Candel Therapeutics, Inc.

Cybersecurity Risk Management and Strategy

Candel has implemented cybersecurity risk management processes that are informed by industry standards in accordance with the scale of our business. Our quality assurance organization has implemented a risk management program for our company at large, and our IT team is responsible for ensuring alignment between our overall risk management processes and our cybersecurity risk management processes. Our cybersecurity risk management processes are designed to assess, identify and mitigate risks from current and emerging cybersecurity threats.

We use various tools and processes to accomplish these objectives, including policies and procedures, risk assessments, and testing. Further, we require our employees to participate in cybersecurity risk awareness trainings and phishing exercises.

Our cybersecurity risk management processes are supported by third-party service providers, including a managed services provider that assists the Company with, among other things, threat monitoring and cybersecurity incident response and escalation services. Werely on a third-party service provider to assist us with our cybersecurity practices, including for vulnerability assessments, penetration testing, and managing IT environments. Our process for onboarding new vendors with access to critical systems or data includes vendor questionnaires, contractual obligations, and if deemed appropriate, review of vendor audit reports.

Our incident management processes include reporting to senior management, including the Chief Financial Officer (CFO), Chief Executive Officer, Senior Vice President Quality Assurance and, where appropriate, to the board of directors. To date, we havenot identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, “Risk Factors,” in this Annual Report on Form 10-K.

Cybersecurity Governance

The board of directors has delegated oversight of the Company’s cybersecurity risk management program to the Audit Committee, including responsibilities for reviewing and discussing cybersecurity risks, implementing risk management programs, controls and procedures, and performing high level reviews of the threat landscape.

Our Vice President, Information Technology (VP, IT) is responsible for the strategic leadership and day-to-day management of our cybersecurity risk management program. The individual occupying this role has over thirty years of experience with information technology management and over five years of cybersecurity risk management.

Our VP, IT engages in regular meetings with our third-party managed IT service provider and the Director, IT Infrastructure and Operations to review and assess our cybersecurity risk management processes. The VP, IT reports such findings to our CFO who annually presents updates on cybersecurity risks, mitigation strategies, and, if necessary, incident response activities to our Audit Committee. Further, our Audit Committee updates the full board of directors on matters relating to cybersecurity risk management, as necessary.