Company: TEM
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000950170-25-025603
Chunk: 493

Company: Tempus AI, Inc.
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1B
Chunk 493
---
 to help us evaluate and attest to 

114

our risk management systems, including maintaining a certification pursuant to ISO 27001 and conducting periodic third-party audits to maintain our certification. In addition, we maintain a detailed Incident Response Plan to assist in responding to potential cybersecurity threats. Our Incident Response Plan addresses critical aspects of incident management, including detection, impact analysis, containment, mitigation, remediation, recovery, and long-term strategies to prevent future incidents. Our Information Security and Privacy Teams conduct tabletop exercises twice per year to ensure preparedness for information security, including cybersecurity incidents. In addition, we promote a company culture of awareness and discipline in cybersecurity matters through annual employee training and education, including periodic phishing and social engineering simulations. We also maintain cybersecurity insurance coverage.Our Privacy program is designed to support and enhance our Cybersecurity program. We perform an annual HIPAA Security Risk Assessment, among other things, to help identify remediation priorities and to ensure we have implemented best practices in storing and safeguarding PHI.Our assessment and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company’s enterprise risk management program; (2) the information security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Enterprise Risk Management Committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the board of directors, which evaluates our overall enterprise risk.We frequently collaborate with other third-party service providers to conduct regular audits, threat assessments, and consultation on cybersecurity strategy, enhancements, and best practices. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, including legal counsel, cybersecurity software providers, and penetration testing firms.We use third-party service providers to perform a variety of functions throughout our business, such as application providers and cloud infrastructure providers. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires, review of the vendor's written security program, review of security assessments, and security assessment calls with the vendor's security personnel. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity