Company: BOLT
Filing Date: 2025-03-24
Form Type: 10-K
Source: 0000950170-25-043873
Chunk: 126

Company: Bolt Biotherapeutics, Inc.
Filing Date: 2025-03-24
Form: 10-K
Item: Item 1B
Chunk 126
---
Not applicable. 

Item 1C. Cybersecurity. Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data (such as information related to our product candidate development, collaboration activities and clinical trials), including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive personnel data and other personal data (collectively, “Information Systems and Data”).Our information technology department, supported by certain service providers, identifies, assesses and manages the Company’s cybersecurity threats and risks. Our information technology department (led by our Director of IT 

69

Table of Contents

Operations and Security), identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, real-time monitoring of network events, subscribing to reports and services that identify cybersecurity threats, evaluating threats and actors reported to us, conducting scans of the threat environment, evaluating our and our industry’s risk profile, coordinating with law enforcement concerning threats when appropriate, conducting (and working with third parties, as appropriate) assessments and audits for internal and external threats and vulnerabilities, and using of external intelligence feeds.We implement and maintain various technical, physical, and organizational measures, processes, and policies, designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident detection and response plan; vulnerability management processes; risk assessments; implementation of security standards; encryption of certain data; network security controls; segregation of certain data; access controls including multi-factor authentication for certain Information Systems and Data; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management program; employee training; penetration testing; and cybersecurity insurance. Our assessment and management of material risks from cybersecurity threats is integrated into the Company’s overall risk management processes.  For example, our information technology department presents updates on our IT environment and cybersecurity threats to the audit committee of the board of directors, which evaluates our overall enterprise risk and the effectiveness of our risk management approaches.We use service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats.  Such providers include but are not limited to legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed security service providers, and penetration testing firms.We use service providers to perform a variety of functions throughout our business, such as application providers, hosting companies