Exagen Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025

Item 1C. Cybersecurity.

We recognize the critical importance of maintaining the trust and confidence of physicians, patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by NIST and other applicable industry standards, as well as the HIPAA Security Rule and other recognized frameworks. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

Cybersecurity Risk Management and Strategy; Effect of Risk

We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats in addition to other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, and penetration testing to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our Audit Committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Vice President of Information Services.

We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST, as well as performing intrusion detection and prevention. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities:

a. monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;

b. through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;

c. employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;

d. provide regular, mandatory training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;

e. conduct regular phishing email simulations for all employees with access to our email systems to enhance awareness and responsiveness to possible threats;

f. conduct monthly cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;

g. leverage internal and external resources to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and

h. carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident

Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. As part of the above processes, we rely on internal resources rather than consultants, auditors or other third parties, to review our cybersecurity program.

Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data.

We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " Failure in our information technology, telephone or other systems could significantly disrupt our operations and adversely affect our business and financial condition ," which disclosures are incorporated by reference herein.

Cybersecurity Governance; Management

Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our Audit Committee to oversee risks from cybersecurity threats.

Upon detection of a material cybersecurity threat, our Audit Committee receives an update from management of the cybersecurity threat, risk management and strategy processes, as well as the steps management has taken to respond to such risks. In such sessions, our Audit Committee generally receives materials that include cybersecurity materials discussing current material cybersecurity threat risks, and describing our ability to mitigate those risks, and discusses such matters with our Chief Executive Officer. Our Audit Committee and board of directors receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.

Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President of Information Services, with support from our entire Information Services department. Such individuals have collectively over 10 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications. These Information Services team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these Information Services team members report to our Chief Executive Officer, and ultimately to the Audit Committee of our board of directors about material cybersecurity threats.

Item 1C. Cybersecurity.

We recognize the critical importance of maintaining the trust and confidence of physicians, patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by NIST and other applicable industry standards, as well as the HIPAA Security Rule and other recognized frameworks. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

Cybersecurity Risk Management and Strategy; Effect of Risk

We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats in addition to other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, and penetration testing to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our Audit Committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Vice President of Information Services.

We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST, as well as performing intrusion detection and prevention. To provide for the availability of critical data and systems, maintain

regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities:

a. monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;

b. through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;

c. employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;

d. provide regular, mandatory training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;

e. conduct regular phishing email simulations for all employees with access to our email systems to enhance awareness and responsiveness to possible threats;

f. conduct monthly cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;

g. leverage internal and external resources to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and

h. carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident

Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. As part of the above processes, we rely on internal resources rather than consultants, auditors or other third parties, to review our cybersecurity program.

Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data.

We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " Failure in our information technology, telephone or other systems could significantly disrupt our operations and adversely affect our business and financial condition ," which disclosures are incorporated by reference herein.

Cybersecurity Governance; Management

Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our Audit Committee to oversee risks from cybersecurity threats.

Upon detection of a material cybersecurity threat, our Audit Committee receives an update from management of the cybersecurity threat, risk management and strategy processes, as well as the steps management has taken to respond to such risks. In such sessions, our Audit Committee generally receives materials that include cybersecurity materials discussing current material cybersecurity threat risks, and describing our ability to mitigate those risks, and discusses such matters with our Chief Executive Officer. Our Audit Committee and board of directors receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.

Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President of Information Services, with support from our entire Information Services department. Such individuals have collectively over 10 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications. These Information Services team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these Information Services team members report to our Chief Executive Officer, and ultimately to the Audit Committee of our board of directors about material cybersecurity threats.