Monte Rosa Therapeutics, Inc.

Cybersecurity Risk Management and Strategy

We have implemented a cybersecurity risk management program, in accordance with our risk profile and business size, that is designed to detect, identify, assess, and respond to current and emerging cybersecurity threats. Ourcybersecurity risk management program is supported by third-party information technologiesand vendors, including a managed services provider that assists us with, among other things, information technology system monitoring, detection, and response support services. We also leverage third-party information technology service providers to monitor and evaluate our cybersecurity posture through vulnerability scans, penetration tests, and cybersecurity risk reviews and assessments. Our cybersecurity risk assessments are informed by industry standards and frameworks and incorporate elements of the same, including elements of the National Institute of Standards and Technology (NIST) cybersecurity framework.

We have adopted an incident response plan designed to coordinate the steps to identify, contain, eradicate, and recover from cybersecurity incidents. We have a process requiring newly hired employees to participate in security awareness training and we conduct periodic phishing email simulations. We also have a risk-based process to review certain third-party information technology service providers and vendors, including through contractual requirements and proactive threat intelligence monitoring, as appropriate.

To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Like other companies in our industry, we and our third-party information technology service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, “Risk Factors,” in this annual report on Form 10-K.

Governance

Our Head of Information Technology, or IT, with the support of our third-party information technology service providers and a team of IT professionals, is responsible for the strategic leadership and day-to-day management of our cybersecurity program, including the prevention, detection, mitigation, and remediation of cyber incidents. The individual serving as Head of IT has more than twenty-five years of experience in information technology and information security.

Our Board of Directors has delegated oversight of our cybersecurity risk management program to our Audit Committee, per the Audit Committee Charter. Our Head of IT provides quarterly updates to the Audit Committee regarding our cybersecurity risk management program, including information about cybersecurity risk management governance, and provides the Audit Committee with status updates on various projects intended to enhance the overall cybersecurity posture of the Company, as applicable.