Clene Inc.

Overview

Our cybersecurity policies and procedures have been developed to ensure an adequate and consistent approach to the management, control, and protection of our information (“Information Assets”). Our Information Assets include business information, customer information and external business partner information, including, without limitation, classified information, information relating to research, intellectual property, personally identifiable information, business and product development, clinical test and evaluation data, and business plans, customer and supplier information, supply chain, manufacturing, distribution, finance, human resources, consulting, partnerships, contracts, and corporate transactions, maintained in any form or format or location, including audio, video, paper, magnetic, electronic and optical.

87

Device and Network Security

Our device and network security policies and procedures are designed to mitigate risk by ensuring our network and computing devices (“Computer Equipment”), electronic systems, and resources used in our business (“Information Systems”), whether owned or leased by us, our employees, orthird parties, and the Information Assets contained therein, are protected from security threats.

To mitigate risk, we utilize (i) firewalls, (ii) anti-malware software, (iii) device and environment monitoring, (iv) device scanning, alerts, and reporting, (v) identity and access management, (vi) physical security, (vii) security and application lifecycle security, (viii) security updates and backups, and (ix) vulnerability and risk assessments.

Security Incident Reporting

Our security incident reporting policy and procedures enable the identification, monitoring, reporting, and response capabilities to known or suspected security incidents in our network and all IT-managed services and Information Systems. Security identification begins with a broad range of potential risks, including, butnot limited to, theft or unauthorized disclosure of Information Assets, unexpected modification of Company Information Assets, disruptions of service that can result in Information Assets being unavailable for an unacceptable amount of time, and suspicious behavior and/or unauthorized activity by any individual or organization that can potentially compromise Information Assets or Information Systems.

Our process to monitor, report, and respond to identified or suspected security incidents includes (i) collection of relevant information about an incident, including (a) impacted systems, (b) impacted entities, (c) protection mechanisms that were in place and active at the time of the security incident, (d) audit logs, and (e) the risk classification of the Information Assets that were potentially impacted; (ii) reporting to a centralized ticketing system; (iii) reporting to management and other authorities, such as legal, human resources, IT, and local and/or state law enforcement, etc.; (iv) escalation, if the incident is considered to be critical based upon our assessment of its potential impact, to appropriate management and directors and other authorities; and (v) documentation of the incident and our response actions taken.

Change and Configuration Management

Our change and configuration management policy and procedures enable the effective management of changes to Information Systems (“Changes”) to ensure the confidentiality and integrity of Information Assets and the continued availability of both the Information Systems and IT services. The policies and procedures apply to all changes to Information Systems managed by the Company or its IT external business partners. Our change and configuration management includes: (i) authorization, (ii) impact assessments, (iii) the use of test environments, (iv) quality and user-acceptance testing, (v) documentation, and (vi) error resolution.

Information Asset Protection

Our Information Asset protection policy and procedures enables the management, control, and protection of Information Assets from unauthorized disclosure, theft, loss, destruction, unauthorized alteration, unauthorized access, and the denial of availability, all of which could have a direct and significant impact on the future success of the Company. Protection of Information Asset supports the efficient and effective management, control, and protection of our business information and the business information entrusted to us by our customers and external business partners. All Information Asset protection policies and procedures must also be viewed in the context of our obligations to comply with government requirements, such as those related to the protection of personal data, and compliance with our contractual obligations.

We use the following approach to manage risks related to Information Asset protection: (i) identification and classification of Information Assets, (ii) identification and assessment of the threats to those Information Assets and the associated risk based upon impact to the business and the likelihood of their occurrence, (iii) assessment and analysis of risk, and determination of the actions required to lower risks to an acceptable level, (iv) implementation of appropriate controls or management acknowledgment of risk where controls cannot be implemented, (v) continuous monitoring and measuring of risk, (vi) ongoing communication of risks and mitigating actions, and (vii) auditing for compliance.

88

Governance

Assessing, identifying, and managing cybersecurity related risks are integrated into our overall risk management program. Our CEO, General Counsel, and Vice President of Quality and Technical Operations (“VP of Quality”) directly oversee the development, implementation, operation, and revision of our cybersecurity policies and procedures, and are primarily responsible for the oversight of risks from cybersecurity threats and any security incidents that may occur. These officers have more than 27 years of combined experience in managing IT, operations, and information risk and security. Our VP of Quality has experience developing comprehensive information security programs for organizations, and brings extensive experience in the private sector and is a specialist in IT governance strategies, risk management protocols, and compliance frameworks. All security incidents are managed by our VP of Quality and reported to management, including our CEO, General Counsel, and other personnel based upon the specifics of the incident and its impact. Additionally, if a known or suspected security incident occurs at the Company, based upon its risk classification and if we assess the impact to be critical, the incident is escalated in a timely manner to the Audit Committee of the Board of Directors for oversight of the monitoring, reporting, and response process. The Audit Committee also oversees the implementation of our policies and procedures to prevent or reduce cybersecurity risks on an ongoing basis during the performance of its general committee duties.

We face a number of cybersecurity risks in connection with our business and have from time-to-time experienced cybersecurity incidents, which to date have not had a material impact on our financial condition or results of operations. For more information about the cybersecurity risks we face, see Item 1A—Risk Factors “Our internal computer systems, or those used by any CROs or other third-party contractors or consultants we may engage, may fail or suffer security breaches.”