GLAUKOS Corp

Risk Management and Strategy

We recognize the importance of maintaining the security of our information systems and assets, and have several cybersecurity processes and controls designed to identify, assess and manage the risks associated with cybersecurity threats and cybersecurity incidents.

Risk Management Systems and Processes

Our cybersecurity risk management program encompasses periodic risk assessments, designed to help identify cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment. To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk management program is administered by the Company’s legal and internal audit functions, and includes, among other risks, the process of identifying and assessing cybersecurity threat risks, as well as monitoring the effectiveness of our associated risk mitigation efforts. During the year, our senior management periodically identifies cybersecurity risks facing the Company and reviews our mitigation plans related to these risks. These senior leaders conduct an evaluation of the severity of these identified risks and any changes to the risk level or the Company’s mitigation efforts since the prior evaluation. The severity of risks is measured based upon the potential adverse impact that could result, the immediacy of the threat and the availability of mitigating factors, among other elements. Management may engage outside consultants, such as legal counsel or cybersecurity advisors, in assessing risks and developing mitigation plans.

We also have specific cybersecurity risk assessment processes which help identify our cybersecurity threat risks, including a comparison of our processes to industry standards as well as periodic third-party assessments of our programs. We compare our Information Security Program with industry standards including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO 27001. In order to enhance internal expertise, members of our Global Technology Systems (GTS) department maintain various cybersecurity-related certifications. We also maintain written incident response and security policies that seek to ensure we are protected and ready to respond should a security incident occur. Our incident response plan coordinates the activities we would take to respond to and recover from cybersecurity incidents, which include processes to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate potential liability and reputational damage. Based on established criteria, incidents may be reported to senior management, the Audit Committee or the full Board.

To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, we undertake the activities listed below:

•

closely monitor emerging laws, regulations and implement responsive changes to our processes;

•

conduct annual cybersecurity training for all employees and contractors who use our systems;

•

conduct regular email phishing testing exercises for all employees to enhance awareness and responsiveness to such possible threats;

•

require employees, as well as contractors who have access to our systems or the data of our employees, customers or patients, to treat information as confidential;

•

perform internal audits of cybersecurity processes, including reviews of logging and monitoring practices and the patch management process;

•

conduct tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our preparedness, processes, technologies and incident response plan; and

•

carry cyber risk insurance that provides protection (as specified in the applicable policies) against certain potential costs and losses arising from a cybersecurity incident.

Engagement of Third Parties

As part of the above processes, we regularly engage with assessors, consultants, and other third-parties to review our cybersecurity program. These reviews are intended to evaluate the effectiveness and robustness of the security measures implemented in our networks and information systems, identifying potential vulnerabilities, performance improvements, and recommended improvement strategies. These security assessments may focus on key areas such as user access controls, data encryption processes, auditing and monitoring of database activities, system and server configuration and updated procedures.

Threats from Third Party Service Providers

Our processes also address cybersecurity threat risks associated with our use of third-party software and service providers. Third-party risks are included within our enterprise risk management assessment program, which is discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on any high-risk third-parties that provide us software or have access to our systems or highly sensitive information, and monitor cybersecurity threat risks identified through such diligence. We formed a Software Approval Board, which is made up of cross-functional members from Quality, Internal Audit, Information Security, Business Systems, and R&D, to help determine risk and impact of any potential newly proposed software before purchase or installation on our systems. Additionally, we require third parties with access to sensitive systems or data to agree by contract to manage their cybersecurity risks in specified ways. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

Material Impact of Cybersecurity Threats or Incidents

We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading “Risks Related to our Business,”

included as part of our risk factor disclosures at Item 1A of this Annual Report, which disclosures are incorporated by reference herein.

We arenot aware of any material cybersecurity incidents that have occurred in the last three fiscal years, and the expenses we have incurred from cybersecurity incidents were immaterial, including penalties and settlements, of which there were none.

Governance

Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.

Board Oversight

The Audit Committee of our Board is responsible for the oversight of risks from cybersecurity threats. At least twice a year, the Audit Committee receives a report of our cybersecurity threat risk management and mitigation strategy covering topics such as information security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and potentially material cybersecurity threat risks or incidents should one occur, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives information describing current and emerging material cybersecurity threat risks, and describing the Company’s plans to mitigate those risks, and discusses such matters with our head of Information Security, Vice President of GTS and other members of senior management. Potential material cybersecurity threat risks are also considered during separate Board discussions of important matters like enterprise risk management. Two members of our Board, including one member of the Audit Committee, have earned cybersecurity certifications to help them identify cybersecurity threats and oversee management’s efforts to manage and mitigate them.

Management Oversight

While the Audit Committee reviews and oversees the Company’s risks from cybersecurity threats, senior leadership is responsible for the day-to-day management of cybersecurity risk and the design and implementation of policies, processes and procedures to identify and mitigate this risk. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Legal department and our Internal Audit department, working with our GTS department. Members of this team include our fractional Chief Information Security Officer, our Head of Internal Audit and Cyber Security Engineer. Our fractional Chief Information Security Officer is a Certified Information Systems Security Professional (CISSP), as well as a member of ISACA and ISC2 industry organizations with over 25 years of experience in this field. Our head of Internal Audit is a Certified Information Systems Auditor (CISA) as well as a member of ISACA and has held leadership roles in internal audit and risk for 20 years. Our Cyber Security Engineer is a CISSP and a member of ISC2 with 10 years of related experience in this field. Members of senior management areinformed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.