Company: GANX
Filing Date: 2025-03-27
Form Type: 10-K
Source: 0001558370-25-003823
Chunk: 12

Company: Gain Therapeutics, Inc.
Filing Date: 2025-03-27
Form: 10-K
Item: Item 1C
Chunk 12
---
ITEM 1C. CYBERSECURITY

Risk Management and StrategyWe do no believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. During the reporting period, we have not experienced any material cybersecurity incidents nor any series of immaterial cybersecurity incidents that would require to be disclosed in this year-end reportManagement of cybersecurity risks is a component of our overall risk management strategy. We rely on information technology, communication networks, enterprise applications, accounting and financial platforms, and related systems in the operation of its business. Our operations also rely on the secure collection, storage, transmission and processing of proprietary, confidential and sensitive data. Our cybersecurity risk management strategy is designed to support us in identifying, protecting, detecting, responding to, and recovering from cybersecurity threats and incidents with the intention of protecting the confidentiality, integrity, and availability of such systems and data.We have implemented several processes with the assistance of third parties that we engage to help us manage our overall information technology function. These include certain processes for assessing, identifying and managing cybersecurity risks and are designed to help protect our information assets and operations from internal and external cyber threats, and to protect employee, collaborator and patient information from unauthorized access or attack, as well as to secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, and periodic review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, computer security firms and governance experts, to enhance our cybersecurity oversight and to gain valuable insights into the ever-evolving cybersecurity landscape. Our use of third parties to conduct our business is significant. We use suppliers, CROs, CDMOs, and other service providers. A cybersecurity incident at third party could materially adversely impact us. In order to mitigate this risk, we assess third party cybersecurity controls prior to engaging third parties and include security and privacy addendums to our contracts where applicable. We also require that third party service providers or partners report cybersecurity incidents to us so that we can assess the impact of the incident on us.In an effort to further deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with data protection, cybersecurity and incident response and prevention materials, which educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks.Lastly, we have established a Cybersecurity Incident Response Policy ("CIR