Company: SPRB
Filing Date: 2025-04-15
Form Type: 10-K
Source: 0000950170-25-053945
Chunk: 0

Company: SPRUCE BIOSCIENCES, INC.
Filing Date: 2025-04-15
Form: 10-K
Item: Item 1C
Chunk 0
---
Risk Management and Strategy

We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal health information (including clinical trial data) (“Information Systems and Data”). Our information technology function, which is led by Samir Gharib, our President, Chief Financial Officer, and Chief Compliance Officer, helps identify, assess and manage the Company’s cybersecurity threats and risks. Our information technology function works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company’s risk profile using various methods including, employing both automated and manual tools and controls; conducting threat and vulnerability assessments; utilizing third-party services to monitor our information technology infrastructure; and performing internal audits. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: risk assessments, incident detection and response policies, network security controls for certain systems (including as applicable data segregation, data encryption, access controls, physical security, and systems threat monitoring), disaster recovery and business continuity plans, vendor risk management program, and dedicated cybersecurity staff and employee training.

Our assessment and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company’s enterprise risk management program and the information technology function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, Mr. Gharib and the audit committee of the board of directors evaluate material risks from cybersecurity threats against our overall business objectives and reports to the board of directors, which evaluates our overall enterprise risk.

We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers and managed cybersecurity service providers.

We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, and supply chain providers. We have a vendor management program to manage cybersecurity risks associated with our use of service providers. The program includes, as applicable, risk assessment for certain vendors, security questionnaires, review of certain vendors