Company: DVAX
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001029142-25-000049
Chunk: 116

Company: DYNAVAX TECHNOLOGIES CORP
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 116
---
 harm; loss of revenue or profits; and other adverse consequences.”

Governance

Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for reviewing and discussing with management our cybersecurity risk assessment and management processes, including our oversight and the steps we take to monitor and help control risks from cybersecurity threats.

Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including our ISO, who has over 20 years of experience in information security. Our ISO oversees a global team of information security professionals consisting of multiple full time equivalent employees in multiple countries.Our ISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our ISO (in coordination with our CSIRT) is also responsible for other functions, including preparing for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our CSIRT reviews, approves and prioritizes information security and cybersecurity policies, projects and initiatives. Executive management is responsible for prioritizing initiatives and approving budgets to allocate funding for the foregoing based on feedback from the ISO, the CSIRT and the Audit Committee. Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our ISO. The ISO works with our CSIRT to help us mitigate and remediate cybersecurity threats or incidents of which they are notified. The ISO is responsible for designing and promoting general security awareness and training, as well as defining and training relevant participants on our incident response processes. Our security and incident response processes include escalation and reporting to the CSIRT, 

56

Table of Contents

Disclosure and Risk Committee, senior management and Audit Committee for certain information security incidents, as warranted under the circumstances. 

The Audit Committee receives periodic reports from the ISO concerning our significant cybersecurity threats and risk, and the processes we have implemented to address them. The Audit Committee also has access to various reports, summaries of reports or presentations related to cybersecurity threats, risk and mitigation.