Company: DOMO
Filing Date: 2025-04-04
Form Type: 10-K
Source: 0001505952-25-000045
Chunk: 103

Company: DOMO, INC.
Filing Date: 2025-04-04
Form: 10-K
Item: Item 1C
Chunk 103
---
 our Chief Information Security Officer are several experienced security engineers, and governance, risk, and compliance professionals. In addition to our in-house cybersecurity capabilities, we also engage with external assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.Our CISO and our management committee on cybersecurity (security steering committee) oversee our cybersecurity policies and processes, including those described in “Risk Management and Strategy” above.  Some key processes by which our CISO and security steering committee are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following:•Identification and Reporting: We have implemented a robust, cross-functional approach to identifying, assessing, and managing cybersecurity threats and risks. Our program includes controls and procedures designed to properly identify, classify, and escalate cybersecurity risks to provide management with visibility and prioritization of risk mitigation efforts and to publicly report material cybersecurity incidents when appropriate.•Threat Intelligence: We have established a Threat Intelligence team focused on profiling, intelligence collection, and threat analysis supporting our ongoing efforts to identify, assess and manage cybersecurity threats. The team’s input supports both near-term response to cybersecurity events, and long-term strategic planning and development of our cybersecurity risk management framework.•Technical Safeguards: We deploy, maintain, and regularly monitor the effectiveness of technical safeguards that are designed to protect our information systems from cybersecurity threats. We make investments in core security capabilities, including awareness and training, identity and access, incident response, product security, cloud security, enterprise security, risk management, and supply chain risk, to enable us to better identify, protect, detect, respond to, and recover from evolving security threats. Our technical safeguards include firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through internal and external security assessments and cybersecurity threat intelligence. We regularly assess our safeguards through internal testing by our assurance teams. We also leverage external third-party testing (e.g., penetration testing, attack surface mapping, and security maturity assessments).•Incident Response and Recovery Planning: We have established and maintain robust incident response, business continuity and disaster recovery plans designed to address our response to a cybersecurity incident. We conduct regular tabletop exercises involving multiple operational teams, including senior management, to test these plans and to familiarize personnel with their roles in a response scenario.•Third-Party Risk Management: We maintain a robust, risk-based approach to identifying and overseeing cybersecurity threats presented by certain third parties, including vendors, service providers and other external users