Company: LPSN
Filing Date: 2025-03-14
Form Type: 10-K
Source: 0001102993-25-000018
Chunk: 97

Company: LIVEPERSON INC
Filing Date: 2025-03-14
Form: 10-K
Item: Item 1C
Chunk 97
---
Item 1C. Cybersecurity 

The Company has implemented and maintains a cybersecurity program governed by an information security team responsible for managing and directing strategy, policy, standards, architecture, controls, and processes. The cybersecurity program is underpinned by a cybersecurity risk management framework designed to identify and prioritize cybersecurity risks to the Company and is overseen by our Board of Directors.Risk management and strategy Our cybersecurity program is designed to protect our information systems from cyber threats and to ensure the confidentiality, integrity and availability of systems and information used, owned or managed by the Company related to our employees, our customers and their users. This involves an ongoing effort to protect against, detect and respond to cybersecurity threats and vulnerabilities. LivePerson maintains a security risk management program that is tasked with determining the cybersecurity threats that pose the greatest risk to the Company. This program is managed by the Security Risk Committee, chaired by the Chief Security Officer (“CSO”), as well as representative members from security, operations, and internal audit leadership. The committee meets at least twice annually. A resultant risk assessment produced by the committee is leveraged to inform senior leadership and our Board of Directors on top areas of risk, as well as to shape the security and technology team’s roadmap.                      

41

Our cybersecurity program includes a number of components, such as:•regular cybersecurity risk assessments, audits, and penetration tests;•policies generally aligned with industry standards such as Information Security Standard (“ISO”) / International Electrotechnical Commission –27001 and the PCI Data Security Standard;•measures to block and prevent certain malicious activity, such as endpoint detection and response controls;•measures to block and prevent certain network attacks, such as firewalls and Distributed Denial of Service mitigation tools;•measures to secure remote access, such as virtual private networks and multi-factor authentication;•cybersecurity training programs for employees, contractors and agents, including regular phishing simulations;•a vulnerability disclosure program to compensate researchers for responsible disclosure of vulnerabilities in our platform;•the maintenance of a Security Incident Response Plan with periodic tabletop testing; and•third-party risk management processes designed to manage risks associated with vendors and suppliers.The goal of the Company’s information security program is to manage risks in a prioritized fashion; however, control gaps and/or their related control effectiveness, resource constraints, and execution failure can pose cybersecurity risk to the Company. In the event of a cyber incident, the Company has a process in place whereby the information security team will alert the appropriate levels of management, as well as the legal