Company: ARWR
Filing Date: 2025-11-25
Form Type: 10-K
Source: 0000879407-25-000029
Chunk: 131

Company: ARROWHEAD PHARMACEUTICALS, INC.
Filing Date: 2025-11-25
Form: 10-K
Item: Item 1C
Chunk 131
---
ITEM 1C.           CYBERSECURITY

The Company maintains a cybersecurity program, with direct oversight from senior management and the Audit Committee (the “Audit Committee”) of the Board of Directors (the “Board”), to manage information, data, and technology security. The cybersecurity program is informed in part by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and is designed to help identify, assess, and manage cybersecurity risks relevant to the Company’s business. The Company’s cybersecurity program has been developed in light of the nature of the Company’s business, resource availability, requirements from stakeholders, and industry trends. The Company has formed an internal cross-functional Technology Risk Management Committee comprised of representative leaders from various aspects of the Company’s business to broadly implement its cybersecurity program.The Company’s cybersecurity program prioritizes vulnerability management, risk reduction, detection, and prevention to help protect against material risks from cybersecurity threats to its information systems. The Company periodically conducts internal and third-party cybersecurity risk assessments and penetration tests and incorporates relevant findings and recommendations into its overall cybersecurity strategy, as appropriate. Through these assessments, the Company develops targeted strategies intended to address the most significant cybersecurity risks.The Company’s cybersecurity program emphasizes defense, rapid detection, and remediation of cybersecurity threats and incidents, including the use of various security tools and systems based on defense-in-depth and zero-trust principles that are intended to meet control requirements. The cybersecurity program also encompasses crisis incident response guidelines that detail the processes for the detection, response, mitigation, and remediation of cybersecurity incidents, in order to support the effective management of, response to, communication during, and recovery from any such incidents.A key element of the Company’s strategy is fostering training and awareness through annual cybersecurity training and role-based phishing tests for employees and certain third parties having access to the Company’s information systems. The Company also utilizes a third-party cybersecurity operations monitoring center to help identify threats and incidents to the Company’s servers and computers. The Company’s cybersecurity program includes specific requirements and guidelines for the information security team relating to the Company's computer emergency response preparedness, intrusion response preparedness, and incident response preparedness.When a potential cybersecurity threat or incident is identified, our processes require that the Senior Director of Information Security be promptly notified of the incident, who then is to conduct an initial investigation to determine the probability and potential of the threat or incident to have a material impact on key business systems and processes. If there is a reasonable possibility for a material impact to the Company’s business or information systems, the cybersecurity program requires that the