GRAIL, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025

Item 1C. Cybersecurity

Risk Management and Strategy

Given the importance of cybersecurity to our business, we maintain a cybersecurity program to help support the effectiveness of our systems, and our preparedness for cybersecurity risks, and our protection of the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is part of our overall risk management program and shares similar governance processes and reporting channels that apply across the risk management program to financial, legal, compliance, and other operational risk areas. Our program is informed by industry frameworks, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0 ("NIST CSF 2.0"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use frameworks such as NIST CSF 2.0 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

We also require cybersecurity trainings when onboarding new employees and contractors, as well as annual cybersecurity awareness training for our employees and contractors.

We use our Enterprise Risk Management ("ERM") process to assess and manage cybersecurity risks that may be associated with our systems, operations, and third-party service providers. We conduct internal audits and engage external assessors to help review our cybersecurity program and identify opportunities for maturing our program. For additional information, see "Item 1A. Risk Factors".

Identifying, assessing and managing cybersecurity risks

Our cybersecurity team and the owners of information technology systems across the business, led by our Chief Security Officer ("CSO") and Vice President, Security ("VP, Security"), monitor current events and trends related to cybersecurity in an effort to anticipate potential risks and threats on current systems and operations. We have implemented and continue to develop various processes to identify, review and track risks to our systems and operations, including through the use of third-party solutions and penetration testing of our systems. We have policies and procedures for performing cybersecurity risk assessments of our third-party service providers that may have access to our systems, data, facilities, or that otherwise perform services on our behalf and for conducting due diligence in connection with the onboarding of new third-party vendors.

As a core component of our enterprise risk management strategy, we maintain a rigorous cybersecurity program that is periodically evaluated through internal assessments and independent third-party audits. We perform comprehensive maturity assessments against the NIST CSF2.0 and the NIST Privacy Framework. These strategic reviews complement our sustained compliance posture, which includes recurring annual audits for ISO/IEC 27001, SOC 2 Type 2, PCI DSS, UK Cyber Essentials and HIPAA.

We leverage these assessments to identify functional gaps and benchmark our cybersecurity program against applicable regulatory requirements. The resulting findings are integrated into a formal Remediation Roadmap designed to mature our security posture and drive continuous improvement. By integrating findings from both internal evaluations and independent external audits, we foster a culture of continuous improvement and operational resilience. Recognizing that the human element is a critical line of defense, we maintain a robust cybersecurity awareness program. This initiative equips our employees and contractors to recognize and mitigate evolving threats through continuous education and regular phishing simulation exercises designed to reinforce vigilant behavior. Our process also includes initial due diligence, ongoing monitoring, and periodic reassessments of our third-party service providers.

In the event of a cybersecurity incident, we have an incident response framework that includes defined escalation procedures, cross-functional coordination protocols, regulatory notification assessment procedures, and post-incident review processes. We also periodically conduct cross-functional exercises and activities to help detect, assess and respond to cybersecurity incidents, and have relationships with external providers to assist with incident response efforts, as needed. We also seek to contractually require our third-party service providers to notify us in the event a cybersecurity incident within their systems or services impacts our data or operations. We maintain specific coverage to help mitigate losses associated with certain cybersecurity incidents that impact our or our third parties' systems, networks and technology.

As of December 31, 2025, we have not identified any risks from cybersecurity threats , including as a result of any previous cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We assess materiality based on quantitative and qualitative factors, including potential impact to our operations, financial condition, intellectual property, regulatory compliance obligations, and reputation. While we maintain a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see Item 1A. "Risk Factors –Our information technology systems, or those used by our third-party collaborators or other contractors or consultants, may fail or suffer cybersecurity incidents or cyberattacks".

Cybersecurity Governance

Our Board of Directors administers its cybersecurity risk oversight function through its Audit Committee. The Audit Committee is charged with reviewing our cybersecurity and other information technology risks, controls, and procedures, including our processes to mitigate cybersecurity risks and respond to data or cybersecurity incidents. The Audit Committee is also charged with reviewing cybersecurity issues with management that could affect the adequacy of our internal controls. The Audit Committee meets periodically, and at least annually,with the CSO and/or VP, Security and the executive leadership team and receives a report on our cybersecurity program, posture, risks and other matters. At least annually, we conduct an organization-wide ERM process to evaluate key risks in different areas of the business including cybersecurity. During that process, cybersecurity risks are identified, and scores representing the potential likelihood and severity of each risk are determined. The executive leadership team and Audit Committee receive a direct report of the ERM program findings, including these cybersecurity risks and incidents it considers to be significant or potentially significant. Third-party assessors, consultants, counsel or other parties also participate in Audit Committee discussions as needed.

More broadly, the Audit Committee reviews our policies and practices with respect to risk assessment and risk management, including results from our overall ERM review, and discusses with management our major risk exposures and the steps that have been taken to monitor and control such exposures. Cybersecurity is a key piece of our overall ERM program. The Audit Committee oversees the activities of, and meets regularly with, our Chief Compliance Officer, and receives direct reports from the Chief Compliance Officer regarding the ERM structure and activities of our compliance program, including updates on training, policies, auditing and monitoring, investigations and any corrective and preventive actions . As part of the ERM program, our Chief Compliance Officer gathers information about cybersecurity risk, and that information is included in the Chief Compliance Officer's report to the Audit Committee.

Our cybersecurity team and information technology system owners across the business are led by our CSO and VP, Security. Our CSO has over five years of tenure with the Company and more than 29 years of experience in technology, including 15 years in cybersecurity. He previously served as Chief Technology Officer at NextBio and as Vice President of Software Engineering, Enterprise Informatics at Illumina, Inc. He is supported by a cybersecurity organization comprising experts in strategy, governance, risk management, compliance, engineering, security operations, and incident response, including our VP, Security who has over two decades of specialized experience in cybersecurity and privacy. The CSO is responsible for implementing and overseeing the controls and processes employed to identify, assess and manage the Company's risks from cybersecurity threats. We also maintain a Privacy and Security Steering Committee that regularly meets to review and discuss cybersecurity issues and review our cybersecurity-related metrics. The Privacy and Security Steering Committee is composed of the VP, Security, Chief Privacy Officer, Chief Compliance Officer, and other representatives from our cybersecurity, IT, legal, and privacy teams. The VP. Security, cybersecurity team, and members of the Privacy and Security Steering Committee combined have decades of experience in managing relevant information technology and cybersecurity matters. The VP, Security also provides regular briefings to our executive leadership team, including the CEO and CFO, and our Audit Committee on cybersecurity matters, such as threats, events, and the state of the program, and at least annually as part of our ERM process.

Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from IT personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.