Company: ABUS
Filing Date: 2025-03-27
Form Type: 10-K
Source: 0001447028-25-000083
Chunk: 80

Company: Arbutus Biopharma Corp
Filing Date: 2025-03-27
Form: 10-K
Item: Item 1C
Chunk 80
---
Item 1C.       Cybersecurity  

We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.Cybersecurity Program Given the importance of cybersecurity to our business, we maintain a robust and comprehensive cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical and technical safeguards, with regular evaluations of our cybersecurity posture, including internal and external audits, as well as annual penetration tests. We also require cybersecurity training when onboarding new employees and contractors and on an annual basis thereafter. Our cybersecurity program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework to strengthen our program effectiveness and reduce cybersecurity risks.We use a risk-based approach with respect to our oversight of third-party service providers. As part of our process for onboarding new vendors, we assess new third-party service providers for technical capabilities, reputation, financial stability, pricing, and other criteria and such third-party service providers are reviewed and approved by our Finance and Legal departments. We have implemented processes to confirm that agreements with third-parties contain data security and privacy terms as appropriate. For certain key third-party service providers, we obtain a SOC type 2 audit report from the vendor’s audit firm which provides detailed information and assurance about a service organization’s security, availability, processing integrity, confidentiality and privacy controls.Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a regularly tested Incident Management and Response program as well as business continuity and disaster recovery plans. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat and handling it in accordance with that severity level.We have relationships with a number of third-party service providers to assist with cybersecurity evaluation, containment and remediation efforts.

Governance

Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Executive Director of IT and Information Security (ED, IT & IS), who reports to our Chief Financial Officer. Our ED, IT & IS has over 30 years of IT experience and an Advanced Graduate Certification in Cybersecurity. He is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to,