XML 57 R22.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Risk management and strategy
 
We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic, or competitive in nature, and our clinical trial and related data (“Information Systems and Data”).
 
The underlying processes and controls of our cyber risk management program incorporate various practices and standards for cybersecurity and information technology. We conduct an annual assessment performed by a third-party service provider of our cyber risk management program. The annual risk assessment identifies, quantifies, and categorizes material cyber risks to our Company. In addition, we, in conjunction with the third-party cyber risk assessment vendor, develop a risk mitigation plan designed to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.
 
In addition, we maintain various policies to help identify, address, and mitigate risks from cybersecurity threats, including, for example in areas such as information security, access on/offboarding, and access and account management. We monitor threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by us. We also partner with IT and cybersecurity providers, such as cybersecurity consultants. We leverage these third-party providers and solutions to support our cybersecurity risk management strategy and processes, which include, for example, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls, endpoint protection, endpoint detection and response, remote monitoring management on certain devices, encryption of certain data, critical data backups, infrastructure maintenance, incident detection and response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.          
 
Our assessment and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company’s enterprise risk management program and identified in the Company’s risk register; (2) the security department/security management works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; or (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.
 
We have implemented third-party risk management processes to manage material risks from cybersecurity threats associated with reliance on vendors, critical service providers, and other third parties we engage, such as software-as-a-service providers, data hosting companies, and contract research organizations. These processes include, for example, conducting risk assessment for certain vendors, reviewing vendor security assessments and questionnaires, and conducting annual reviews of vendor audits and reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our third-party risk management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.
 
For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 3. Section D Risk Factors in this Annual Report on Form 20-F, including “Cyber-attacks, security breaches or other disruptions to our information technology systems, or those of third parties upon which we rely, or our data could irreparably damage our reputation and our business, expose us to liability and materially and adversely affect our results of operations.”
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic, or competitive in nature, and our clinical trial and related data (“Information Systems and Data”).
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 3. Section D Risk Factors in this Annual Report on Form 20-F, including “Cyber-attacks, security breaches or other disruptions to our information technology systems, or those of third parties upon which we rely, or our data could irreparably damage our reputation and our business, expose us to liability and materially and adversely affect our results of operations.”
Cybersecurity Risk Board of Directors Oversight [Text Block]
Governance
 
The audit committee of the board of directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the audit committee of the board of directors on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. In addition, cybersecurity risks are reviewed by our board of directors at least annually, as part of our corporate risk oversight processes. 

 

 
Our Chief Information Security Officer (“CISO”) is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO is a Certified Information Systems Security Professional and has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners.
 
We have developed an incident response plan that is designed to escalate certain cybersecurity incidents to members of management, including the CISO, depending on the circumstances. Such members of management work with the Company’s incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company’s incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]
The audit committee of the board of directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the audit committee of the board of directors on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. In addition, cybersecurity risks are reviewed by our board of directors at least annually, as part of our corporate risk oversight processes. 
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our Chief Information Security Officer (“CISO”) is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CISO is a Certified Information Systems Security Professional and has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] We have developed an incident response plan that is designed to escalate certain cybersecurity incidents to members of management, including the CISO, depending on the circumstances. Such members of management work with the Company’s incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company’s incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true