Company: CRNX
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-029050
Chunk: 230

Company: Crinetics Pharmaceuticals, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1B
Chunk 230
---
None.

Item 1C. CybersecurityCybersecurity represents a critical component of the Company’s overall approach to risk management. The Company’s cybersecurity policies, standards and practices follow recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the specific 

68

goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company’s intellectual property; (iv) maintaining the confidence of our patients, collaborators, health care providers, and prospective and future customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.Risk Management and StrategyConsistent with overall policies and practices, the Company’s cybersecurity program focuses on the following areas:•Vigilance: The Company conducts global clinical trials. As a consequence, we have global cybersecurity threat operations function 24/7, with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans.•Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company’s information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence.•Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks.•Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company’s systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.•Training: The Company provides periodic mandatory training for personnel regarding cybersecurity threats, which reinforces the Company’s information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel.•Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company’s response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on