Century Therapeutics, Inc.

Cybersecurity Risk Management and Strategy

At Century Therapeutics, we recognize the importance of information security practices designed to protect the confidentiality, integrity, and availability of Company information. We have implemented a cybersecurity program in accordance with our risk profile and business that is informed by recognized industry standards and frameworks, and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework.

Our cybersecurity risk management program includes multiple components, including information security assessments, penetration testing, response and vulnerability assessments, that are conducted periodically by both internal and external resources. We also conduct employee training and leverage third-party security tools, including but not limited to access controls, threat monitoring, and endpoint protection and response. We maintain asecurity operations center operated by a third party that collects cybersecurity threat data from multiple internal and external sources and determines if activity is potentially suspicious or malicious. We are in the process of developing and implementing additional cybersecurity policies and procedures.

We take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on the nature of the data accessed by the vendor. Currently, we review System and Organization Controls reports from vendors who have access to financial reporting information, and we are in the process of developing additional vendor risk management policies and procedures.

We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors experienced threats and security incidents that could affect our information or systems. For more information, please see Section 1A. Risk Factors.

Cybersecurity Governance

Our Head of Information Technology is responsible for the strategic leadership and direction of the Company’s cybersecurity management. The individual currently serving as the Head of Information Technology has over 20 years of experience working in information technology. The Head of Information Technology receives cybersecurity alerts from the Company’s third-party security operations center, and provides periodic updates to the Company’s executive committee, which includes the Company’s Chief Executive Officer, and Principal Financial Officer.

The Head of Information Technology also provides updates tothe Audit Committee of the board of directors approximately on a quarterly basis. The Audit Committee, pursuant to its charter, reviews significant existing and emerging cybersecurity risks, including material cybersecurity incidents if any, the impact on the Company and its stockholders of any significant cybersecurity incident and any disclosure obligations arising from any such incidents.