Kintara Therapeutics Inc

Cybersecurity Risk Management

Like many companies, we face significant and persistent cybersecurity risks. The small size of our organization and limited resources could exacerbate these risks. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

In the ordinary course of our business, we collect and store sensitive data, including intellectual property. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management strategy, which is comprised of a wide array of policies, standards, architecture, processes, and governance. Under the guidance and supervision of our Chief Executive Officer (“CEO”), we further limit risk by delegating our information technology and cybersecurity to a leading third-party IT consultant to safeguard our networks. Additionally, as an added layer of security, all of our data is stored on the cloud.

Despite being a small organization, we are committed to maintaining governance and oversight of these risks and to implementing standard operating procedures (“SOPs”) and training to help us assess, identify, monitor and respond to these risks. Employees are trained to avoid phishing emails, and our internal controls system is designed to mitigate the risk of payments of fraudulent invoices.

Governance

We aim to incorporate industry best practices for companies of our size and financial strength throughout our cybersecurity program. Our board of directors has ultimate oversight of cybersecurity risk. The Chief Executive Officer reports to our board of directors. Our Chief Executive Officer provides periodic updates to the board of directors on (1) any critical cybersecurity risks; (2) ongoing cybersecurity initiatives and strategies; (3) applicable regulatory requirements; and (4) industry standards. The Chief Executive Officer also notifies the board of directors of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.