OS Therapies Inc

Cybersecurity Governance

Ourboard of directors has the ultimate oversight responsibility for the risk management process and regularly reviews issues that present particular risk to us, including those involving cybersecurity. Our board is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which we are exposed and implement processes and programs designed to manage cybersecurity risks and mitigate and remediate cybersecurity threats and incidents.

Our management is responsible foridentifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. In managing cybersecurity risks, we adhere to a structured framework that outlines the roles and responsibilities of management positions and committees.

Cybersecurity Risk Management and Strategy

We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, and financial information (“Information Systems and Data”). Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the cybersecurity program works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

The cybersecurity program within our company helps identify, assess and manage our cybersecurity threats and risks. Our cybersecurity program identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual tools, internal or external audits, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, and evaluating threats reported to us. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data.

We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms.** **We also use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We manage cybersecurity risks associated with our use of these providers by reviewing their security assessments and applicable reports.

We arenot aware of any risks from cybersecurity threats, including because of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how we may do so, see our risk factors under “Item 1A. Risk Factors.”