Company: CRVO
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0001437749-25-007829
Chunk: 100

Company: CervoMed Inc.
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1A
Chunk 100
---
 that breakdowns can occur because of simple error or mistake. Additionally, controls can be circumvented by the individual acts of some persons, by collusion of two or more people or by an unauthorized override of the controls. Accordingly, because of the inherent limitations in our control system, misstatements or insufficient disclosures due to error or fraud may occur and not be detected.

The Company’ s IT systems, or those of its vendors, collaborators or other contractors or consultants, may fail or suffer security incidents, loss of data and other disruptions, which could result in a material disruption of its product development programs, compromise sensitive information related to its business or prevent it from accessing critical information, potentially exposing it to liability or otherwise adversely affecting its business.

In the ordinary course of the Company’s business, the Company collects and stores sensitive data, intellectual property, and proprietary business information. This data encompasses a wide variety of business-critical information including research and development information, clinical trial information, commercial information, and business and financial information. The Company faces risks relative to protecting this critical information including loss of access, unauthorized disclosure, unauthorized modification, and inadequate monitoring of its controls over these risks. The Company also relies on IT systems and networks, including third-party "cloud-based" service providers, and the Company’s third-party CROs, to process, transmit and store electronic information in connection with the Company’s business activities. This includes crucial systems such as email, other communication tools, electronic document repositories, and archives.

As use of digital technologies has increased, cyber incidents, including deliberate attacks and attempts to gain unauthorized access to computer systems and networks, have increased in frequency and sophistication. These threats pose a risk to the security of the Company’s systems and networks and the confidentiality, availability and integrity of the Company’s data. Cyberattacks could include wrongful conduct by hostile foreign governments, industrial espionage, wire fraud and other forms of cyber fraud, the deployment of harmful malware, denial-of-service, social engineering fraud or other means to threaten data security, confidentiality, integrity and availability. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, the Company may be unable to anticipate these techniques or implement adequate preventative measures.

Despite the implementation of security measures, the Company’s internal IT systems and those of its current and any future third-party vendors, collaborators and other contractors or consultants are vulnerable to system failures, accidents, security incidents, damage, interruption or data theft from computer viruses, computer hackers, malicious code