Company: NCNA
Filing Date: 2025-03-20
Form Type: 20-F
Source: 0000950170-25-042709
Chunk: 280

Company: NuCana plc
Filing Date: 2025-03-20
Form: 20-F
Item: Item 16K
Chunk 280
---
 risk management processes and an area of focus for our board of directors and management. In general, our Audit Committee of our board of directors and our executive management oversee our CSMT, which oversees our risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our Audit Committee of our board of directors and executive management executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to our CSMT, and our board of directors has authorized our Audit Committee and CSMT to oversee risks from cybersecurity threats.

At least quarterly, our Audit Committee receives an update from our CSMT of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, any results from third party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our Audit Committee generally receives materials that include current and emerging material cybersecurity threat risks, describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties. Our Audit Committee and executive management also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

Members of our Audit Committee and board of directors are also encouraged to regularly engage in conversations with executive management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board of directors' meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.
Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CSMT, which consists of our Director of Operations, Director of Finance, and Senior Vice President of Clinical Operations. Such individuals have collectively over 16 years of prior work experience in various roles involving managing information security, developing cybersecurity strategies, implementing effective information and cybersecurity programs. These team 

 

members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members