Company: QLYS
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0001107843-25-000009
Chunk: 69

Company: QUALYS, INC.
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 69
---
Item 1C.     Cybersecurity

Risk Management and StrategyWe have established an Information Security Management System (“ISMS”) comprised of policies, procedures, and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall enterprise risk management systems and processes. Our ISMS is aligned to generally accepted security standards and is certified by third-party auditors according to ISO/IEC 27001 standards. We routinely assess cybersecurity risks for materiality, including assessing any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.We routinely conduct risk assessments to identify cybersecurity threats and weaknesses, as well as risk assessments of events that could potentially materially change our business practices and affect our information systems that could be impacted by cybersecurity threats and vulnerabilities. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer (“CISO”) who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process. 

36

Table of Contents

As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic trainings.We have established a Computer Security Incident Response Team (“CSIRT”) that identifies security incidents, characterizes the nature and severity of incidents, and provides diagnostic and corrective actions when appropriate. The CSIRT is responsible for identifying, managing, and responding to security incidents against Qualys' infrastructure and corporate IT systems. The security measures the CSIRT employs are consistent with relevant requirements of the National Institute of Standards and Technology (“NIST”), Federal Risk and Authorization Management Program (“FedRAMP”), International Organization for Standardization (“ISO”), and Federal Information Security Management Act (“FISMA”). We have also adopted certain guidelines from NIST and the United States Computer Emergency Readiness Team.Our Incident Response Program and Plan describes the major phases of an incident management lifecycle which includes the preparation,