Company: ATRA
Filing Date: 2025-03-07
Form Type: 10-K
Source: 0000950170-25-035507
Chunk: 253

Company: Atara Biotherapeutics, Inc.
Filing Date: 2025-03-07
Form: 10-K
Item: Item 1C
Chunk 253
---
 us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us will not occur in the future. For additional information on the risks we face from cybersecurity threats, please see the risk factor titled, "If our security measures are compromised, or our information technology systems or those of our vendors, and other relevant third parties fail or suffer security breaches, loss or leakage of data, and other disruptions, this could result in a material disruption of our services, compromise sensitive information related to our business, harm our reputation, trigger our breach notification obligations, prevent us from accessing critical information, and expose us to liability or other adverse effects to our business." in Item 1A. "Risk Factors." 

Governance

The Audit Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity. The Audit Committee receives status updates on at least a semi-annual basis from our Chief Information Officer on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape. The Chair of the Audit Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Audit Committee. In addition, all Board members have access to the materials for each Audit Committee meeting. Our Chief Information Officer is responsible for the oversight of our cybersecurity risks. We have implemented a security incident response plan and use this incident response framework as part of the process we employ to keep the Audit Committee and our executive management informed about cybersecurity risks and to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. The plan is a set of procedures and tasks that our incident response team, under the direction of the Chief