Acasti Pharma Inc

We are increasingly dependent on third-party provided software applications and computing infrastructure to conduct key operations. We depend on both our own procured systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program as well as cybersecurity policies and processes to support our controls and our preparedness for treatment of identified information security risks. We also undergo annual evaluations of our cybersecurity program, conducted by our cybersecurity external advisory firm.

Our cybersecurity program evaluation identified various risks and issues that we continue to mitigate to further improve our program. This includes:

•

Establishing a cybersecurity training program for users.

•

Implementing a third-party risk management program to support our existing Third-Party Risk Management Policy and process to assess the risks associated with our critical third-party vendor engagements.

•

Testing our Cybersecurity Incident Response Plan.

•

Establishing additional processes for identifying cybersecurity threats and vulnerabilities within the environment in which we operate.

•

Enhancing our technical security management safeguards and configurations.

Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats

In the event of a cybersecurity incident, we maintain a Cybersecurity Incident Response Plan. Pursuant to the plan and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We have a relationship with various law firms to assist with advisory on legal aspects of containing incidents and communicating accordingly.

Governance

Management Oversight

The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our information technology (“IT”) contractor. Our IT consultant leverages their over 35 years of experience. Our IT consultant is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity incidents.