Company: MYGN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000899923-25-000019
Chunk: 111

Company: MYRIAD GENETICS INC
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 111
---
 vulnerability scanning and patching, email anti-phishing technology, malicious URL and IP filtering, application controls, USB control and threat intelligence services; •our cybersecurity personnel include certified security professionals who are experienced in networks, computer systems, cloud cybersecurity, cybersecurity risk management, incident response, and security awareness training; •we regularly test and monitor our cybersecurity defenses to ensure that they are effective; and •we also conduct security awareness training for all employees to help them identify and mitigate cybersecurity risks. 

58

Table of Contents

We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the risk factor “Security breaches, loss of data and other disruptions, including from cyberattacks and other cybersecurity incidents, could compromise personal, confidential, or other sensitive or proprietary information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation”, included in Part I, Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference into this Item 1C. We did not experience any material cybersecurity incidents during the last fiscal year. We have an incident response plan and processes in place for responding to cybersecurity incidents. The process includes steps to identify, contain, investigate, and remediate the impacts of the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. The plan involves the participation of a security incident response team that includes our Chief Legal Officer, our Privacy Officer, and other senior leaders in finance, communication, human resources, and legal. The plan includes procedures to communicate the incident to management and customers as appropriate and to provide information as required to state and federal law enforcement and regulatory bodies.  

Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient, payor, business partner, and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, our data, or our facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject