Company: DAWN
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000950170-25-026654
Chunk: 244

Company: Day One Biopharmaceuticals, Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1B
Chunk 244
---
None.

Item 1C. Cybersecurity.The Company’s board of directors, or the Board, recognizes the critical importance of maintaining the trust and confidence of our patients, investors, business partners and employees. The Board is actively involved in oversight of the Company’s risk management program, and cybersecurity represents an important component of the Company’s overall approach to risk management. The Company’s cybersecurity policies, standards, processes and practices are fully integrated into the Company’s risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, mitigating and remediating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

105

Risk Management and StrategyAs one of the critical elements of the Company’s overall risk management approach, the Company’s cybersecurity program is focused on the following key areas:Governance: As discussed in more detail under the heading “Governance,” the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, or the Audit Committee, which regularly interacts with the Company’s Head of Information Technology and other members of management, including members of management’s Data Privacy and Security Committee.Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and processes that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.Information Security: We implement organizational, administrative and technical measures based on commercially reasonable procedures using (i) industry standard information security measures prescribed for use by National Institute of Standards and Technology, (ii) security measures aligned with the ISO/IEC 27000 series of standards, (iii) the Sarbanes-Oxley Act and SSAE 18/ISAE 3402, (iv) privacy regulations such as the European Union’s General Data Protection Regulation and the California Consumer Privacy Act, (v) business continuity management measures aligned with the ISO/IEC 22301 standard and (vi) other generally recognized industry standards, in each case, designed to safeguard the confidentiality, integrity, and availability of our infrastructure and data and the resiliency of our operations.Technical Safeguards: The Company deploys technical