Biohaven Ltd. 10-K Cybersecurity GRC - 2024-02-29

Page last updated on April 11, 2024

Biohaven Ltd. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-02-29 16:14:12 EST.

Filings

10-K filed on 2024-02-29

Biohaven Ltd. filed an 10-K at 2024-02-29 16:14:12 EST
Accession Number: 0001935979-24-000010

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity Risk Management and Strategy We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework. Our measures to prevent, detect and mitigate cyber threats include training for employees, multi-factor authentication, backup servers, threat monitoring, periodic strategy review and penetration testing performed by a third-party advisory firm, and coverage under an information security risk insurance policy. Third-party suppliers are pre-screened as part of our vendor onboarding process to evaluate their cybersecurity programs and assess risk. As a part of our pre-screening process, we evaluate each vendor’s overall cybersecurity risk profile relative to the services they provide for Biohaven, including questions relating to cybersecurity insurance, security operations and access and management of our data. Cybersecurity incidents involving third-party supplier systems are evaluated for their impact on the Company and managed through our cyber incident management process. In addition, our employees are required to complete an annual cybersecurity training managed through our internal compliance training system. Governance The Board recognizes the importance of cybersecurity in maintaining the trust and confidence of our stakeholders, patients and employees. Our Audit Committee is central to the Board’s oversight of cybersecurity and bears the primary responsibility for overseeing risks associated with our information systems and technology, including cybersecurity. Our Chief Technology Officer (“CTO”) is tasked with updating the Board and Audit Committee on cybersecurity risks. Our CTO provides comprehensive briefings to our Audit Committee on a quarterly basis regarding our strategy for managing and mitigating cybersecurity and technology-related risks. Beginning in 2024, our CTO will also provide such comprehensive briefings to the Board on an annual basis. Our CTO has been in the position for over three years and has over 35 years of industry experience focusing on large scale business transformations leveraging technology, cybersecurity, and technical operations excellence. Our CTO has held various senior technology leadership roles at other companies prior to joining the Company. Cybersecurity Risks Although cybersecurity risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we are subject to various cybersecurity risks, which could, in the future, be material. For more information about the cybersecurity risks we face, see risk factor entitled “Our business and operations may be materially adversely affected in the event of computer system failures or security breaches” in Item 1A, “Risk Factors.”

Company Information