Company: ATRA
Filing Date: 2025-04-28
Form Type: DEF 14A
Source: 0000950170-25-059322
Chunk: 33

Company: Atara Biotherapeutics, Inc.
Filing Date: 2025-04-28
Form: DEF 14A
Chunk 33
---
 to experience, cyber incidents in the normal course of our business. As of the date of this report, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us will not occur in the future.

The Audit Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity. The Audit Committee receives status updates on at least a semi-annual basis from our Chief Information Officer on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape. The Chair of the Audit Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Audit Committee. In addition, all Board members have access to the materials for each Audit Committee meeting.

Our Chief Information Officer is responsible for the oversight of our cybersecurity risks. We have implemented a security incident response plan and use this incident response framework as part of the process we employ to keep the Audit Committee and our executive management informed about cybersecurity risks and to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. The plan is a set of procedures and tasks that our incident response team, under the direction of the Chief Information Officer, executes with the goal of ensuring timely identification and appropriate resolution of cybersecurity incidents. In addition, we validate compliance with our internal data security controls through the use of security monitoring tools.

Our Chief Information Officer has over 25 years of information technology experience and has a thorough understanding of enterprise level cyber security framework. Our Chief Information Officer has also participated in cybersecurity reviews and implementations including various tools and platforms for over 10 years and drives strategic cyber security implementations based on industry best practices that helps us strengthen our security posture on a continuous basis.

Supplier Code of Conduct

We are committed to maintaining the highest standards of legal and ethical conduct and to reflect our TRAIT values. We expect our suppliers to demonstrate a similar commitment to legal and ethical business practices. Our Supplier Code of Conduct conveys our minimum expectations for our suppliers, and their respective subcontracts and suppliers, to: (i) operate in full compliance with all laws, rules, and regulations; (ii) conduct business ethically and act with integrity; (iii) uphold the human rights of workers and to treat workers with dignity and respect; (