Company: CNTB
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001835268-25-000014
Chunk: 233

Company: Connect Biopharma Holdings Ltd
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1C
Chunk 233
---
ITEM 1C. CYBERSECURITY

Our Board of Directors (the “Board”) and management recognize the importance of maintaining the trust and confidence of our clinical trial participants, investors, business partners and employees. The Board and the Audit Committee of the Board (the “Audit Committee”) are actively involved in oversight of our cybersecurity program as part of our approach to risk management. Our cybersecurity policies, processes and practices are integrated into our operations and are based on recognized standards such as the National Institute of Standards and Technology Cybersecurity Framework. In general, we seek to address cybersecurity risks through a comprehensive, coordinated approach that is focused on preserving the confidentiality, integrity, security, and availability of our critical systems and the information that we create through our business operations by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. 

Risk Management and Strategy We design and assess our program based on the National Institute of Standards and Technology’s Cybersecurity Framework (“NIST CSF”). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Key elements of our cybersecurity risk management program include, but are not limited to, the following: •A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; •The utilization of Microsoft 365 services for email, data storage, Identity Provider (“IdP”) for Single Sign-On (“SSO”), and other technical controls such as remote user and device management; •Microsoft 365 configurations which are aligned with security and industrial standards, including automatic risk management mechanisms and alert notifications for our Information Technology (“IT”) team; •A zero trust approach to cybersecurity focused on preventing and limiting damage in the event that a malicious actor gains access to our network and operating on the principle “never trust, always verify,” continuously authenticating and authorizing users and devices that seek to obtain access to our systems and data; •Privileged access management protocols that require user access requests to receive formal, documented approvals with specific business justifications and, following receipt of such approvals, the provision of only the minimum access necessary for the approved purpose; •Regular monitoring of our Microsoft security score, which serves as a benchmark