Foghorn Therapeutics Inc

Risk Management and Strategy

We have established an enterprise risk management program, with cybersecurity representing a relevant component of our overall approach to risk management. The cybersecurity portion of our risk management program shares common methodologies, reporting channels and governance processes that apply across the program to other legal, compliance, strategic, operational, and financial risk areas. In general, we seek to address cybersecurity risks through a data security framework that is focused on information classification and location, access and acceptable use controls, alerts and protections, vendor risk assessment, and backup and recovery. We engage third parties to perform assessments of our cybersecurity measures, including tabletop exercises, penetration testing, and other cybersecurity audits. As part of our cybersecurity risk management procedures, we also have a third-party cyber risk management process for service providers, suppliers, and vendors. Additionally, we provide regular, mandatory training for all employees regarding cybersecurity threats.

As of the date of this Annual Report on Form 10-K, we have not experienced a cybersecurity incident or other threats that resulted in a material effect on our business strategy, results of operations, or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.

Governance

Our Board of Directors and Audit Committee oversee our enterprise risk management process, including the management of risks arising from cybersecurity threats. On at least an annual basis, the Board of Directors and Audit Committee receive presentations and reports on cybersecurity risks from our Vice President of Information Technology, which may address topics including our overall assessment of cybersecurity risks, compliance with cybersecurity policies and procedures, third-party test results, the current threat environment, and technological trends and information security considerations arising with respect to our peers in the biotechnology space. The Board and Audit Committee also receive ad hoc reporting as appropriate. Our Vice President of Information Technology, who reports to our Chief Strategy and Business Operations Officer, is primarily responsible for assessing such risks. This individual has over 20 years of information technology and cybersecurity experience in the biotechnology industry.