Company: KROS
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001664710-25-000018
Chunk: 294

Company: Keros Therapeutics, Inc.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 294
---
 have required us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information.

The costs to respond to a security incident and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service, negative publicity, and other harm to our business and our competitive position. Any security incident affecting us, our current and future CROs, collaborators, contractors, consultants or other partners or our industry, whether real or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures and lead to regulatory scrutiny. Likewise, we use third parties for the manufacture of our product candidates and to conduct clinical trials, and similar events relating to their computer systems could also have a material adverse effect on our business. To the extent that any disruption or security incident were to result in a loss of, or damage to, our data or applications, or inappropriate disclosure of confidential or proprietary information, we could face governmental reporting obligations, fines, incur liability and the further development and commercialization of our product candidates could be delayed.

If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. Additionally, our sensitive information could be leaked, disclosed, or revealed as a result of or in connection with our employee’s, personnel’s, or vendor’s use of generative AI technologies, resulting in adverse consequences. In each case, these consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; 

82

restrictions on processing sensitive information (including personal data); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may prevent or cause individuals to stop conducting business with us or negatively impact our ability to grow and operate our business. For example, the loss of preclinical or clinical data could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions