Company: ASAN
Filing Date: 2025-03-18
Form Type: 10-K
Source: 0001477720-25-000045
Chunk: 83

Company: Asana, Inc.
Filing Date: 2025-03-18
Form: 10-K
Item: Item 1B
Chunk 83
---
Item 1B. Unresolved Staff Comments

None.

Item 1C. Cybersecurity

Risk Management and StrategyWe implement and maintain a formal information security management program designed to identify, assess, and manage material risks from cybersecurity threats to our critical networks, services, and data. Our information security management program includes a dedicated security team led by our Head of Security that is responsible for implementing security controls and monitoring for suspicious activity. Our information security management program also includes a cybersecurity risk management process which aims to identify and assess material risks from cybersecurity threats, including from vulnerabilities within Asana systems and new and emerging threats to Company operations by using automated and manual tools, subscribing to and analyzing reports and services that identify certain cybersecurity threats, conducting scans of certain environments, evaluating our and our industry’s risk profile, evaluating threats reported to us, and conducting audits and threat assessments.We consider our information security management program and the cybersecurity governance structure described below to be part of our overall enterprise risk management program.Depending on the nature of the environment, system and/or data, we implement and maintain various technical and organizational measures, processes, standards and/or policies designed to manage and mitigate cybersecurity risks, including, for example, as may be appropriate: employee training, software design review, static code analysis, coordinated vulnerability disclosure and bug bounty program, penetration testing performed by an outside assessment firm, vulnerability scanning and management, endpoint and network security monitoring, access controls, vendor risk management, asset management, and software updates and patching.We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including as applicable to our environments, systems, and data. These third-party service providers may include, but are not limited to, cybersecurity consultants, cybersecurity software providers, cybersecurity assessment firms, and forensic investigators.To operate our business, we also use third-party vendors to perform a variety of functions, including but not limited to, developing aspects of our platform, hosting and delivering our platform and related services, supporting the sale and marketing of our products and services, and providing technical and customer support. Depending on the nature of the services provided, the sensitivity of the systems and data at issue, and the identity of the vendor, our vendor management process may involve different measures designed to help identify, assess, and manage cybersecurity risks associated with the vendor, such as conducting risk assessments and re-assessments, reviewing of the vendor’s security program, and imposing contractual cybersecurity-related obligations on the vendor. For example, our security, privacy, and IT teams