Company: FSLY
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001517413-25-000063
Chunk: 115

Company: Fastly, Inc.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 115
---
 a data security incident our business could experience materially adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, loss of revenue or profits, loss of customers or sales, reputational harm, and other adverse consequences.”

Governance

Our board of directors addresses the Company’s cybersecurity risk management as part of its general risk oversight function. The board of directors is responsible for overseeing Company’s cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. 

Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CISO, Mr. Marshall Erwin. Our CISO has experience in the technology and government industries, including through his previous roles as CISO for a major Internet company and an analyst in the US intelligence community. He also served as the cybersecurity and counterterrorism advisor on the Senate Homeland Security and Government Affairs Committee and as the intelligence specialist at the Congressional Research Service.  Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy, and communicating key priorities to relevant personnel. Our CISO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our incident response plan is designed to escalate certain cybersecurity incidents, including breaches, to members of management depending on the circumstances, including our CISO, general counsel, and other members of leadership when appropriate. The security incident and response team works with relevant subject matter experts across the organization when necessary to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company’s incident response plan includes reporting to the board of directors for cybersecurity incidents the Company's disclosure committee determines are material. The disclosure committee, which includes members of management such as our Chief Financial Officer and general counsel, meets quarterly. The CISO acts in an advisory capacity to the Company's disclosure committee on an as-needed basis.

Our board of directors receives periodic reports at least annually from our CISO concerning the Company’s significant cybersecurity threats and risk and the processes the Company has implemented to address them. Our board of directors also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.