Company: NCNA
Filing Date: 2025-03-20
Form Type: 20-F
Source: 0000950170-25-042709
Chunk: 275

Company: NuCana plc
Filing Date: 2025-03-20
Form: 20-F
Item: Item 16J
Chunk 275
---
 risk management and strategy processes.
We also identify our cybersecurity threat risks by comparing our processes to standards set by the NCSC, as well as by engaging experts to attempt to infiltrate our information systems and conduct risk management assessments. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities:
•
monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;
•
through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;
•
employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including software operating system updates, anti-virus software, multifactor authentication, firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;
•
implement an incident notification and response process to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and

•
employ a software patch and vulnerability management program, including software updates, computer back-up processes, information technology support, and regular third-party vulnerability scans.
Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.
As part of the above processes, we regularly engage with consultants and other third parties, including regular third-party review of our cybersecurity program to help identify areas for continued focus, improvement and compliance.
Our processes to address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers who have access to patient and employee data or our systems, include requiring those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, including with respect to processing and transferring personal and patient data. We intend to conduct due diligence of third-party vendors and supplier cybersecurity protocols.
We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings “ Our proprietary information,