Company: CRNX
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-029050
Chunk: 231

Company: Crinetics Pharmaceuticals, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1B
Chunk 231
---
 a regular basis.•Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company’s technology, operations, legal, and other key business functions, third party vendors, as well as the members of the Board through the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.•Governance: The Board’s oversight of cybersecurity risk management is supported by the Audit Committee, the Company’s Vice President, Information Technology, other members of management and relevant management committees and councils.A key part of the Company’s strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company’s processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and to the Board through the Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews. GovernanceThe Board, through the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company’s management implements to address risks from cybersecurity threats. The Audit Committee receives periodic presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company’s peers and third parties. The Audit Committee would also receive prompt and timely information regarding any cybersecurity incident that would meet the applicable established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least twice each year, the Audit Committee discusses the Company’s approach to cybersecurity risk management with the Company’s Chief Operating Officer.

69

The Company’s Chief Operating Officer is the member of the Company’s executive management that is principally responsible for overseeing the Company’s cybersecurity risk management program, in partnership with other business leaders across the Company. The Company’s Chief Operating Officer has served in various roles in research and development, operations, portfolio management