CASSAVA SCIENCES INC 10-K Cybersecurity GRC - 2024-02-28

Page last updated on April 11, 2024

CASSAVA SCIENCES INC reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-02-28 16:01:07 EST.

Filings

10-K filed on 2024-02-28

CASSAVA SCIENCES INC filed an 10-K at 2024-02-28 16:01:07 EST
Accession Number: 0001437749-24-005894

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity In the normal course of business, we collect and store sensitive information, including proprietary and confidential business information, intellectual property, information regarding clinical and non-clinical trials, sensitive third-party information and employee information. We have processes designed to protect our information systems, data, assets, infrastructure, and computing environments from cybersecurity threats and risks. Our cybersecurity strategy includes the use of managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats. In addition, we use multi-factor authentication, perform periodical penetration testing and other logical, physical and technical controls designed to deter, prevent, mitigate and respond to cybersecurity threats. Further, our information systems include continuous alert plans, and we provide periodical cybersecurity reminders to our employees to emphasizes the importance of adherence to our security policies. We conduct organizational risk assessment, which help management in identifying data assets and recognizing and assessing potential threats, and investigating potential vulnerabilities. We are in the process of reviewing and implementing incremental information technology strategies to mitigate cybersecurity risks and their possible impacts. Risk assessments enable management to make risk management decisions and assign resources to mitigate risk. We also periodicly engage third parties to assess the effectiveness of our cybersecurity practices. As of the date of this Annual Report, we do not believe that any past cybersecurity incidents that have been detected have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. We do not carry a separate cybersecurity commercial insurance policy covering the potential financial losses that may occur in the event we experience a cybersecurity incident. See Risk Factors - Risks Related to Our Business and Operations for additional information about the risks to our business associated with cybersecurity or a breach or compromise to our information security systems.

Company Information