Company: FSLY
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001517413-25-000063
Chunk: 113

Company: Fastly, Inc.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 113
---
Item 1C.     Cybersecurity

Risk management and strategy

We have implemented and maintain various cybersecurity processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, trade secrets, personal information, and data of our customers (including their end-users) (“Information Systems and Data”). Our Chief Information Security Officer (“CISO”) and security organization help identify, assess, and manage the Company’s cybersecurity threats and risks, including through the use of the Company’s security risk register. The CISO and security organization identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company’s risk profile using various methods including, for example: (1) identifying vulnerabilities through automated scans, vulnerability assessments, and subscriptions to threat intelligence feeds and notices; (2) assessing security weaknesses identified through internal security reviews, external penetration tests, and reports on our products and services; and (3) assessing the Company’s threat landscape given the industry’s risk profile, the results of our enterprise risk assessment, and information technology, privacy, and security audits. Depending on the environment, system, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan; incident detection and response; vulnerability management policy; business continuity plan; risk assessments; implementation of security standards and certifications; encryption of data; network security protocols; data segregation; access controls; physical security; asset management, tracking and disposal; systems monitoring, vendor risk management program; employee training; penetration testing; cybersecurity insurance; and a dedicated CISO and security organization. Our assessment and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management processes. For example, (1) the security organization is engaged in all major changes to the Company’s environment or products to conduct a risk assessment and identify potential cybersecurity risk; (2) cybersecurity risk is a component of the Company’s enterprise risk management program and managed within the Company’s risk register; (3) the security organization works with senior leadership across the Company to prioritize our risk management processes and mitigate cybersecurity threats that are most likely to lead to a material impact to our business; and (4) our senior management evaluates material risks from cybersecurity threats against