EXICURE, INC.

Our management recognize the importance of maintaining the security and resiliency of our cybersecurity environment to deliver on the expectations of our employees and investors. Overall, the purpose of our information security program is to protect the confidentiality, integrity and availability of our systems and data, along with the safe operation of our systems. Our current processes are limited and reflect the transitional state of our business and lack of resources. If and when our business evolves and we obtain additional resources, we would expect to adapt our processes accordingly.

Technical safeguards

We deploy technical safeguards that are designed to protect our systems from cybersecurity threats, including firewalls, anti-malware software, and authentication and authorization controls.

Third parties

Wedo not currently engage third parties with respect to our cybersecurity risk management processes due to our limited resources and operations.

Governance of Cybersecurity Risks

Pursuant to its charter, the Audit Committee of the Board has the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The Company’s Chief Executive Officer, President, and Chief Financial Officer are responsible for assessing and managing cybersecurity risks. Given our currently limited resources, we do not have dedicated personnel with specific cybersecurity expertise. When appropriate, the Company’s management will report on cybersecurity issues and presents information to our Audit Committee and/or our full Board on cybersecurity matters.

Material Impact of Cybersecurity Risks

We have not experienced a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.