Cryoport, Inc. 10-K Cybersecurity GRC - 2024-03-13

Page last updated on April 11, 2024

Cryoport, Inc. reported their cybersecurity risk management and governance process in a yearly 10-K filed on 2024-03-13 17:26:29 EDT.

Filings

10-K filed on 2024-03-13

Cryoport, Inc. filed an 10-K at 2024-03-13 17:26:29 EDT
Accession Number: 0001558370-24-003128

Note: filing items unformatted. Drop us a note with the above URL to help us prioritize formatting it!

Item 1C. Cybersecurity.

ITEM 1C. Cybersecurity Risk Management and Strategy We identify and assess material risks from cybersecurity threats to our information systems and the information residing in our information systems by monitoring and evaluating our threat environment on an ongoing basis using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, and conducting risk assessments. We manage material risks from cybersecurity threats to our information systems and the information residing in our information systems through various processes and procedures, including, depending on the environment, risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, and employee training. We engage third-party service providers to provide some of the resources used in our information systems and some third-party service providers have access to information residing in our information systems. With respect to such third parties, we seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature and extent of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our processes may include conducting due diligence on the cybersecurity practices of such provider and contractually imposing cybersecurity related obligations on the provider. We also engage third parties to assist with cybersecurity risk assessments, incident detection and response, vulnerability management, systems monitoring, and employee training. We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect Cryoport, including our business strategy, results of operations, or financial condition. Refer to Part I, Item 1A Risk Factors Risks Related to Our Technology and Intellectual Property Cyberattacks, data incidents and breaches in the security of our information systems and networks and of the electronic and confidential information in our possession could materially adversely impact our business, financial condition and results of operations, in addition to our reputation and relationships with our employees, customers, suppliers and business partners in this Form 10-K for additional discussion about cybersecurity-related risks. Governance Our Board of Directors holds oversight responsibility over Cryoport s risk management and strategy, including material risks related to cybersecurity threats. This oversight is executed directly by our board of directors and through its committees. Our audit committee oversees the management of Cryoport s major financial risk exposures, the steps management has taken to monitor and control such exposures, and the process by which risk assessment and management is undertaken and handled, which would include cybersecurity risks, in accordance with its charter. The audit committee holds quarterly meetings and receives periodic reports from management regarding risk management, including major financial risk exposures from cybersecurity threats or incidents. Within management, the Chief Information Officer or Information Technology Director, as applicable, of our business units are primarily responsible for assessing and managing our material risks from cybersecurity threats on a day-to-day basis and keep the senior executive officers informed on a regular basis of the identification, assessment, and management of cybersecurity risks and of any cybersecurity incidents. Such management personnel have prior experience and training in managing information systems and cybersecurity matters and participate in ongoing training programs. 39 Table of Contents In the first quarter of 2024, we created two new corporate roles, the Chief Digital and Technology Officer and the Chief Information Security Officer. The Chief Information Security Officer will report directly to the Chief Digital and Technology Officer and be primarily responsible for assessing and managing our material risks from cybersecurity threats within management.

Company Information