Company: SUPN
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001356576-25-000017
Chunk: 473

Company: SUPERNUS PHARMACEUTICALS, INC.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 473
---
 at the top of our organization, where Company leadership consistently communicates the requirements for vigilance and compliance throughout the organization, and then leads by example. We use a risk-based and layered approach to prevent, detect, and respond to cyberattacks, and leverage external partnerships for threat intelligence.Our management is responsible for risk identification, risk management and risk mitigation strategies associated to cybersecurity related information technology risks, including fully documenting our cybersecurity policies and procedures and cybersecurity risk management program as well as implementing a cybersecurity risk management program and ensuring compliance with our cybersecurity policies and procedures. Our Senior Vice President of Quality, GMP Operations, and Information Technology leads our Information Technology team, which includes experienced and information security professionals and has expertise in various aspects of cybersecurity, such as network security, data protection, incident response, threat intelligence, and security awareness. Our Information Technology Team’s expertise is supplemented by external consultants who provide specialized services and independent assessments of our cybersecurity posture and capabilities.Management has appointed a Cybersecurity Incident Response Team (the “CSIRT”) which is operationally responsible for coordinating, executing, and managing cybersecurity incident response activities. The CSIRT is comprised of experienced information security personnel from our Information Technology team. The CSIRT’s responsibilities include, among other things, incident identification and escalation to designated members of management. Among the designated members of management who are required to be notified are our Chief Executive Officer and our Chief Financial Officer.Our Board of Directors has appointed its Audit Committee as its primary body to oversee management’s risk identification, risk management and risk mitigation strategies related to cybersecurity related information technology risks. Members of our management who have responsibility for designing and implementing our risk management processes are required to meet periodically with the Audit Committee regarding our policies, processes, procedures and any significant development related to the identification, management and mitigation of cybersecurity risks. The Audit Committee’s primary oversight of management’s cybersecurity risk management efforts is supplemented by our full Board, which is required to receive, on an annual basis an update from management on any significant developments related to the identification, management and mitigation of cybersecurity risks.

Cybersecurity Risk Identification and ManagementAs part of management’s initiative to enhance our information security program, during 2024 our program underwent an internal audit, which was supported by an international firm experienced in auditing such programs. The results of the audit are being used by management to supplement previously planned enhancements. Management, with the assistance of third-party experts, is developing and implementing governance-related enhancements to its cybersecurity risk management program. A significant aspect of that process involves fully documenting policies, standards and procedures and developing others, including