Aura Biosciences, Inc.

Cybersecurity Risk Management and Strategy

We have implemented cybersecurity risk management procedures, in accordance with our risk profile and business size, that are designed to identify, assess, and mitigate risks from current and emerging cybersecurity threats. Our cybersecurity procedures, which are informed by the National Institute of Standards and Technology cybersecurity framework, are supported by a third-party managed services provider that assists us in managing our information technology systems.

Our cybersecurity procedures are comprised of a variety of tools designed to protect our data and information technology systems, including but not limited to endpoint protection and network security measures, that are supported by our third-party service providers. We also have a process to require our employees to undergo cybersecurity awareness training. Further, we have a process to review risks to our company in connection with certain third-party providers and vendors, as appropriate.

To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party information technology service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, see, “Risk Factors,” in this Annual Report on Form 10-K.

Cybersecurity Governance

Our cybersecurity program is managed and directed byour Head of Information Technology, or IT, who has nearly thirty years of experience in information technology and information systems management. Our Head of IT reports to our Chief Legal Officer and Secretary. Our Cybersecurity Governance Team, which is made up of representatives from across the organization, is responsible for oversight of cybersecurity risks and addressing potential cybersecurity risks to business programs, employees, clients, vendors and partners.

Our Board has delegated oversight of our cybersecurity risk management program to our Audit Committee, per the Audit Committee charter. Our Head of IT provides periodic updates to the Audit Committee regarding our cybersecurity risk management program, including information about cybersecurity risk management governance, as well as status updates on plans intended to enhance the overall cybersecurity posture of our company, as applicable. In the event of a cybersecurity incident, we have established a process for escalation to the Audit Committee as well as our Board, as appropriate.