Cabaletta Bio, Inc.

Cyber Risk Management and Strategy

We, under the oversight of the audit committee of our board of directors, have implemented and maintain a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats. Our risk management is supported by various tools and technologies, including third-party security solutions, monitoring, and alerting tools, designed to monitor, identify, and address risks from cybersecurity threats.

Weengage with other third-party providers and consultants to support our cyber risk management efforts, including through periodic security testing and assessments. We have a process to assess certain major third-party vendors and service providers, including through a review of responses to compliance questionnaires and contractual requirements, as appropriate.

We, like other companies in our industry, face a number of risks from cybersecurity threats in connection with our business. Although such risks have notmaterially affected, and we do not believe they are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our data and systems. For more information about the risks from cybersecurity threats we face, please see Item 1A- Risk Factors.

Governance Related to Cybersecurity Risks

Our board of directors, as a whole and through its committees, has responsibility for the periodic review and oversight of information technology risks, including risks from cybersecurity threats.

The audit committee is responsible for oversight of our cyber risk management program. The day-to-day management of the cyber program is directed by the Director of IT under the direction of the Chief Financial Officer. Currently, the Director of IT reports to the Chief Financial Officer and provides periodic updates to the Chief Financial Officer on cyber matters.

The Director of IT meets with the Chief Financial Officer periodically to discuss and review our cybersecurity risk management processes and to address matters related to potential cybersecurity and information technology risks, with input from the Company’s third-party technology providers, as appropriate. The Chief Financial Officer provides periodic reports on cybersecurity and information technology matters to the audit committee, which is responsible for reviewing and overseeing the Company’s risk management process, including risks from cybersecurity threats, as set forth in the audit committee charter. The audit committee periodically reports on cybersecurity risk management to the full board of directors.