Company: RPID
Filing Date: 2025-08-12
Form Type: 10-Q
Source: 0001380106-25-000174
Chunk: 44

Company: RAPID MICRO BIOSYSTEMS, INC.
Filing Date: 2025-08-12
Form: 10-Q
Item: Part I, Item 2
Chunk 44
---
 customers and other parties. We manage and maintain our applications and data utilizing a combination of on-site systems and cloud-based data centers. We utilize external security and infrastructure vendors to manage parts of our data centers. These applications and data encompass a wide variety of business-critical information, including research and development information, customer information, commercial information and business and financial information. We, like all companies storing business-critical information, face a number of risks relative to protecting this critical information, including loss of access, inappropriate use or disclosure, unauthorized access or exfiltration, inappropriate modification, inappropriate destruction, and the risk of our being unable to adequately monitor and audit and modify our controls over our critical information. This risk extends to the third-party vendors and subcontractors we use to manage this sensitive data or otherwise process it on our behalf. The secure processing, storage, maintenance and transmission of this critical information are vital to our operations and business strategy, and we devote significant resources to protecting such information. Although we take measures to protect sensitive data from unauthorized access, use or disclosure, our information technology and infrastructure may still be vulnerable to, and we have in the past experienced and may continue to experience in the future, attacks by hackers or viruses or data breaches due to employee error, malfeasance or other malicious or inadvertent disruptions. Further, attacks upon information technology systems, including ransomware attacks and digital extortion, business email compromises, social engineering, including phishing attacks, denial of service attacks, computer malware, malicious codes, viruses, wrongful intrusions, wrongful conduct by insider employees or vendors, data breaches, and other malicious internet-based activity are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives, capabilities, and expertise. We may also face increased cybersecurity risks due to our reliance on internet technology and the number of our employees who are working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a victim entity, we may be unable to anticipate these techniques or implement adequate preventative measures. While we have measures in place to identify, detect and mitigate security threats and incidents, they are not failproof, so we may also experience security incidents that may remain undetected for an extended period. Any such incident could result in the compromise of our information systems, and the data stored there could be accessed, encrypted, corrupted,