Company: QLYS
Filing Date: 2025-04-23
Form Type: DEF 14A
Source: 0001140361-25-015182
Chunk: 36

Company: QUALYS, INC.
Filing Date: 2025-04-23
Form: DEF 14A
Chunk 36
---
 ESG report for more information on these policies and related programs on our website at www.qualys.com.

| 30 |

Empowering Our Business and Customers Cybersecurity and compliance constitute key parts of our business. Our customers look to Qualys to enable protection of their systems and applications from ever-evolving cyberattacks and to maintain compliance with related cybersecurity policies and regulations. We continually work to enhance the capabilities of our cybersecurity offerings. We hold ourselves to the highest standards regarding data security policies and customer privacy programs. Trust is the foundation of our business, and we take the responsibility to protect our customers’ data and privacy very seriously. Oversight of cybersecurity and customer data privacy at Qualys begins with our Board and the direct supervision of the Audit and Risk Committee. Our Chief Information Security Officer (“CISO”) has management oversight of IT, platform, physical infrastructure, and product security, and other department leaders regularly update the Board on cybersecurity and customer privacy. Consistent with our Board’s and Management’s cybersecurity and customer data privacy oversight, we have established an Information Security Management System (“ISMS”) comprised of policies, procedures, and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall enterprise risk management systems and processes. Our ISMS is aligned to generally accepted security standards and is certified by third-party auditors according to ISO/IEC 27001 standards. We routinely assess cybersecurity risks for materiality, including assessing any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. We routinely conduct risk assessments to identify cybersecurity threats and weaknesses, as well as risk assessments of events that could potentially materially change our business practices and affect our information systems that could be impacted by cybersecurity threats and vulnerabilities. These risk assessments include the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our CISO who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human