Company: PRTA
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001559053-25-000009
Chunk: 127

Company: PROTHENA CORP PUBLIC LTD CO
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 127
---
ITEM 1C. CYBERSECURITY

Processes for Assessing, Identifying and Managing Risks from Cybersecurity ThreatsWe, like any other organization operating in the biotechnology and pharmaceutical space, are subject to cybersecurity threats. In order to be prepared to respond to a potential cybersecurity threat, we have implemented an Information Technology (“IT”) Security Guidelines Policy. Such policy sets forth a framework for management of all Company-managed IT systems and equipment. In connection with such policy, we have also implemented an IT Security Incident Response Plan, which sets forth processes in the event of a suspected cybersecurity incident. The processes set forth in such IT Security Incident Response Plan are part of our overall enterprise risk management system. As set forth in the IT Security Incident Response Plan, we may engage third-party consultants to assist us with the response to any suspected cybersecurity incident. We engage third parties on a periodic basis in connection with our overall enterprise risk management assessment. With respect to third-party service providers that we may engage in connection with our day-to-day operations, we attempt to assess such service provider’s processes regarding potential cybersecurity threats in connection with first engaging such service provider.

Oversight of Risks Related to Cybersecurity ThreatsBoth our Board of Directors and members of our management team are responsible for oversight of risks related to cybersecurity threats. Our Audit Committee reviews our major risk exposures, including risks related to cybersecurity threats. Our Head of IT, who reports to our Chief Legal Officer, is primarily responsible for assessing and managing risks related to cybersecurity threats. Our Head of IT has approximately 30 years of experience managing IT systems for organizations similarly situated to ours. As set forth in the IT Security Incident Response Plan, the Chief Legal Officer and the Head of Human Resources would be informed of any cybersecurity incident, and depending on the severity of the cybersecurity incident, many other functions of the management team would be informed as well. At the discretion of the Chief Legal Officer, the Audit Committee would be informed of a cybersecurity incident. Additionally, our Head of IT presents an annual report, which sets forth risks related to cybersecurity threats, to the Audit Committee and is available to the committee to discuss any aspect of the report.As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition for the years of financial statements presented in this report.Notwithstanding the approach we take to cybersecurity threats, we may not be successful in preventing or mitigating a