Company: ZLAB
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001628280-25-008409
Chunk: 214

Company: Zai Lab Ltd
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 214
---
 appropriate. Members of our information security team, which includes personnel in the United States and China, collectively have decades of experience with information technology and cybersecurity systems, implementation, and oversight in the jurisdictions in which we operate. Under our incident response plan and our related information security policies and procedures, our information security personnel are responsible for promptly notifying senior management, including leaders in our legal and compliance departments, about any new cybersecurity incident or threat that may require management evaluation or response.

Our Audit Committee assists our Board in overseeing cybersecurity risk management and the integrity of our information technology systems, processes, and data. Periodically, the Audit Committee reviews and discusses with management, our internal auditor, and, in its discretion, third party vendors or other external experts, the adequacy of 

-74-

security for our information technology systems, processes, and data; our incident response and contingency plans in the event of a breakdown or security breach affecting the security of our information technology systems or data or the information technology systems, processes, and data of our clients; and any new threats or incidents that have or may impact us. The Audit Committee receives reports on the operation of such programs from the Chief Operating Officer, Chief Legal Officer, and/or the IT Department, as appropriate. The Audit Committee also reviews management reports regarding the evolving threat environment, vulnerability assessments, and specific cybersecurity incidents. Periodically, the Audit Committee reports on cybersecurity matters, incidents, and risk oversight to the Board. The Board also receives briefings from management on our cybersecurity risk management program.

Although we have not experienced a cyberattack or other cybersecurity incident that has materially affected us, we have been subject to cybersecurity attacks in the past, and we cannot guarantee that we will not experience cybersecurity incidents that may have a material effect on us in the future. For more information, see Risk Factors – Potential cybersecurity threats are changing rapidly and advancing in sophistication. We may not be able to protect our systems and networks, or the confidentiality of our confidential or other information (including personal information), from cyberattacks and other unauthorized access, disclosure, and disruption.