Company: CRVO
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0001437749-25-007829
Chunk: 117

Company: CervoMed Inc.
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1A
Chunk 117
---
 Company’s IT environment, overall cybersecurity risk management program and strategy and education regarding emerging trends and threats.

79

Management's Role in Cybersecurity Risk Management and Governance

Our executive management team is responsible for assessing and managing material risks from cybersecurity threats and possess relevant experience and expertise in various disciplines that are key to effectively managing such risks. The experience and expertise of our executive management team is also supplemented by our external IT service providers that collectively have extensive, broad experience and expertise in these areas. Our executive management team reports information about such risks to the Audit Committee of the Board on at least a quarterly basis.

We depend on and engage various other third parties, including suppliers, vendors, and service providers, to support key elements of our business including our IT infrastructure. We have implemented various control processes designed to address cybersecurity threat risks associated with our use of such third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, IT, and/or compliance personnel. In addition, cybersecurity risks and posture are, as appropriate and applicable, a factor considered in the selection process prior to our engagement of third-party service providers.

In response to an identified cybersecurity incident, a group comprised of appropriate management personnel, our third-party IT service provider and, depending on the scope and severity of the incident, additional third-party subject matters experts, will be assembled to develop and implement a response strategy to contain, control, and remediate the cybersecurity incident, including securing our affected systems and/or information, mitigating harmful effects of the incident, preventing further compromises, and communicating information to affected parties, regulatory agencies and law enforcement, as necessary. This group will also report any such cybersecurity incident to the Audit Committee of the Board.

Assessment of Cybersecurity Risk

The potential impact of risks from cybersecurity threats are assessed on an ongoing basis by both management and the Board, including how such risks could materially affect our business strategy, operational results, and financial condition, and from time-to-time the Company engages third-parties to provide independent risk assessments.

As of the date of this Annual Report, we have not experienced a cybersecurity incident that results in a material effect on our business strategy, results of operations or financial condition, but we cannot provide assurance that we will not be materially affected