Company: VCYT
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001384101-25-000014
Chunk: 122

Company: VERACYTE, INC.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 122
---
 security policies, standards, processes and practices. Incident Response and Recovery Planning: We have established and maintain a cybersecurity incident response plan that addresses our response to a cybersecurity incident.Third-Party Risk Management:  We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems that could adversely impact our business in the event of a cybersecurity incident. We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures. The results of such assessments, audits and reviews are reported to the Audit Committee and the board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

Governance

The board of directors, in coordination with the Audit Committee, oversees our management of risks arising from cybersecurity threats. The board of directors and the Audit Committee each receive presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the board of directors and the Audit Committee discuss our approach to cybersecurity risk management with the members of management, including the CIO.

60

Table of Contents

The Cybersecurity Executive Leadership Team is composed of the CIO, in coordination with our Chief Executive Officer, or CEO, Chief Financial Officer, or CFO, Chief Compliance Officer and General Counsel, or GC.  The team works collaboratively across our company to design and implement programs to protect our information systems from cybersecurity threats and to appropriately respond to any cybersecurity incidents in accordance with our cybersecurity incident response plan. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout our company are engaged to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CIO and the Cybersecurity Executive Leadership Team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report