Company: ZM
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001585521-25-000042
Chunk: 100

Company: Zoom Communications, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 100
---
Item 1C. CYBERSECURITY

Risk Management and Strategy

We have designed and implemented an information security program that is tailored to our operations and infrastructure, the nature of our products and services, and the sensitivity of data. Our information security program consists of processes that are designed to identify, assess, and manage material risks from cybersecurity threats.We have implemented cybersecurity risk management processes that include, for example, vulnerability assessments, application security assessments, penetration testing, third party security assessments, security audits, and ongoing risk assessments. In addition, we have implemented certain technical, physical, and organizational safeguards designed to mitigate material risks from cybersecurity threats, including, for example, depending on the environment or system: information security policies and standards, data protection policies and standards, security training and awareness campaigns, information protection processes, and systems monitoring for cybersecurity threats. We have also implemented an Incident Response Plan and procedures that provide us with a framework for responding to cybersecurity incidents. The Incident Response Plan and procedures provide protocols for incident evaluation, including the use of third-party service providers, processes for notification, and internal escalation of information to our senior management and the appropriate Board committee(s), all as appropriate depending on the nature of the incident. The Incident Response Plan is reviewed and updated, as necessary, under the leadership of Zoom’s Chief Information Security Officer (“CISO”).Further, our assessment and management of material risks from cybersecurity threats are an important element of our overall enterprise risk management program and included in our annual enterprise risk assessment which we provide to senior management and the Board.We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software and managed service providers, penetration testing firms, and forensic investigators.

We have a third party risk management program designed to oversee, identify, and mitigate material risks from cybersecurity threats associated with our use of third-party service providers. We perform risk-based due diligence and ongoing monitoring of third parties, which may include, for example: reviewing the third party’s relevant security audits and assessments, conducting our own security assessments, and imposing contractual obligations related to information security. 

As of the date of this Annual Report on Form 10-K, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they