Company: VEEV
Filing Date: 2025-03-24
Form Type: 10-K
Source: 0001393052-25-000022
Chunk: 533

Company: VEEVA SYSTEMS INC
Filing Date: 2025-03-24
Form: 10-K
Item: Item 1C
Chunk 533
---
ITEM 1C.    CYBERSECURITY.

We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

Veeva Systems Inc. | Form 10-K31

Table of Contents

Governance

Our board of directors formed a Cybersecurity Committee to exercise oversight over our cybersecurity and privacy programs and controls for our products and our internal-use information technology. The Cybersecurity Committee is chaired by a director with cybersecurity expertise and board and executive experience at large technology companies. The Cybersecurity Committee receives reports from management on a regular basis on a range of topics, including the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives, incident reports from cybersecurity and privacy events, data privacy policies and procedures, and compliance with regulatory requirements and industry standards. 

Our day-to-day cybersecurity and technology risk management efforts, including oversight of our information security management system, are led by our EVP of Internal Operations, a member of our executive leadership team with over three decades of experience in the field, whose cybersecurity experience includes serving as our Chief Information Officer and in executive roles at other companies leading security, operations, audit, and compliance teams. Our Chief Information Security Officer (CISO), who has over two decades of experience in cybersecurity, including over five years at Veeva, reports to the EVP of Internal Operations and oversees our security team. Our CISO’s cybersecurity experience includes serving as a security architect and Director of Security Engineering at Veeva, and overseeing security, automation, and performance testing for other technology companies. 

Cybersecurity risk management is integrated into our broader risk management framework. We have a security points of contact program, which embeds security experts into product development, services, and IT teams. In addition, a security council, chaired by our CISO, meets monthly to discuss the security program, security incidents, and ongoing program objectives. The council is comprised of senior leaders in product development, operations, security, quality, and services, and helps ensure that security remains a top priority across the enterprise. 

Risks Management and Strategy

Information Security Management SystemWe maintain a comprehensive Information Security Management System (ISMS) that is designed to ensure the confidentiality, integrity, and availability of customer data, corporate data (such as intellectual property or source code), employee data, and our systems. Our ISMS is founded on the following industry-leading and regulatory standards:•ISO 9001:2015 – Quality Management Systems•ISO