Sionna Therapeutics, Inc.

Cyber Risk Management and Strategy

We have implemented and maintain an information security program that includes processes for the identification, assessment, and mitigation of cybersecurity risks. We conduct periodic assessments of our assets as part of our risk management process and to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standards. Our cybersecurity risk management process is a part of our overall risk management program. We also have an employee education program that includes training designed to raise awareness of cybersecurity threats. We maintain an incident response plan that outlines the legal and governance process for identifying and managing material cyber risks to our information and information systems and our framework for assessing and responding to cyber incidents, as applicable.

Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we do, from time to time, experience threats and communicate security incidents relating to our and ourthird party vendors’ data and information systems. For more information about these risks, please refer to the section entitled “Risk Factors” in this Annual Report.

Governance Related to Cybersecurity Risks

Our head of information technology ("IT"), who reports to the Chief Financial Officer (collectively, "IT Leadership"), has primary responsibility for the strategic leadership and management of our cybersecurity program. Our head of IT has over 25 years of experience building and leading information technology and security teams. Our IT Leadership works alongside other functions to maintain and implement our cybersecurity strategy. Our IT Leadership meets as circumstances warrant with other members of our management, including executive leadership, to review and update incident response procedures and other aspects of our cybersecurity program.

The audit committee of Sionna's board of directors has ultimate oversight over cybersecurity risk. Our IT Leadership presents to the audit committee periodically regarding cybersecurity matters, including updates on security testing and assessments, cyber risks, and related cyber strategy, as applicable. The Chief Financial Officer and the Chief Legal Officer are responsible for informing the audit committee in the event of any material cybersecurity incidents and any potential disclosure obligations arising from such incidents. The audit committee will update the board of directors on matters related to cybersecurity as needed.