Company: CSTL
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001447362-25-000031
Chunk: 6

Company: CASTLE BIOSCIENCES INC
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 6
---
Item 1C. Cybersecurity.

Risk management and strategy

We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and commercial and pipeline tests (“Information Systems and Data”).Our Director of Cyber Security & Infrastructure (“DCSI”) oversees our information security function, which in conjunction with our security and engineering operations, Security Operations Center, a third-party managed 

72

Table of Contents

security provider, helps identify, assess and manage the Company’s cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company’s risk profile using various methods including, for example: manual and automated tools; subscribing to and analyzing certain reports of cybersecurity threats and threat actors; conducing scans of our environment; evaluating our and our industry’s risk profile and certain threats reported to us; coordinating with law enforcement concerning certain threats; conducting internal and external audits and threat assessments; conducting vulnerability assessments; using external intelligence feeds; and working with a third-party to test our incident response processes.Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response and business continuity plan; vulnerability management policy; risk assessments; implementing certain certifications and security standards; encrypting certain of our data; network security controls; segregating certain data; access and physical security controls; asset management, tracking, and disposal; monitoring our systems; employee training; penetration tests; maintaining cybersecurity insurance; and dedicated cybersecurity staff.Our assessment and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company’s enterprise risk management program; our information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which is primarily responsible for overseeing our risk management processes on behalf of our board of directors.We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from