Company: DVAX
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001029142-25-000049
Chunk: 114

Company: DYNAVAX TECHNOLOGIES CORP
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 114
---
ITEM 1C. CYBERSECURITY

Risk Management and Strategy

We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, along with personal data and other sensitive information, including our trade secrets, data we may collect about trial participants in connection with clinical trials, and other sensitive data (“Information Systems and Data”). Our Senior Director of IT Infrastructure & Security also functions as our information security officer (“ISO”). The ISO (as part of our security function), along with our management committee and broader internal cybersecurity, IT infrastructure, and digital technology automation functions, as well as third-party service providers, all help identify, assess and manage our cybersecurity threats and risks. Our security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry’s risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, responding to proactive outreach from CISA and FBI, internal and/or external audits, conducting threat assessments for internal and external threats, third-party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and use of external intelligence feeds.Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to help manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a corporate security incident response plan, a vulnerability management policy, a vendor risk management program, incident detection and response processes, IT systems disaster recovery procedures, risk assessments, reasonable implementation of security controls in accordance with applicable security standards/certifications, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, employee training, penetration testing, cybersecurity insurance, dedicated cybersecurity staff/officer. We also rely on third-party vendor backup/restore, disaster recovery and business continuity procedures as stated in the respective SOC 1 and SOC 2 reports if provided by such vendors as they pertain to certain of our managed services.

55

Table of Contents

Our procedures for assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For