Company: VERA
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-029969
Chunk: 0

Company: Vera Therapeutics, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1B
Chunk 0
---
Not applicable.

Item 1C. Cybersecurity Risk management and strategyWe implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive personal data, including that of our employees, consultants and clinical trial participants (Information Systems and Data).  The Chief Financial Officer, Chief Business Officer, Chief Accounting Officer, Senior Vice President of Legal, Vice President of Information Technology, and certain third-party providers are members of our Cybersecurity Risk Management Committee and help identify, assess and manage the Company’s cybersecurity threats and risks. This Cybersecurity Risk Management Committee, which reports to the Audit Committee of the Company’s Board of Directors, is responsible for identifying and assessing risks from 

88

cybersecurity threats. The Cybersecurity Risk Management Committee monitors and evaluates our threat environment and the Company’s risk profile using various methods including, for example: manual and automated tools in certain environments and systems, subscribing to reports and services that identify certain cybersecurity threats, conducting scans of certain threat environments, evaluating certain cybersecurity threats reported to us, conducting internal and external audits of certain environments and systems, and performing third-party threat assessments.Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan; information security program; acceptable use policy; incident detection and response tools; risk assessments of certain environments and systems; encryption of certain data; network security for certain environments and systems; access controls for certain environments and systems; data segregation of certain data; physical security; asset management; third-party systems monitoring; employee cybersecurity training; and cybersecurity insurance.     Our assessment and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management processes. For example, our Cybersecurity Risk Management Committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, such as legal counsel, cybersecurity consultants, forensic investigators, and cybersecurity software providers.  We use third-party service providers to perform a variety of functions throughout our