What Astera Labs, Inc. tells the SEC about who runs cybersecurity

Item 1C. Cybersecurity

Risk Management and Strategy

We have established policies and processes designed to identify, assess, and mitigate cybersecurity risks. These policies and processes are intended to protect the confidentiality, integrity, and availability of our critical information systems and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature. They include the deployment of third-party security solutions and tools designed to monitor, identify, and address cybersecurity risks, as well as the development of an incident response plan informed by the National Institute of Standards and Technology ("NIST") framework that is designed to identify and manage significant events that may impact our information technology infrastructure, including those arising from or related to cybersecurity threats. As part of our cybersecurity risk management, we conduct periodic risk assessments designed to identify reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. We also maintain risk-based processes to assess and review the cybersecurity practices of certain of our third-party vendors and services providers prior to onboarding, including through review of System and Organization (SOC) reports provided by potential vendors and the inclusion of security requirements in contracts, as appropriate. Employees are required to complete annual cybersecurity awareness training designed to raise awareness of cybersecurity threats. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future.

For more information about the risks from cybersecurity threats, see the risk factors entitled " Cybersecurity risks, including cyber-attacks, data breaches, and system vulnerabilities could adversely affect our business and disrupt our operations " and " An impairment of the confidentiality, integrity, or availability of our IT systems, or those of one or more of our IT vendors could have a material adverse effect on our business ."

Governance

Our board of directors ("Board") considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Audit Committee of the Board (the "Audit Committee") oversight of cybersecurity matters, cybersecurity risk management, disclosure obligations with respect to cybersecurity incidents, and compliance with SEC rules applicable to cybersecurity risk management.

The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management will update the Audit Committee, as necessary, regarding any significant cybersecurity incidents. The Audit Committee regularly reports to the full Board regarding its activities, including those related to cybersecurity risk.

Our Chief Executive Officer is currently serving as interim Chief Information Security Officer ("CISO") while we conduct a search for a successor following the departure of our CISO in January 2026. Our CISO , in connection with our IT personnel, is responsible for day-to-day implementation, management and evaluation of our cybersecurity risk assessment and management processes. This team has primary responsibility for our overall cybersecurity risk management program, including monitoring the detection, prevention, mitigation, and remediation of cybersecurity incidents, and works in partnership with our other business leaders, including our Chief Financial Officer and General Counsel. Our CISO supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our interim CISO has over two decades of engineering and general management experience in various technical roles, including oversight of functions into which the CISO reported. Our interim CISO was also previously responsible for setting up our IT and our IT security from its founding until June 2022.

Our cybersecurity incident response process is designed to escalate significant cybersecurity incidents to a team of business leaders, including, but not limited to, our Chief Financial Officer and General Counsel. In the case of a cybersecurity incident, this team of business leaders will work with our incident response team to help determine the severity of the impact of a cybersecurity incident, as well as to help mitigate and remediate cybersecurity incidents of which they are notified. The incident response team will also work under the oversight of legal counsel and the Audit Committee to determine whether an incident is material for disclosure purposes under applicable law.