Company: ARWR
Filing Date: 2025-11-25
Form Type: 10-K
Source: 0000879407-25-000029
Chunk: 132

Company: ARROWHEAD PHARMACEUTICALS, INC.
Filing Date: 2025-11-25
Form: 10-K
Item: Item 1C
Chunk 132
---
 Technology Risk Management Committee be promptly notified, which then assigns a risk level to the threat or incident. All threats and incidents identified as high-risk are promptly escalated to Company leadership and the legal department, who, in collaboration with the Company's Information Security department, are tasked with activating and implementing a high-risk information security incident mitigation and response plan, which details the roles, responsibilities, and strategies to respond. Our cybersecurity program also requires that high-risk cybersecurity incidents or threats be reported to the Company’s Materiality Committee and the Audit Committee within 24 hours of their designation as high-risk by the Technology Risk Management Committee.

59

Cybersecurity risks are incorporated into our overall risk management program. If a cybersecurity risk is identified as high-risk, a response and mitigation plan is developed, and progress updates on the plan are routinely reported to the Technology Risk Management Committee and tracked by the Audit Committee as part of our overall risk management process.

The Company is not aware of any cybersecurity threats or incidents in the last fiscal year, including as a result of any prior cybersecurity incidents, that have had a material impact on the Company, including its business strategy, operations, or financial condition. However, we face certain ongoing cybersecurity risks and threats that, if realized, are reasonably likely to materially affect us.  Additional information on cybersecurity risks we face is discussed in Part I, Item 1A “Risk Factors,” under the heading “Our business and operations could suffer in the event of a cybersecurity incident or other information technology system failures.” 

Execution of the Company’s cybersecurity program is delegated by the Board to the Senior Director of Information Security, who has over 25 years of relevant experience in information security, including 14 years at the Company, and is further supported by a team of security professionals within the Information Systems & Informatics department. The Senior Director of Information Security reports to the Vice President, Treasury & Head of Information Systems, and they meet periodically with senior leadership and the Audit Committee to review metrics on cybersecurity preparedness, incidents, mitigations and remediation efforts. The Company has also established a management-level Technology Risk Management Committee, which includes leaders from finance, legal, operations, quality & compliance, and information systems & informatics, who are responsible for overseeing the execution of high-risk incident response and mitigation plans. This committee actively reviews technology strategies, physical and cybersecurity threat assessment, and emerging issues and related initiatives. It is also responsible for evaluating the materiality of information for SEC filings and, as required or as otherwise appropriate, coordinates with the Company’s Materiality Committee to