Company: SION
Filing Date: 2025-08-11
Form Type: 10-Q
Source: 0002036042-25-000047
Chunk: 83

Company: Sionna Therapeutics, Inc.
Filing Date: 2025-08-11
Form: 10-Q
Item: Part I, Item 3
Chunk 83
---
.

We currently rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, employee email, and other functions. We also currently rely on commercially available tools from third-party service providers to process and safeguard our sensitive information and business data. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

Although, to our knowledge, we have not experienced any material security breach to date, we have experienced and may continue to experience threats or system failures which could cause a security incident or other interruption that could result in unauthorized, unlawful or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely. We have not yet conducted any internal audits or penetration tests on our information technology systems, nor have we enlisted any external parties to conduct security audits or penetration tests on our behalf. Such assessments, when conducted, could indicate vulnerabilities in our information technology systems which we may not be able to effectively remediate. If a security incident were to occur and cause interruptions in our operations, it could result in a material disruption of our product development programs. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. We may expend significant resources or modify our business activities (including our clinical trial activities) to endeavor to protect against security incidents.

Certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. Additionally, certain federal, state and foreign government requirements include obligations of companies to notify individuals of security breaches involving particular categories of personally identifiable information, which could result from breaches experienced by us or the third parties upon whom we rely. Such disclosures are costly, and the disclosure or the failure to comply with such