PALVELLA THERAPEUTICS, INC.

Cybersecurity Risk Management and Strategy

In recognition of the evolving cybersecurity threat landscape, we acknowledge the increasing sophistication and frequency of cybersecurity incidents. While we cannot completely protect against the possibility of a cybersecurity incident occurring, we take measures designed to mitigate risks from cybersecurity threats, including those implemented by our third-party managed services provider.

As part of our cybersecurity procedures, we leverage a number of security controls, including network and device monitoring and system backup procedures. We work to mitigate risks from cybersecurity threats stemming from third-party vendors by providing them with access only to systems that they need to provide services to us.

We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information, please see “Item 1A, Risk Factors.”

Cybersecurity Governance

Senior management, including the Chief Executive Officer and Chief Financial Officer, are responsible for implementation of the Company’s risk management controls, including controls in connection with risks from cybersecurity threats.

The Audit Committee of our Board of Directors is primarily responsible for overseeing the Company's compliance and risk management obligations, including the management of risks from cybersecurity threats. Pursuant to its charter, the Audit Committee is responsible for monitoring the effectiveness of the Company’s information system and cybersecurity controls.

On a quarterly basis, the Audit Committee discusses with senior management, and internal audit, if applicable, the Company’s processes for assessing, identifying, and managing material risks from cybersecurity threats and the state of the Company’s cybersecurity processes. The Audit Committee also receives updates on, and monitors, the Company’s prevention, detection, mitigation and remediation of cybersecurity incidents.