Company: ARVN
Filing Date: 2025-02-11
Form Type: 10-K
Source: 0001655759-25-000016
Chunk: 283

Company: ARVINAS, INC.
Filing Date: 2025-02-11
Form: 10-K
Item: Item 1C
Chunk 283
---
Item 1C. Cybersecurity.

We have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to provide protection for our information assets and operations from internal and external cyber threats, including protecting employee and patient information from unauthorized access or attack, as well as secure our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. As part of our overall risk mitigation strategy, we maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches. We have engaged external parties, including consultants, computer security firms and risk management, and legal and governance experts, to enhance our cybersecurity oversight. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

127

Based on an assessment using the previously described risk mitigation strategy, we do not believe there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See “Our internal computer systems and those of our collaborators, contractors, consultants and other third parties are vulnerable to cyber attacks, cyber intrusions and security breaches, which could not only materially disrupt our business operations and result in the loss of confidential information, but could also damage the integrity of our clinical trials, impact our regulatory filings, compromise our ability to protect our intellectual property, and subject us to regulatory actions that could result in significant fines or other penalties” in Part I, Item 1A. “Risk Factors” for additional information.

Our Audit Committee of our Board of Directors, or the Audit Committee, provides direct cybersecurity risk oversight, and provides regular updates to the Board of Directors regarding such oversight. The Audit Committee receives quarterly updates from management and the Cybersecurity Board, as discussed in further detail below, regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity risks, threats or incidents. We also provide updates to the full Board of Directors regarding cybersecurity risks, threat landscape and risks, as appropriate. 

We have a cross-functional Cybersecurity Board led by our Senior Vice President, Information Technology Systems & Security serving as the chair and consisting of executive-level and non-executive level leaders, including among others, our Chief Financial Officer