Company: MYGN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000899923-25-000019
Chunk: 110

Company: MYRIAD GENETICS INC
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 110
---
Item 1C.    CYBERSECURITY

Cybersecurity Risk Management and Strategy

We recognize the critical importance of maintaining the trust and confidence of patients, business partners, payors, clinical trial participants, and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our Board of Directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We generally follow the HITRUST Common Security Framework in our cybersecurity policies, standards, processes, and practices. To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity risk management program that includes the identification, prioritization, and management of technical and non-technical risk to the confidentiality, integrity, or availability of patient, employee, clinical trial participant, payor, business partner, and company information. This program considers the risks associated with our industry and the technical and regulatory requirements related to the information systems and data involved. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We have developed policies, standards, processes, and practices designed to protect our information systems and data from unauthorized access, cybersecurity attacks, and other security incidents. The policies, standards, processes, and practices are implemented and enforced by dedicated IT and cybersecurity professionals. We utilize a variety of control measures and cybersecurity technologies that are designed to protect our availability of critical information systems and data, maintain regulatory compliance, assess, identify, and manage our material risks from cybersecurity threats, and protect against and respond to security incidents. These controls and processes are reviewed periodically and include the following activities: •we monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; •through our policies, practices, and contracts, as applicable, we require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; •we utilize technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, virtual private networks (VPN), Web Application Firewalls (WAF), intrusion detection systems, antivirus and endpoint detection and response software, multi-factor authentication (MFA), data encryption, encrypted backups,