Prime Medicine, Inc.

Risk Management and Strategy

Our cybersecurity risk management program is a significant part of our overall risk management program. Teams of internal andthird-party cybersecurity professionals oversee cybersecurity risk management, which incorporates elements of the National Institute for Standards and Technology Cybersecurity Framework.

We also maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats. We also have a process in place to oversee and assess our third party resources, including, for critical vendors and as appropriate, through reviews of Service Organization Control Type 2 reports.

We maintain an ongoing end-user cybersecurity awareness program that is designed to raise awareness of cybersecurity threats to reduce our vulnerability as well as to encourage consideration of cybersecurity risks across functions, including quarterly training and simulated phishing campaigns.

Although we have not experienced a material cybersecurity incident, like other organizations in our industry, we face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. For more information about the cybersecurity risks we face, see the section entitled “Risk Factors — Risks Related to Information Technology and Data Privacy.”

Oversight and Governance

Members of our senior management, including our Chief Executive Officer and leaders from our legal and information technology functions, maintain responsibility for assessing and managing cybersecurity threats. This team has deep expertise in building and leading information systems and cybersecurity teams across a variety of institutions. Our head of information technology has approximately 20 years of information security experience.

Cybersecurity risk governance has been delegated by our board of directors to the audit committee of the board of directors, or the audit committee. As provided in the audit committee charter, the audit committee is responsible for reviewing, assessing, and considering, in consultation with management and our board of directors, as appropriate, the overall risk management policies and procedures of the Company, including our major risk exposures such as cybersecurity.

The audit committee and board of directors receive routine updates from senior management, including leaders from our information technology and legal functions regarding matters of cybersecurity. These updates include existing and new cybersecurity risks, status on how management is addressing and mitigating those risks, cybersecurity and data privacy incidents, if any, and status on key information security initiatives.