Company: TEM
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000950170-25-025603
Chunk: 492

Company: Tempus AI, Inc.
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1B
Chunk 492
---
None.

Item 1C. Cybersecurity. Risk Management and StrategyOur business depends on our continued ability to collect and safeguard vast amounts of personal and sensitive business information, including, among other types of data, protected health information (PHI), employee information, credit card information, insurance information, proprietary and confidential information about our business, financial information, trade secrets, intellectual property, and the sensitive and confidential information from the third parties with whom we work. We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, and hardware and software, to safeguard and prevent unauthorized access to this critical data (collectively Information Systems and Data).Our Chief Technology Officer, or CTO, and our Chief Information Security Officer, or CISO, together with our Enterprise Risk Management Committee help identify, assess, and manage the Company’s cybersecurity threats and risks. Working with a cross-functional team, these individuals and our Enterprise Risk Management Committee identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry’s risk profile, evaluating threats reported to us, conducting internal and/or external audits, conducting vulnerability assessments to identify vulnerabilities, using external intelligence feeds, and third-party-conducted red/blue team testing and tabletop incident response exercises.Our Information Security program has six broad components: Controls & Compliance; Security Operations; Cloud Security; Identity and Access Management; Application Security; and Data Governance. Within each program component, and depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining a vulnerability management policy and disaster recovery/business continuity plans, risk assessments, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, a vendor risk management program, a dedicated cybersecurity staff/officer, active monitoring, detection, prevention, mitigation, and remediation strategies to ensure we are adequately safeguarding and protecting our critical information, routinely conducting audits, vulnerability scans, penetration tests, social engineering simulations, security awareness training, and threat intelligence assessments to ensure that our systems, policies, and procedures are operating as intended. We also engage with a range of external experts