Company: DOMO
Filing Date: 2025-04-04
Form Type: 10-K
Source: 0001505952-25-000045
Chunk: 101

Company: DOMO, INC.
Filing Date: 2025-04-04
Form: 10-K
Item: Item 1C
Chunk 101
---
Item 1C. Cybersecurity

Domo has an established cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of its critical systems, internal networks, and information. This program implements policies, processes, and controls to respond to cybersecurity threats and mitigate business impacts. Management is responsible for day-to-day administration of Domo’s cybersecurity policies, processes, practices, and risk management. Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. Our board of directors is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management (“ERM”).

We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected our organization, including its business strategy, results of operations, or financial condition. However, we face ongoing and increasing cybersecurity risks, including from bad actors that are becoming more sophisticated and effective over time. If realized, these risks are reasonably likely to materially affect our organization. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, “Risk Factors.”

Risk Management and Strategy

We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes.  We routinely assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Our cybersecurity policies, standards, processes, and practices are informed by recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and an array of other applicable standards-setting bodies, which are integrated into a broader risk management framework and related processes. We also hold various security-related industry certifications and attestations that have been validated by external auditors, including SOC 1, SOC 2, ISO 27001, ISO 27018, HITRUST, HIPAA, and others.We conduct annual risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats.  These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments