Company: PHAT
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0000950170-25-034183
Chunk: 303

Company: Phathom Pharmaceuticals, Inc.
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1C
Chunk 303
---
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. 

We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This means that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. It does not, however, mean that we meet any technical standards, specifications, or requirements.

Our cybersecurity risk management program is part of our overall risk management program and shares similar governance processes and reporting channels that apply across the risk management program to financial, legal, compliance, and other operational risk areas. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

Key elements of our cybersecurity risk management program include but are not limited to the following:

•	risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information;

•	an internal team responsible for, inter alia, managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;

•	the use of external service providers with subject matter expertise, where appropriate, to assess, test or otherwise assist with aspects of our security processes;

•	cybersecurity awareness training of our employees, including incident response personnel, and senior management; 

•artificial intelligence based managed detection and response system that provides 24×7 monitoring of our networks, endpoints, and cloud environments; alerts from this system are handled by an external 24x7 staff that reviews the alerts and acts where necessary;

•	a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and

•	a third-party risk management evaluation process for key service providers, based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors with access to our information systems or data.

We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See “Risk Factors – “Our internal information systems, or those of any of our CROs, contract