Company: SUPN
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001356576-25-000017
Chunk: 1

Company: SUPERNUS PHARMACEUTICALS, INC.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 1
---
 identification, management and mitigation of cybersecurity risks.

Cybersecurity Risk Identification and ManagementAs part of management’s initiative to enhance our information security program, during 2024 our program underwent an internal audit, which was supported by an international firm experienced in auditing such programs. The results of the audit are being used by management to supplement previously planned enhancements. Management, with the assistance of third-party experts, is developing and implementing governance-related enhancements to its cybersecurity risk management program. A significant aspect of that process involves fully documenting policies, standards and procedures and developing others, including personnel training requirements, threat monitoring, detection, and containment standards, risk assessment processes, standards for third-party penetration testing, and standards for third-party vendor security requirements. Management expects that the program will continue to adapt and incorporate new techniques and procedures in an effort to combat evolving and novel cybersecurity threats.Our current cybersecurity risk management program includes the following key elements:•Cybersecurity risk mitigation: We utilize various measures, tools and controls to prevent, detect, and mitigate cyberattacks, such as firewalls, antivirus software, encryption, authentication, backup, and recovery. We also adopt a defense-in-depth approach that layers multiple security mechanisms across our information systems and networks, such as perimeter, endpoint, application, and data security. We monitor and test our security measures and controls, and we update and enhance them as needed to address new and emerging cyber threats and vulnerabilities.We also rely on specialized services or tools from third-party vendors and software companies including network monitoring, threat, incident and breach identification and data security and backup services. For third-party service providers whose software or personnel have access to our systems, we review their security audit reports prior to the commencement of their services.•Cybersecurity risk response: The Company’s Executive Management, which is led by our CEO and includes leaders from across the Company’s departments, is responsible for providing the necessary resources, support, and authority for the CSIRT to carry out their responsibilities effectively. Our Executive Management team is accountable for making critical decisions in response to an incident. The CSIRT is operationally responsible for coordinating, executing, and managing incident response activities. Both our Executive Management team and CSIRT receive regular training on information security topics. 

67

Table of ContentsITEM 1A. RISK FACTORS.

•Cybersecurity education and training: We provide regular and mandatory cybersecurity education and training to our employees, contractors, and other authorized users of our information systems and networks, to raise their awareness and understanding of cyber risks and their responsibilities for protecting our information systems