Company: CSTL
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001447362-25-000031
Chunk: 7

Company: CASTLE BIOSCIENCES INC
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 7
---
 cybersecurity threats, including for example professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software and managed service providers, penetration testing firms, and dark web monitoring services.We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have vendor management processes to manage cybersecurity risks associated with our use of certain providers. These processes may include reviewing vendors’ written security programs and security assessments, conducting security assessment calls with vendor personnel, and imposing contractual obligations related to information security on certain of our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including “If our information technology systems, or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences.”

Governance

Our board of directors addresses the Company’s cybersecurity risk management as part of its general oversight function. The board of directors’ audit committee oversees the risk assessment, risk management and internal controls over cyber security matters, as outlined in its committee charter.

Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our DCSI. Our DCSI has over 20 years of experience as a security professional, has a CISSP certification, and has completed the Carnegie Melon Insider Risk Management Program. The DCSI is responsible for hiring appropriate personnel, leading enterprise-wide cybersecurity strategy, helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy, and communicating key priorities to relevant personnel.Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Security Management. Security Management works with the Company’s incident response team to help the Company mitigate and remediate cybersecurity incidents of 

73

Table of Contents

which they are notified. In addition, the Company’s incident response plan includes