Company: BOLT
Filing Date: 2025-03-24
Form Type: 10-K
Source: 0000950170-25-043873
Chunk: 127

Company: Bolt Biotherapeutics, Inc.
Filing Date: 2025-03-24
Form: 10-K
Item: Item 1B
Chunk 127
---
, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We have a vendor management program designed to manage cybersecurity risks associated with our use of certain of these providers.  The program includes a risk assessment for certain vendors that host our Information Systems and Data.  For vendors who host our critical data, we have processes designed to assess the vendor’s ability to support business continuity and disaster recovery. Where appropriate, we conduct security questionnaires and a review of vendors’ security.  This review may include reviewing program documentation, security reports and audits, conducting security assessment calls with the vendor's security personnel, and imposing information security-related contractual obligations on the vendor. We also request data privacy assessments from certain vendors as appropriate. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see the risk factor in Part 1. Item 1A, including the risk factor entitled “Our internal computer systems, or those used by our CROs or other contractors or consultants, may fail or experience security breaches or other unauthorized or improper access.” Governance Our board of directors addresses the Company’s cybersecurity risk management as part of its general oversight function. The board of directors’ audit committee is responsible for overseeing Company’s cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of IT Operations and Security and Principal Accounting Officer.Our Director of IT Operations and Security is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy, reviewing security assessments and other security-related reports, and communicating key priorities to relevant personnel. For example, our Director of IT Operations and Security holds a Master of Science in information security and assurance, holds relevant certifications such as Certified Ethical Hacker, Computer Hacking Forensics Investigator, Security+ and Network+, and has worked for approximately nine years in the field of cybersecurity. Our Principal Accounting Officer is responsible for helping prepare budgets, helping prepare for cybersecurity incidents, and approving certain cybersecurity processes.Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Principal Accounting Officer. Our Principal Accounting Officer receives regular reports on the status of our cybersecurity