Company: SION
Filing Date: 2025-01-17
Form Type: S-1
Source: 0001193125-25-008474
Chunk: 106

Company: Sionna Therapeutics, Inc.
Filing Date: 2025-01-17
Form: S-1
Chunk 106
---
 encryption, disclosure of, or access to our sensitive
information or our information technology systems, or those of the third parties upon whom we rely. We have not yet conducted any internal audits or penetration tests on our information technology systems, nor have we enlisted any external parties
to conduct security audits or penetration tests on our behalf. Such assessments, when conducted, could indicate vulnerabilities in our information technology systems which we may not be able to effectively remediate. If a security incident were to
occur and cause interruptions in our operations, it could result in a material disruption of our product development programs. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could result in delays
in our regulatory approvals efforts and significantly increase our costs to recover or reproduce the data. We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against
security incidents.

Certain data privacy and security obligations may require us to implement and maintain specific security measures or
industry-standard or reasonable security measures to protect our information technology systems and sensitive information. While we have implemented security measures designed to protect against security incidents, there can be no assurance that
these measures will be effective. Additionally, certain federal, state and foreign government requirements include obligations of companies to notify individuals of security breaches involving particular categories of personally identifiable
information, which could result from breaches experienced by us or the third parties upon whom we rely. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

We may not be able to detect and remediate vulnerabilities in our information technology systems because the threats and techniques used to exploit the
vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. These vulnerabilities pose material risks to our
business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. It is not possible to prevent all threats to our information technology systems and those of our
third-party service providers, over which we exert less control, and any controls we implement to do so may prove to be ineffective.

If we (or a
third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties,
audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (