Company: NCNA
Filing Date: 2025-03-20
Form Type: 20-F
Source: 0000950170-25-042709
Chunk: 278

Company: NuCana plc
Filing Date: 2025-03-20
Form: 20-F
Item: Item 16K
Chunk 278
---
Item 16K. Cybersecurity
We recognize the critical importance of maintaining the trust and confidence of patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the United Kingdom National Cyber Security Centre or NCSC, and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

Cybersecurity Risk Management and Strategy; Effect of Risk
We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program and have implemented a Cyber Security Management Team, or CSMT, to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. The CSMT consists of our Director of Operations, Director of Finance, and Senior Vice President of Clinical Operations.
We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and the services of third-party service providers, including vulnerability assessments, to inform our risk identification and assessment. As discussed in more detail under “Cybersecurity Governance” below, our Audit Committee of our board of directors provides oversight of our CSMT, which leads and conducts our cybersecurity risk management and strategy processes.
We also identify our cybersecurity threat risks by comparing our processes to standards set by the NCSC, as well as by engaging experts to attempt to infiltrate our information systems and conduct risk management assessments. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities:
•monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;
•through our policies, practices and contracts (as applicable), require employees, as