Company: SUPN
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001356576-25-000017
Chunk: 474

Company: SUPERNUS PHARMACEUTICALS, INC.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 474
---
 personnel training requirements, threat monitoring, detection, and containment standards, risk assessment processes, standards for third-party penetration testing, and standards for third-party vendor security requirements. Management expects that the program will continue to adapt and incorporate new techniques and procedures in an effort to combat evolving and novel cybersecurity threats.Our current cybersecurity risk management program includes the following key elements:•Cybersecurity risk mitigation: We utilize various measures, tools and controls to prevent, detect, and mitigate cyberattacks, such as firewalls, antivirus software, encryption, authentication, backup, and recovery. We also adopt a defense-in-depth approach that layers multiple security mechanisms across our information systems and networks, such as perimeter, endpoint, application, and data security. We monitor and test our security measures and controls, and we update and enhance them as needed to address new and emerging cyber threats and vulnerabilities.We also rely on specialized services or tools from third-party vendors and software companies including network monitoring, threat, incident and breach identification and data security and backup services. For third-party service providers whose software or personnel have access to our systems, we review their security audit reports prior to the commencement of their services.•Cybersecurity risk response: The Company’s Executive Management, which is led by our CEO and includes leaders from across the Company’s departments, is responsible for providing the necessary resources, support, and authority for the CSIRT to carry out their responsibilities effectively. Our Executive Management team is accountable for making critical decisions in response to an incident. The CSIRT is operationally responsible for coordinating, executing, and managing incident response activities. Both our Executive Management team and CSIRT receive regular training on information security topics. 

67

Table of ContentsITEM 1A. RISK FACTORS.

•Cybersecurity education and training: We provide regular and mandatory cybersecurity education and training to our employees, contractors, and other authorized users of our information systems and networks, to raise their awareness and understanding of cyber risks and their responsibilities for protecting our information systems and data. We also conduct periodic phishing and social engineering campaigns to test and reinforce the cybersecurity behavior and culture of our users. We also ensure our suppliers and other business partners, meet our cybersecurity expectations and requirements.We are committed to maintaining and improving our cybersecurity risk management program as our business and the cybersecurity threat environment evolves. Because no cybersecurity program can ensure an incident will not occur, we have established business continuity, contingency and recovery plans to be used if we experience a cybersecurity incident, and obtained cyber insurance coverage to mitigate the potential losses and liabilities arising from cyber incidents.