Company: KROS
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001664710-25-000018
Chunk: 319

Company: Keros Therapeutics, Inc.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 319
---
ITEM 1C. CYBERSECURITY

Cybersecurity Risk Management and StrategyWe have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data and information related to our product candidates, preclinical studies and clinical trials, which we refer to collectively as Information Systems and Data.  Our information technology and security, or IT, management team, and legal, and risk management teams, together with our third-party service providers, help identify, assess and manage our cybersecurity threats and risks. In doing so, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company’s risk profile using a multi-faceted approach including use of manual and automated tools, internal and external IT audits, and IT security, governance, risk and compliance reviews, reviewing reports and using services that identify cybersecurity threats, conducting threat and vulnerability assessments, evaluating reported threats as well as the industry’s risk profile, and third-party-conducted red/blue team testing and tabletop incident response exercises.We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, 

93

for example: maintaining an incident response plan and policy, incident detection and response, maintaining a vulnerability management policy, maintaining disaster recovery and business continuity plans, conducting risk assessments, implementing security standards and certifications, maintaining network security controls, access controls, and physical security measures, asset management, systems monitoring, conducting proactive privacy and cybersecurity reviews of systems and applications, performing penetration testing using external third-party tools and techniques to test security controls, conducting employee training, monitoring emerging laws and regulations related to data protection and information security and implement appropriate changes and encrypting Information Systems and Data. In addition, we maintain cybersecurity insurance.Our assessment and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management processes.  For example, our IT team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, our risk committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk. We use third-party service providers to assist us from time to time to identify, assess