Company: ARVN
Filing Date: 2025-02-11
Form Type: 10-K
Source: 0001655759-25-000016
Chunk: 284

Company: ARVINAS, INC.
Filing Date: 2025-02-11
Form: 10-K
Item: Item 1C
Chunk 284
---
 and General Counsel. This board is responsible for reviewing, engaging and making decisions related to the execution and continuous improvement of cybersecurity strategy, processes and governance impacting our information systems, employees, partners and patients. Our Senior Vice President, Information Technology Systems & Security leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our Senior Vice President, Information Technology Systems & Security is an experienced senior leader with more than 25 years of experience in information technology within the pharmaceutical industry leading a team of employees and consultants with a breadth of experience including security management experience along with CISSP certification.

In an effort to deter and detect cyber threats, we periodically provide our workforce, including all employees and contingent staff, with a privacy, data protection, cybersecurity and incident response, and prevention education and awareness program, which includes annual and supplemental training covering a range of timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use, and mobile security. This education and awareness program functions to educate employees on the importance of reporting all incidents immediately. In addition, we perform monthly phishing test campaigns to reinforce identification and reporting training. We automatically assign online reinforcement training upon initial phish test failure and may follow-up one-on-one as needed. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. Lastly, we perform annual penetration tests conducted by independent, third-party cybersecurity firms and ongoing vulnerability assessments conducted by the internal security team.