Rapport Therapeutics Inc

Cyber Risk Management and Strategy

We have adopted cybersecurity risk management processes, in accordance with our risk profile and business size, that are designed to identify, assess, and mitigate risks from current and emerging cybersecurity threats. Our cybersecurity processes, which are informed by the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”), are supported by athird-party Managed Service Provider (“MSP”) that assists us in managing our information technology systems.

We implement a multi-layered approach to cybersecurity that includes, but is not limited to, employee security awareness training, phishing simulations, incident response planning, and various cybersecurity tools and technologies. We leverage the support of third-party information technology and security providers to manage our information technology systems, including through the performance of system scans and threat intelligence analysis. We have also previously conducted a cybersecurity risk assessment that was intended to take into account the evolving cyber threat landscape and industry best practices, and we are adapting our cyber risk strategy in an effort to mitigate emerging cybersecurity risks.

We maintain a risk-based process to assess and review the cybersecurity practices of our third-party vendors, as appropriate, based on the level of access which the vendor has to critical operations, our information technology systems, and personally identifiable information.

To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we have, from time to time, experienced threats and cybersecurity incidents relating to our information technology systems and infrastructure. Our third party vendors may also experience threats and cybersecurity incidents from time to time. For more information, please refer to Item 1A, “Risk Factors,” in this annual report on Form 10-K.

Governance Related to Cybersecurity Risk

Management is responsible for identifying, considering and assessing material risks for the business, including risks related to cybersecurity, on an ongoing basis. Our Chief Information Officer (“CIO”) is responsible for our overall IT strategy and operations, including the strategic direction of our cybersecurity program, cybersecurity risk oversight and monitoring of the prevention, detection, mitigation, and remediation of cybersecurity incidents. The individual serving as our CIO has over 10 years of experience in information security.

Our Board of Directors has delegated oversight of our cybersecurity risk management program to our Audit Committee, per the Audit Committee Charter. Our CIO provides quarterly updates to the Audit Committee regarding our cybersecurity risks and an annual enterprise risk management update, which includes updates on plans intended to enhance our overall cybersecurity posture, to the Audit Committee. The Audit Committee updates the full Board of Directors on matters relating to cybersecurity risk management as needed.