Company: MIRM
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001759425-25-000014
Chunk: 124

Company: Mirum Pharmaceuticals, Inc.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 124
---
Item 1C. Cybersecurity.

Risk management and strategy

We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and approved medications (“Information Systems and Data”). Our information security team, supported by our legal and compliance departments, help identify, assess and manage our cybersecurity threats and risks. Our information security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, depending on the context, including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing certain reports of threats and threat actors, conducting scans of certain environments, evaluating our and our industry’s risk profile, evaluating certain threats reported to us, conducting third-party threat assessments, coordinating with law enforcement about certain threats, conducting internal audits and threat assessments, and conducting vulnerability assessments. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response procedures and policies; disaster recovery/business continuity plans; risk assessments; implementation of certain security controls; encryption of certain data; network security, access, and physical controls for certain systems; management, tracking and disposal of certain assets; systems monitoring; employee training; penetration tests by third-party service providers; tabletop exercises conducted by third parties; and cybersecurity insurance. Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms such as legal counsel, threat intelligence providers, cybersecurity consultants and software providers, penetration testing services, and other third-party service providers including for identity management solutions. We use third-party service providers to perform a variety of functions throughout our business application providers, hosting companies, contract research organizations (C