Company: MIRM
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001759425-25-000014
Chunk: 125

Company: Mirum Pharmaceuticals, Inc.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 125
---
ROs), contract manufacturing organizations (CMOs), supply chain resources, and other business-related SaaS platforms. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes conducting risk assessments of certain vendors, reviewing certain vendors’ security assessments, reviewing reports of certain of our vendors’ security, and reviewing the written information security program of certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor 

83

Table of Contents

management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including “Our business is subject to complex, stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations relating to privacy and data protection. Our actual or perceived failure to comply with such obligations could result in regulatory investigations or actions, litigations (including class claims) and mass arbitration demands, fines and penalties, disruptions of and changes to our business practices, monetary penalties, reputational harm, loss of revenue or profits, and other adverse business consequences.”; and “If our information technology systems, or those used by our CMOs, CROs, commercial vendors or other contractors, consultants or third parties with whom we work, or our data are or were compromised, we could experience material adverse consequences, including but not limited to regulatory investigation, actions, litigation, fines and penalties, disruptions of our business operations, reputation harm, loss of revenue or profits, and other adverse consequences.”

Governance

Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors’ audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. 

Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director of Information Technology/Information Security, Vice President, Legal, Chief Compliance Officer (“CCO”), and Chief Financial Officer (“CFO”). Our Executive Director of Information Technology/Information Security has over ten years of experience in information technology and security, and previously held positions such as Associate Director of Informational Technology and