Company: KROS
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001664710-25-000018
Chunk: 320

Company: Keros Therapeutics, Inc.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 320
---
, and manage material risks from cybersecurity threats, including for example professional services firms, including legal counsel, threat intelligence service providers, cybersecurity consultants and software providers, managed cybersecurity service providers and penetration testing firms.   Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling or processing our Information Systems and Data. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider, including completion of security questionnaires, review of the vendor’s written security program, review of security assessments and reports, audits, and security assessment calls with the vendor’s security personnel. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. “Risk Factors” in this Annual Report on Form 10-K, including under the heading “If our internal computer systems, or those used by our contract research organizations, or other contractors or consultants with whom we work, fail, suffer security incidents, or are or were otherwise compromised, we could experience adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences.”

Cybersecurity Governance

Our board of directors addresses the Company’s cybersecurity risk management as part of its general oversight function. Our audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Members of our audit committee receive updates on a regular basis from senior management, including leaders from our IT and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives.

Our cybersecurity risk assessment and management processes are implemented and maintained by leaders from our IT, finance and legal teams, including our Executive Director who serves as the Head of IT and Cybersecurity, who has twenty years of experience in various roles involving information technology