Company: DVAX
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001029142-25-000049
Chunk: 115

Company: DYNAVAX TECHNOLOGIES CORP
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 115
---
 example, (1) cybersecurity risk is evaluated as a component of our broader enterprise risk management program, identified in our risk register and monitored and managed more specifically by our Corporate Security Incident Response Team (CSIRT); (2) the security function works with the CSIRT to help prioritize our risk management processes and help mitigate cybersecurity threats that we believe are more likely to lead to a possible material impact to our business; (3) our ISO evaluates material risks identified from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors (the "Audit Committee"), which reviews and discusses with senior management our overall risk assessment and management. We use third-party managed service providers to assist us in identifying, assessing, mitigating and managing potential risks from cybersecurity threats. In addition, we engage other advisors from time to time to help identify, assess, mitigate and manage new or developing risks in a changing threat landscape. Such ongoing services and periodic services include professional services from providers such as legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring services, and forensic investigators (as needed). We use third-party service providers to perform a variety of functions throughout our business, such as application service providers, software-as-a-service providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and other supply chain resources. We have a vendor risk management program to help manage cybersecurity risks associated with our use of these providers. This includes risk assessment for each vendor, review of security assessments, supplemental security questionnaires (as needed), security assessment calls with the vendor's security personnel, and imposition of certain information contractual obligations on the vendor. In addition, depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor risk management program may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.  For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including “If our information technology systems or those of third parties upon which we rely, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational