Company: RCUS
Filing Date: 2025-05-06
Form Type: 10-Q
Source: 0001724521-25-000063
Chunk: 40

Company: Arcus Biosciences, Inc.
Filing Date: 2025-05-06
Form: 10-Q
Item: Part I, Item 3
Chunk 40
---
 development to regulatory review and approval, the amount and type of clinical data that may be required by regulatory authorities may increase or change. Consequently, the results of our clinical trials for investigational products in that class will likely need to show a risk benefit profile that is competitive with or more favorable than those products and investigational products in order to obtain marketing approval or, if approved, a product label that is favorable for commercialization. If the risk benefit profile is not competitive with those products or investigational products, or if the approval of other agents for an indication or patient population significantly alters the standard of care with which we tested our investigational products, we may have developed a product that is not commercially viable, that we are not able to sell profitably or that is unable to achieve favorable pricing or reimbursement. In such circumstances, our future product revenue and financial condition would be materially and adversely affected. 

Our internal information technology systems, and those of our third-party CROs and other third parties upon which we rely, are subject to failure, security breaches and other disruptions, which could result in a material disruption of our investigational products’ development programs, jeopardize sensitive information, prevent us from accessing critical information or result in a loss of our assets, and potentially expose us to notification obligations, loss, liability or reputational damage and otherwise adversely affect our business. 

We are increasingly dependent upon information technology systems, infrastructure and data to operate our business. In the ordinary course of business, we collect, store and transmit confidential information, including but not limited to intellectual property, proprietary business information and personal information (collectively, "Sensitive Information"). 

We also have outsourced elements of our operations to third parties, and as a result we manage a number of third-party contractors and other parties who have access to our sensitive information. Our ability to monitor these third parties’ 

51

information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties we rely on experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if these third parties fail to satisfy their privacy- or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such an award. In addition, supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

Despite the implementation of security measures, given the size