Company: VCYT
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001384101-25-000014
Chunk: 121

Company: VERACYTE, INC.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 121
---
ITEM 1C.    CYBERSECURITY

Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, patients, business partners and employees. Our board of directors is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management, or ERM. Our cybersecurity policies, standards, processes and practices continue to be incorporated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

59

Table of Contents

Risk Management and Strategy

As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas: Governance:  As discussed in more detail under the heading “Governance,” the board of directors' oversight of cybersecurity risk management is supported by the Audit Committee of the board of directors, or the Audit Committee, our Chief Information Officer, or CIO, other members of management and relevant management committees as appropriate.Collaborative Approach:  We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Technical Safeguards:  We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. Physical Safeguards:  We deploy physical safeguards such as facility access control via keycard access and security cameras.  In addition, workstation and device security is controlled with proper logging and identity access controls to protect our physical assets.Administrative Safeguards:  We have implemented policies, security standards and procedures to ensure proper user and protection of our assets. We maintain cybersecurity risk insurance coverage to provide financial protection in the event a cybersecurity breach was to occur.Education and Awareness: We provide regular, mandatory, and ongoing training and reinforcement for personnel regarding cybersecurity threats to help equip our personnel with tools to address such threats, and to communicate our evolving information