Absci Corp

Risk Management and Strategy

In the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems.

Our cybersecurity risk management program includes a number of components, including information security program assessments and continuous monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments on our systems, including penetration testing on an annual basis. We also conduct cybersecurity simulation exercises, including in connection with our disaster recovery procedures. In addition, we have a process to assess the security practices of certain third-party vendors, including through the use of vendor security questionnaires, as appropriate. We continue to develop and update a comprehensive cybersecurity strategy to guide cybersecurity risk management activities, align corporate security standards, and guide requirements for all technology across the organization with regards to cybersecurity.

We have taken additional steps to further mature our cybersecurity monitoring and response, vulnerability management, and incident response capabilities through new vendor partnerships to centralize and develop additional detection and response capabilities. In addition to the risk assessments described above, we utilize a managed detection and response (MDR) service that provides continuous monitoring of our network environment and assists with threat detection and incident response. These third parties also assist us in our design and implementation of our cybersecurity policies and procedures and in our assessment and testing of our security safeguards. As part of our cybersecurity risk management program, we also maintain processes to assess and review the cybersecurity practices of third-party vendors and suppliers when applicable. Moreover, we maintain an established process to notify management of identified cybersecurity incidents and to provide an assessment of the potential criticality and impact of such incidents. We have also implemented procedures for response and containment efforts to address the actual or potential impact of identified cybersecurity incidents, as applicable.

As a public company, our information technology systems and related cybersecurity controls are also subject to review as part of our financial statement audit and internal control over financial reporting processes.

Additionally, we have implemented an employee education program that is designed to raise awareness of cybersecurity threats, including risks posed by phishing attempts. This training is included during the employee onboarding process and periodically thereafter.

We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats, we have, from time to time, experienced threats to and security incidents related to our and our third-party vendors’ information systems data and systems, including for example, phishing attacks. For more information about the cybersecurity risks we face, please refer to Item 1A, “Risk Factors,” in this annual report on Form 10-K, including the risk factor titled “Cybersecurity incidents, data breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation.”

Governance

Under the ultimate direction of our chief executive officer, or CEO, and our executive management team (including our Chief Legal Officer, who also serves as our Chief Compliance Officer), with oversight from our audit committee of the board of directors (Audit Committee), our Head of Information Technology (Head of IT) has primary responsibility for assessing, operating and managing our cybersecurity threat management program. Our Head of IT meets periodically with our Chief Legal Officer to discuss current developments in the cybersecurity landscape and our cybersecurity risk management program, including providing updates regarding the sources and nature of critical risks we face and how the IT department assesses those risks, including the likelihood of such risks, the severity of impact, and progress on vulnerability remediation.

Our Chief Legal Officer and Head of IT consult with other members of our information technology department, and with third parties with expertise in cybersecurity, to develop strategies to assess, address and align cybersecurity efforts with our business objectives and operational requirements. The Head of IT role is currently held by an individual with over 25 years of experience leading information security, corporate systems, technology risk, and compliance management, bringing deep expertise in cybersecurity and digital infrastructure operations across diverse industries and regulatory environments.

As part of our board of directors’ enterprise risk management program, ourboard of directors has responsibility for oversight of cybersecurity risk management. Our board of directors has delegated to our Audit Committee oversight of our cybersecurity risk management program, including oversight of information security and cybersecurity threats and related compliance and disclosure requirements. On a quarterly basis, our Head of IT provides an update to our Audit Committee regarding our cybersecurity risk management program, including as relates to critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. The Audit Committee periodically reports on cybersecurity risk management to the full board of directors.