Company: BLTE
Filing Date: 2025-03-17
Form Type: 20-F
Source: 0001410578-25-000356
Chunk: 10

Company: BELITE BIO, INC
Filing Date: 2025-03-17
Form: 20-F
Item: Item 16K
Chunk 10
---
ITEM 16K. Cybersecurity

Cybersecurity Risk Management, Strategy and Governance

Cybersecurity risk management is an integral part of our enterprise risk management framework.
We have adopted a cybersecurity incident response policy designed to protect the confidentiality, integrity, and availability of our critical systems and information.
Our
executive management
is principally responsible
for facilitating our enterprise risk management program, and work closely with our internal audit team,
external IT service provider
and legal counsel to prevent, detect, investigate, contain, escalate, and recover from identified vulnerabilities and security incidents.
In addition, once any cybersecurity incident is identified, our incident response team which consist of our Chief Financial Officer, Chief Compliance Officer and our IT service provider’s lead representative will be responsible for assessing, managing, responding to, documenting and reporting such cybersecurity incident to our Chief Executive Officer and/or our Board of Directors in accordance with the level of threat/impact of such incident, as set forth in the policy. We also maintain processes to oversee and identify risks from cybersecurity associated with our use of third-party service providers. Theseprocesses include comprehensive vendor evaluations prior to engagement, ongoing audits and testing to verify adherence to our security policies, and contractual provisions requiring vendors to meet our cybersecurity standards.

Table of Contents

Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to theAudit Committeeoversight of our cybersecurity and data protection program. Our Audit Committee receives updates from management
on our cybersecurity and data protection programs in the event of a cybersecurity incident, as well as whether any cybersecurity incident occurred since the prior report and any remedial actions taken by our Company. The full board also receives briefings from management on key components of our programs and any pressing risk or compliance matters.

The Company has engaged independent information technology and cybersecurity consultants to assist with the maintenance of its information systems. These consultants, with more than 10 years of experience advising companies of similar scope on information technology and cybersecurity risk management, report to the Chief Executive Officer, who in turn reports directly to the Board of Directors and the Audit Committee, which is the principal committee responsible for overseeing the Board’s risk management activities.

In 2024, we did not identify any cybersecurity threats that have materially affectedor are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see “ Risk