership consistently communicates the requirements for vigilance and compliance throughout the organization, and then leads by example. We use a risk-based and layered approach to prevent, detect, and respond to cyberattacks, and leverage external partnerships for threat intelligence.Our management is responsible for risk identification, risk management and risk mitigation strategies associated to cybersecurity related information technology risks, including fully documenting our cybersecurity policies and procedures and cybersecurity risk management program as well as implementing a cybersecurity risk management program and ensuring compliance with our cybersecurity policies and procedures. Our Senior Vice President of Quality, GMP Operations, and Information Technology leads our Information Technology team, which includes experienced and information security professionals and has expertise in various aspects of cybersecurity, such as network security, data protection, incident response, threat intelligence, and security awareness. Our Information Technology Team’s expertise is supplemented by external consultants who provide specialized services and independent assessments of our cybersecurity posture and capabilities.Management has appointed a Cybersecurity Incident Response Team (the “CSIRT”) which is operationally responsible for coordinating, executing, and managing cybersecurity incident response activities. The CSIRT is comprised of experienced information security personnel from our Information Technology team. The CSIRT’s responsibilities include, among other things, incident identification and escalation to designated members of management. Among the designated members of management who are required to be notified are our Chief Executive Officer and our Chief Financial Officer.Our Board of Directors has appointed its Audit Committee as its primary body to oversee management’s risk identification, risk management and risk mitigation strategies related to cybersecurity related information technology risks. Members of our management who have responsibility for designing and implementing our risk management processes are required to meet periodically with the Audit Committee regarding our policies, processes, procedures and any significant development related to the identification, management and mitigation of cybersecurity risks. The Audit Committee’s primary oversight of management’s cybersecurity risk management efforts is supplemented by our full Board, which is required to receive, on an annual basis an update from management on any significant developments related to the