Company: GHRS
Filing Date: 2025-02-27
Form Type: 20-F
Source: 0001140361-25-006175
Chunk: 128

Company: GH Research PLC
Filing Date: 2025-02-27
Form: 20-F
Item: Item 16
Chunk 128
---
. As a young and rapidly growing company and given the ever-evolving nature of cybersecurity risks, we regularly review and seek to improve our strategies for addressing cybersecurity risks and threats. Our approach to cybersecurity risk management involves identifying, monitoring, assessing, and responding to cybersecurity threats and incidents, facilitating coordination across different departments of the Company, and escalating issues within management and to the Board of Directors, as appropriate.
   
 
 
  We engage a third-party IT service provider to assist us with implementation and operation of technical controls designed to identify, assess, manage and mitigate cybersecurity risks. This includes management of endpoints, patches, user access and incidents, as well as IT change management. Cybersecurity awareness training is also provided to employees on an ongoing basis. We also have processes in place to oversee and identify risks from cybersecurity threats associated with our use of third-party vendors and service providers.
     
   
  Management is responsible for identifying, assessing and managing material cybersecurity risks on an ongoing basis. Cybersecurity risk management is under the direction of our co-founder and Managing Director, Ireland who has maintained responsibility for IT and cybersecurity since the establishment of the Company. He is assisted in this role by our IT Director, Finance team, professional IT consultants that we engage from time to time and our third-party IT service provider. Management receives updates and reports from our third-party IT service provider regarding cybersecurity matters on a regular basis. Management provides quarterly updates to the audit committee regarding IT and cybersecurity risks and mitigation strategies in place to address them.
  
Our Board of Directors has ultimate oversight responsibility for enterprise risk management, including cybersecurity risk management, and delegates cybersecurity risk management oversight to the audit committee. The audit committee meets on a quarterly basis and is responsible for reviewing the Company’s approach and practices with respect to risk assessment and management, which includes cybersecurity risks. On at least an annual basis, management provides an update to the Board of Directors on cybersecurity risk. Additionally, management would follow a risk-based escalation process to notify the audit committee and Board of Directors outside of the cycle of regular updates if they identify an emerging risk or material issue. As part of such process, any material cybersecurity incidents would be escalated by management to the Board of Directors.

  Despite our efforts, we cannot eliminate all risks from cybersecurity threats. We cannot provide assurances that we have not experienced an undetected cybersecurity incident, and we cannot guarantee that our information technology systems include sufficient controls to prevent future cybersecurity incidents. For more information about these risks and how they have impacted our Company, please see “Item 3. Key Information—D.