Vor Biopharma Inc.

Risk management and strategy

We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, and strategic or competitive in nature, and our clinical trial and related data (“Information Systems and Data”).

Our information security function, legal, and third-party service providers (collectively, the “Information Security Function”) help identify, assess, and manage the Company’s cybersecurity threats and risks. The Information Security Function identifies and assesses risks from cybersecurity threats by monitoring and evaluating the Company’s threat environment and risk profile using various methods and tools including, for example: manual and automated tools, subscribing to reports and services that identify cybersecurity threats, and evaluating threats reported to us. We have also initiated athird party threat assessment and are implementing ongoing monitoring and response services.

Depending on the environment, systems and data at issue, the Company implements and maintains technical, physical, and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These measures include, for example: incident detection and response, encryption of certain data, access and network security controls, data segregation, physical security, systems monitoring, employee training, and cybersecurity insurance. Our assessment and management of material risks from cybersecurity threats areintegrated into the Company’s overall risk management processes. This information is reviewed with the Company's extended leadership team and communicated to the audit committee of the board of directors, which evaluates the Company's risks relating to data privacy, technology and information security, including cybersecurity.

Our assessment and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management processes. Key cybersecurity risks are reviewed with the Company's extended leadership team and communicated to the Audit Committee of the Board of Directors, which evaluates the Company's risks relating to data privacy, technology and information security, including cybersecurity.

We leverage third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, external legal counsel, and dark web monitoring services. We maintain access to third-party forensic investigation services and may engage such services in connection with significant cybersecurity incidents. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

For a description of the risks from cybersecurity threats that maymaterially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including “If our information technology systems, or those of our third-party vendors, collaborators, or other contractors or consultants or other third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to a material disruption of our product development programs, regulatory investigations or actions, litigation, fines and penalties, reputational harm and other adverse consequences.”

Governance

Our Board of Directors addresses the Company’s cybersecurity risk management as part of its general oversight function. The Board of Directors’ Audit Committee is responsible for overseeing Company’s cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Head of Digital, Data and Technology, whooversees the Information Security Management System (ISMS) and Information Security Team. Our Chief Financial Officer is responsible for strategic leadership of our cybersecurity risk management program, hiring appropriate personnel, approving budgets, helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy, and communicating key priorities to relevant personnel. The Head of Digital role is currently held by an individual who has several years of professional IT management experience. He leads the operational and ISMS oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare employees and third-party service providers to address cybersecurity risks. We also have a Director of IT, who oversees our Infrastructure and Service Desk Department.

Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the General Counsel, the Chief Financial Officer, and the Chief Executive Officer. The Company’s information technology department and managed service partners work with the Company’s incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company’s incident response plan includes reporting to the Audit Committee of the Board of Directors and the chair of the Board of Directors for certain cybersecurity incidents. The Audit Committee of the Board of Directors periodically receives summaries or presentations from management concerning the Company’s significant cybersecurity threats and risk and the processes the Company has implemented to address them.