Company: TVRD
Filing Date: 2025-03-11
Form Type: 10-K
Source: 0001558370-25-002705
Chunk: 22

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-03-11
Form: 10-K
Item: Item 1C
Chunk 22
---
Item 1C. Cybersecurity.

Risk Management and Strategy​We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, products and our critical data (including intellectual property and confidential information that is proprietary, strategic or competitive in nature, and clinical trial data) (collectively, “Information Systems and Data”).  Our Executive Director of Information Technology, or IT, and other relevant personnel help identify, assess and manage our cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment. We (including the Executive Director of IT) use various methods designed to accomplish this task including, for example: manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our and our industry’s risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting internal audits, conducting threat assessments, conducting third-party threat assessments, and conducting vulnerability assessments.Depending on the relevant information systems environment, we implement and maintain various technical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, incident detection and response measures, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, implementation of security standards/certifications, encryption of certain data, network security controls, data segregation, access controls, asset management (such as tracking and disposal of our information systems), systems monitoring, and cybersecurity insurance.Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes.  For example, the Executive Director of IT works with executive management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Our Executive Director of IT and executive management also evaluate material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of our Board of Directors, or the Board. We use service providers in an effort to identify, assess, and manage material risks from cybersecurity threats. These service providers may provide services related to: threat intelligence, cybersecurity practices, cybersecurity software, managed cybersecurity response, penetration testing, dark web monitoring, forensic investigation, and professional services (including legal counsel).We use service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract