Annexon, Inc.

Risk management and strategy

We have implemented a risk-based approach designed to identify, assess and manage cybersecurity threats that could materially affect our business and information systems. Our cybersecurity program includes monitoring our threat environment through a combination of automated tools, manual reviews, subscribed threat‑intelligence updates, and third‑party cybersecurity assessments. These assessments include periodic vulnerability reviews and penetration testing performed by external service providers.

We leverage cybersecurity consultants and penetration testing firms in an effort to identify, assess, and manage material risks from cybersecurity threats. We also leverage other third-party service providers to support and maintain certain aspects of our business operations, such as cloud-based applications, platforms, and data hosting providers. To manage cybersecurity risks associated with these third-party service providers, we primarily engage with well-established and industry specialist service providers. Depending on the systems, level of access and type of data at issue, to maintain compliance with good data security management practices, we contractually require certain service providers with access to personal, confidential, or proprietary information to maintain security controls and follow applicable industry standards.

For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including “Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, or availability of our information technology systems or data, and those maintained on our behalf, could lead to adverse consequences that materially adversely affect our business, including, without limitation, regulatory investigations or actions, a material interruption to our operations, including clinical trials, damage to our reputation and/or subject us to costs, fines and penalties or lawsuits.”

Governance

Ourboard of directors addresses our cybersecurity risk management as part of its general oversight function. Theaudit committee is responsible for advising on our cybersecurity risk management processes, including oversight ofmitigation of risks from cybersecurity threats. Our management team is responsible forintegrating cybersecurity risk considerations into our overall risk management strategy.

Our cybersecurity program and day‑to‑day cybersecurity related operations are managed by our Head of IT, who works closely with external security advisors and our managed security service providers, or MSSP. Our Head of IT has more than 25 years of experience in information technology and reports to our CFO. The Head of IT meets periodically with the CFO to review cybersecurity risk management activities, discuss potential cybersecurity and information technology risks, and incorporate recommendations from our external technology and security providers. The Head of IT also meets regularly with our MSSP to help guide our monitoring and response processes and to inform reporting to management. Working with the CFO, the Head of IT provides periodic updates to the Audit Committee on cybersecurity and information technology matters, which assists our board of directors in reviewing and overseeing our risk management processes, including cybersecurity risks.

We maintain a cybersecurity policy which is reviewed periodically with the Audit Committee and outlines our approach to identifying, assessing, and managing cybersecurity risks. The policy includes defined escalation procedures that specify when and how cybersecurity incidents are reported to management and, depending on severity, to the Audit Committee. We also maintain incident response procedures designed to guide our actions in the event of a cybersecurity incident. These procedures outline the steps for evaluating, containing, and remediating incidents, and incorporate the use of external security resources when appropriate.