Corbus Pharmaceuticals Holdings, Inc.

We have processes for assessing, identifying and managing cybersecurity risks, which are informed by industry standards and are built into our overall information technology and cybersecurity functions. We maintain an internal information technology specialist who is responsible for the design, implementation, and operation of our information technology ecosystem and cybersecurity governance processes. We also engage with certain external parties, including consultants, computer security firms and risk management advisors, wherever appropriate, in an effort to enhance our cybersecurity oversight and risk management strategy. We conduct risk-based reviews of significant third-party vendors that support our information technology environment to assess whether they maintain appropriate cybersecurity and information security controls. Our Head of IT is responsible for managing the cybersecurity risk and reports to the Chief Financial Officer.

We are not currently aware of any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, other than those that are common to all businesses with internet connectivity, results of operations or financial condition. The audit committee of our board of directors (the "Board") provides oversight over cybersecurity risk and provides updates to the Board regarding such oversight, as needed. The audit committee receives periodic updates from management regarding cybersecurity matters and is notified of significant new cybersecurity threats or incidents occurring between such updates when management determines such matters to be significant and reportable.

To deter and detect cyber threats, we provide annual cybersecurity, data protection, and incident response training to employees, including part-time and temporary employees. This training addresses topics such as phishing and other social engineering threats, password management, confidential data protection, acceptable asset use, and mobile security, and emphasizes the importance of prompt reporting of suspected security incidents. We also deploy technology-based tools designed to mitigate cybersecurity risks and to complement our employee training and awareness programs.