ALIMERA SCIENCES INC 10-K Cybersecurity GRC - 2024-03-08

Page last updated on April 11, 2024

ALIMERA SCIENCES INC reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-03-08 16:42:25 EST.

Filings

10-K filed on 2024-03-08

ALIMERA SCIENCES INC filed an 10-K at 2024-03-08 16:42:25 EST
Accession Number: 0001267602-24-000019

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C . CYBERSECURITY Risk Management and Strategy: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. The Company has designed and implemented a Security Incident Response Plan for cybersecurity incidents and related processes which are overseen by management and cybersecurity professionals. Cybersecurity threats are identified and escalated to a Security Incident Response Team or member thereof pursuant to criteria set forth in these processes. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers, if any. Our cybersecurity policies, standards, processes, and practices are integrated into the Company s overall risk management and compliance program and are overseen by the Audit Committee. The Compliance Committee, led by our Chief Compliance Officer ( CCO ) and the IT Committee, led by our Chief Financial Officer ( CFO ) are responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures. In general, we seek to address cybersecurity risks through a cross-functional approach focused on preserving the security and availability of information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. The Company also engages consultants, auditors, and other third parties in connection with these processes to assist in the design of cybersecurity measures and employee training and to test the effectiveness of the Company s processes and measures . Governance: Board of Directors The Board s oversight of cybersecurity risk management is led by the Audit Committee which interacts with our CFO, who has oversight for information technology and our CCO, as well as other members of management. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, the board of directors, through the Audit Committee, discuss our approach to cybersecurity risk management with the CFO and CCO. The Audit Committee is informed of material risks, if any, from cybersecurity threats pursuant to Company policies, and at least once per quarter the Company s CCO reports to the Audit Committee generally on cybersecurity matters and material risks, if any, from cybersecurity threats. Management The Company s management, including members of its IT and Compliance Committees, also assess and manage material risks, if any, from cybersecurity threats with the assistance of our third-party IT and cybersecurity vendors. Collaborative Approach : We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Technical Safeguards : We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. Incident Response and Recovery Planning : We are committed to establishing and maintaining comprehensive incident response and recovery plans to address our response to a cybersecurity incident. Third-Party Risk Management : We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. 40 Table of Contents Education and Awareness : We provide periodic mandatory training for personnel regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also perform periodic email phishing tests to keep cybersecurity awareness top of mind. We engage in the periodic assessment of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments, audits and reviews are reported to the Audit Committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. See Risk Management and Strategy above. As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, including its business strategy, results of operations or financial condition. As cybersecurity threats become more sophisticated and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures as we pursue our business strategies. For additional information concerning risks related to cybersecurity, see Item 1.A. Risk Factors Our internal information technology systems, or those of our third-party contract research organizations ( CROs ) or other contractors or consultants, may fail or suffer cybersecurity threats or breaches, loss or leakage of data and other disruptions, which could result in a material disruption of certain parts of our business, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business .

Company Information