Company: RSKD
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001851112-25-000006
Chunk: 193

Company: RISKIFIED LTD.
Filing Date: 2025-03-06
Form: 20-F
Item: Item 16K
Chunk 193
---
ITEM 16K. CYBERSECURITY

Cybersecurity Risk Management and Strategy

We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our IT Systems and information.

Our cybersecurity risk management program is based on various cybersecurity standards in which we are certified, including ISO 27001:2013, ISO 27017, ISO 27018, SOC 1, SOC 2 Type 2 and SOC 3. This does not imply that we meet technical specifications or requirements at all times, but that these frameworks help us identify, assess, and manage cybersecurity risks relevant to our business.

Our cybersecurity risk management aligns with and shares common methodologies and reporting channels with our broader risk management.

Key features of our cybersecurity risk management program include, but are not limited to, the following:

• risk assessments designed to help identify material cybersecurity risks to our critical IT Systems, information, including Personal Information and Confidential Information, products, services, and our broader enterprise IT Systems environment;

• a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;

• processes for monitoring for vulnerabilities of our technology which includes code review (as necessary), testing and analysis of software across the software lifecycle;

• the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;

• physical and technical security measures, including encryption, authentication, and access controls;

• a bug bounty program to incentivize third-party assistance in detecting bugs, vulnerabilities or other issues in our syst ems or software;

• cybersecurity awareness training and internal cybersecurity resources for our employees;

• a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and

•a third-party risk management process for service providers, suppliers, and vendors
who access our system and information.

We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. Risk Factors - Our products enable the collection and storage of Personal Information, as well as confidential or proprietary information of our merchants and their consumers, and security concerns could result in liability to us or inhibit sales of our products. ”

Cybersecurity Governance

Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to our audit committee overall risk management, including oversight of cybersecurity and other information technology risks