Company: ASAN
Filing Date: 2025-03-18
Form Type: 10-K
Source: 0001477720-25-000045
Chunk: 84

Company: Asana, Inc.
Filing Date: 2025-03-18
Form: 10-K
Item: Item 1B
Chunk 84
---
 may review the vendor’s security protocols, data retention policies and privacy policies, privacy practices, and security track record, and advise on implementation best practices. See the section titled Item IA. Risk Factors, including “If our information technology systems, or those of third parties with whom we work, or our data are or were compromised or operate in an unintended way, we could experience adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences”, for additional information about the risks from cybersecurity threats that may materially affect our business.

Governance

The Audit Committee of our board of directors is responsible for assisting the Board in overseeing the Company’s risk assessment and risk management processes, including risks related to cybersecurity and data 

50

Table of Contents

privacy. Our Head of Security, who reports to our Head of Engineering and works with other members of management, manages the Company’s cybersecurity program. Our Head of Security holds a master’s degree in computer engineering from the Rochester Institute of Technology and has over 15 years of cybersecurity experience. Our Head of Engineering holds a master’s degree in computer science from the University of Illinois Urbana-Champaign and has nearly two decades of leadership experience at technology companies overseeing key engineering functions. Our Head of Security provides regular updates to the Audit Committee and the Board on cybersecurity risks faced by the Company and the Company’s processes for risk identification, assessment, and management. Our management team is involved in assessing and managing the Company’s material risks from cybersecurity threats, including by hiring appropriate personnel, considering cybersecurity risk in our enterprise risk management strategy, helping prepare for cybersecurity incidents, and participating in the cybersecurity incident response and remediation process for incidents escalated to it including determining materiality. Our management that is involved in these processes includes our Head of Security, Head of Global Privacy, Head of Engineering, Head of Enterprise Technology & IT, Chief Business Officer, Chief Financial Officer, and General Counsel. Management also escalates, as appropriate, reports relating to cybersecurity incidents or threats to the Audit Committee.