Company: CNTB
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001835268-25-000014
Chunk: 234

Company: Connect Biopharma Holdings Ltd
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1C
Chunk 234
---
 for our security posture and guides our continuous improvement efforts; •Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment, including annual external assessments and vulnerability scanning; •A security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; •Regular security awareness training sessions for users, including simulated phishing email campaigns managed by KnowBe4, a third-party leader in security awareness training; •A disaster recovery program, including business continuity procedures in the event of a disaster, backup procedures, failover features with up-to-date SaaS services, and data recovery protocols; and •A third-party risk management (“TPRM”) process to safeguard against risks posed by service providers, suppliers and vendors, based on our assessment of their respective criticality to our operations and respective 

99

TABLE OF CONTENTS

risk profile, encompassing risk identification, due diligence and risk assessment prior to engagement, and categorization of third parties based on risk levels. We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. We did not experience any material IT security incidents during the fiscal year. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See “Risk Factors – Our IT Systems, or those of our CROs, CMOs, other contractors, vendors, consultants or collaborators, may fail or suffer system failures, security breaches or deficiencies in cybersecurity, which could results in a material disruption of our product development programs, compromise sensitive information related to our business or trigger contractual and legal obligations.

Cybersecurity Governance

 Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management’s implementation of our cybersecurity risk management program. 

The Audit Committee receives periodic reports from management on our cybersecurity risks, and our IT team directly reports to the Audit Committee on a periodic basis. In addition, management is obligated to update the Audit Committee, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on