Company: PRME
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001628280-25-008884
Chunk: 187

Company: Prime Medicine, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 187
---
 could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. 

Controls employed by our information technology department and other third parties could prove inadequate, and our ability to monitor such third parties’ data security practices is limited. Due to applicable laws, rules, regulations and standards or contractual obligations, we may be held responsible for any information security compromise or failure or cybersecurity attack attributed to our third-party vendors as they relate to infrastructure they support or the information we share with them.

If we were to experience a cybersecurity compromise or breach or other security incident relating to our information systems or data, the costs, time and effort associated with the investigation, remediation and potential notification of the breach to counterparties, regulators and data subjects could be material. We may incur significant costs in an effort to detect and prevent security incidents, and we may face increased costs and requirements to expend substantial resources in the event of an actual or perceived security incident. In addition, techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently, become more complex over time and generally are not recognized until launched against a target. As a result, we and our third-party vendors may be unable to anticipate these techniques or implement adequate preventative measures quickly enough to prevent either an electronic intrusion into our systems or services or a compromise of critical information. Further, our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts will be sufficient to protect us from liabilities, damages, or claims related to our privacy and data security obligations. We cannot guarantee that we will be able to detect or prevent any such incidents, and our remediation efforts may not be successful or timely. Our efforts to improve security and protect systems and data from compromise may also identify previously undiscovered instances of data breaches or other cybersecurity incidents. If we do not allocate and effectively manage the resources necessary to build and sustain the proper technology and cybersecurity infrastructure, we could suffer significant business disruption, including transaction errors, supply chain or manufacturing interruptions, processing inefficiencies, data loss or the loss of or damage to intellectual property or other proprietary, personal or confidential information. Additionally, while we currently maintain cybersecurity insurance, coverage may not be sufficient to cover actual losses, or may not apply to the circumstances relating to any particular loss.

To the extent that any disruption, compromise or security breach were to result in a loss of, or damage to, our or our third-party vendors’, collaborators’,