BIODESIX INC

1C. Cyberse curity.

Risk Management and Strategy

Our business depends on the secure and continuous processing of information, supported by a resilient IT infrastructure and trusted critical vendors. Cybersecurity is a fundamental pillar of our risk management framework, seamlessly integrated into our decision-making at every level. Our IT department proactively identifies, evaluates, and mitigates cybersecurity risks to ensure alignment with our business objectives and operational needs. We maintain robust security policies and procedures, including comprehensive security and data privacy training for staff, stringent physical security measures, and advanced electronic data protection. Our cybersecurity program strictly adheres to HIPAA, GDPR, and applicable SEC cybersecurity disclosure and reporting requirements, incorporating strong data access controls, privacy safeguards, password protocols, encryption, and a structured incident response process with a formal and timely materiality assessment consistent with SEC reporting obligations.

Beyond policies, our network is fortified with a multi-layered defense strategy, including firewalls and advanced cyber-threat monitoring. We employ continuous vulnerability management and 24/7 extended detection and response (XDR) to continuously detect, analyze, and neutralize potential threats in real time. We recognize the importance of securing our extended digital ecosystem, including third-party service providers. To mitigate associated risks, we conduct rigorous security assessments before onboarding any third-party vendors, which require contractual cybersecurity and data protection obligations and perform ongoing, risk-based monitoring to ensure continuous compliance with our cybersecurity standards.

To further strengthen our security posture, we collaborate with independent external experts who conduct audits, penetration testing and threat assessments of our cybersecurity infrastructure. Through these evaluations and strategic consultations, we ensure that our security measures remain aligned with industry best practices. Our cybersecurity program is designed to safeguard the integrity, confidentiality, and availability of our critical information assets, supporting operational resilience and trust in our business.

Current Cybersecurity Risks

As of the date of this Annual Report on Form 10-K, the Company has not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company. In the event of a cybersecurity incident, the Company is equipped with a well-defined incident response plan. This plan includes immediate actions to contain and mitigate the impact, procedures to assess materiality in a timely manner, and long-term strategies for remediation and prevention of future incidents. See "Risk Factors— We may face additional costs, loss of revenue, significant liabilities, harm to our brand, decreased use of our products or services and business disruption if there are any security or data privacy breaches or other unauthorized or improper access."

Management and Board Oversight

Our management is responsible for day-to-day risk management activities. Our Board of Directors, acting directly and through its committees, is responsible for the oversight of our risk management. The Nominating and Governance Committee monitors our cybersecurity risk profile, receives quarterly updates from management on all matters related to cybersecurity, andreports to the full Board of Directors at least annually, or more often as appropriate. The Nominating and Governance Committee is composed of members with diverse expertise that allows it to oversee cybersecurity risks effectively.

Management is involved in assessing and managing material cybersecurity risks and incidents through dialogue with our Information Security Officer, who serves as the Company’s senior cybersecurity leader. Our Information Security Officer brings expertise to this role through his in-depth knowledge and experience in technology management and cybersecurity. Our Information Security Officer, as the Company’s senior cybersecurity leader, is continually informed about the latest developments in cybersecurity. This is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents, and allows him to regularly inform our Chief Executive Officer and Chief Financial Officer of any and all aspects of our business related to cybersecurity and information technology.

Our Chief Executive Officer, Chief Financial Officer and Information Security Officer regularly report to the Nominating and Governance Committee to ensure effective and efficient oversight of our cybersecurity threats and material risks, and to assist in proper risk management. Significant cybersecurity matters and strategic risk management decisions will be escalated from the Nominating and Governance Committee to the Board of Directors, ensuring that there is comprehensive oversight and the full Board of Directors can provide guidance on critical cybersecurity issues.