XML 44 R27.htm IDEA: XBRL DOCUMENT
v3.25.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2024
Cybersecurity Risk Management Strategy And Governance [Abstract] |
Cybersecurity Risk Management Processes For Assessing Identifying And Managing Threats [Text Block] | We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, and penetration testing to inform our risk identification and assessment. As discussed in more detail under “Cybersecurity Governance” below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer. We also identify our cybersecurity threat risks by comparing our processes to standards set by the UK governments’ National Cyber Security Centre. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities:
| ● | monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;
| ● | through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;
| ● | employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;
| ● | provide regular training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;
| ● | leverage the National Cyber Security Centre incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and
| ● | carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.
Our response to an incident involves the coordination of activities to detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. As part of the above processes, we regularly engage with consultants, auditors and other third parties, including having a third-party independent qualified and accredited advisor review our cybersecurity program to help identify areas for continued focus, improvement and compliance. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we would require those third parties, although there are currently none, that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the risk factor heading “Security incidents, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability” which disclosures are incorporated by reference herein. We have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, and penetration testing to inform our risk identification and assessment. As discussed in more detail under “Cybersecurity Governance” below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer. We also identify our cybersecurity threat risks by comparing our processes to standards set by the UK governments’ National Cyber Security Centre. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities:
| ● | monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;
| ● | through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;
| ● | employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;
| ● | provide regular training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;
| ● | leverage the National Cyber Security Centre incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and
| ● | carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.
Our response to an incident involves the coordination of activities to detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. As part of the above processes, we regularly engage with consultants, auditors and other third parties, including having a third-party independent qualified and accredited advisor review our cybersecurity program to help identify areas for continued focus, improvement and compliance. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we would require those third parties, although there are currently none, that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight And Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected Or Reasonably Likely To Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board Of Directors Oversight [Text Block] | Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. The audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats. At least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes. In such sessions, our audit committee generally receives materials that include a cybersecurity dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties. Our audit committee also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. To date, we have not experienced any cyber security incident. Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.
Cybersecurity Risk Board Committee Or Subcommittee Responsible For Oversight [Text Block] | The audit committee
Cybersecurity Risk Process For Informing Board Committee Or Subcommittee Responsible For Oversight [Text Block] | At least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes. In such sessions, our audit committee generally receives materials that include a cybersecurity dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties. Our audit committee also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. To date, we have not experienced any cyber security incident. Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.
Cybersecurity Risk Role Of Management [Text Block] | Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer. Our Chief Financial Officer has been responsible for our IT functions for 20 years and has managed the IT function of companies generally for the last 35 years. The management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, periodically.
Cybersecurity Risk Management Positions Or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions Or Committees Responsible [Text Block] | Chief Financial Officer
Cybersecurity Risk Management Expertise Of Management Responsible [Text Block] | Our Chief Financial Officer has been responsible for our IT functions for 20 years and has managed the IT function of companies generally for the last 35 years
Cybersecurity Risk Process For Informing Management Or Committees Responsible [Text Block] | The management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan
Cybersecurity Risk Management Positions Or Committees Responsible Report To Board [Flag] | true

X
- References No definition available. + Details
Name: | cycc_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cycc_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References No definition available. + Details
Name: | cycc_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cycc_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References No definition available. + Details
Name: | cycc_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cycc_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References No definition available. + Details
Name: | cycc_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cycc_
Data Type: | xbrli:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References No definition available. + Details
Name: | cycc_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cycc_
Data Type: | xbrli:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References No definition available. + Details
Name: | cycc_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cycc_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References No definition available. + Details
Name: | cycc_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cycc_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References No definition available. + Details
Name: | cycc_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cycc_
Data Type: | xbrli:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References No definition available. + Details
Name: | cycc_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cycc_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References No definition available. + Details
Name: | cycc_CybersecurityRiskManagementStrategyAndGovernanceAbstract
Namespace Prefix: | cycc_
Data Type: | xbrli:stringItemType
Balance Type: | na
Period Type: | duration

X
- References No definition available. + Details
Name: | cycc_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cycc_
Data Type: | xbrli:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References No definition available. + Details
Name: | cycc_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cycc_
Data Type: | xbrli:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References No definition available. + Details
Name: | cycc_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cycc_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References No definition available. + Details
Name: | cycc_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cycc_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References No definition available. + Details
Name: | cycc_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cycc_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References No definition available. + Details
Name: | cycc_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cycc_
Data Type: | xbrli:booleanItemType
Balance Type: | na
Period Type: | duration