Passage BIO, Inc. 10-K Cybersecurity GRC - 2024-03-04

Page last updated on April 11, 2024

Passage BIO, Inc. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-03-04 07:15:36 EST.

Filings

10-K filed on 2024-03-04

Passage BIO, Inc. filed an 10-K at 2024-03-04 07:15:36 EST
Accession Number: 0001558370-24-002310

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

Item 1C. Cybersecurity We recognize the critical importance of maintaining the trust and confidence of all of our stakeholders. Our business depends on the efficient and uninterrupted operation of our information technology systems and those of our third-party vendors. Our board of directors is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our risk management and compliance program. Our cybersecurity policies, standards, processes and practices are fully integrated into the Company s enterprise-wide risk management and compliance program and overseen by the Audit Committee, and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur . Risk Management and Strategy As one of the critical elements of the Company s overall risk management and compliance approach, the Company s cybersecurity program is focused on the following key areas: Governance : The Board s oversight of cybersecurity risk management is led by the Audit Committee of the Board, which regularly interacts with our Chief Compliance Officer, our Executive Director of IT, and other members of management. Collaborative Approach : We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Technical Safeguards : We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, Security Information and Event Management systems, Extended Detection and Response with 24/7 Security Operations Center , anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence . Incident Response and Recovery Planning : We have established and maintain comprehensive incident response and recovery plans to address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. Third-Party Risk Management : We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Education and Awareness : We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also perform periodic email phishing tests to keep cybersecurity awareness top of mind. 90 Table of Contents We engage in the periodic assessment of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Governance The Board, with leadership from the Audit Committee, oversees our cybersecurity risk management process. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, the board of directors, through the Audit Committee, discuss our approach to cybersecurity risk management with the Executive Director of IT. Our Executive Director of IT, in coordination with our executive management team, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee base and appropriate third-party contractors, the Executive Director of IT and the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate. Our Executive Director of IT has over 28 years of experience in leading IT teams and managing cybersecurity in several industries including biotech, media and consumer products. He has hands-on experience as an IT network engineer and systems administrator, configuring and hardening systems against security threats. In addition, he has previously held executive-level leadership IT roles. Throughout his career, he has kept abreast of new developments in cybersecurity and has implemented industry standards to secure IT infrastructure and systems. He works closely with the Company s IT managed service provider to assess all security incidents and events and escalate as needed. No cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. 91 Table of Contents

Company Information