Company: ZHIHF
Filing Date: 2025-04-15
Form Type: 20-F
Source: 0001410578-25-000729
Chunk: 401

Company: Zhihu Inc.
Filing Date: 2025-04-15
Form: 20-F
Item: Item 16K
Chunk 401
---
Item 16K.CYBERSECURITY
Risk Management and Strategy
We have implemented robust processes for assessing, identifying and managing material risks from cybersecurity threats and monitoring the prevention, detection, mitigation and remediation of material cybersecurity incident. We have also integrated cybersecurity risk management into our overall enterprise risk management system. We have established a systematic information security management framework and set up the Zhihu Cybersecurity and Data Security Committee to provide a framework for information security, with a dynamic and multi-layered cybersecurity defense system to effectively mitigate both internal and external cyber threats. Our information security protection mechanism incorporates pre-event prevention, in-process monitoring and post-event response to ensure that our information security is preventable, manageable and controllable. In the pre-event prevention phase, we incorporate information security protection measures into the development of products and services and continuously strengthens the preventive and protective measures for information security through the “security review” methods such as login authentication schemes, permission granting schemes, two-factor authentication, personal information collection scenarios, whether to encrypt the transmission and storage of personal information, whether to mask sensitive data for display, and whether to add watermarks. In the in-process monitoring phase, we established threat intelligence, traffic analysis and security operation centers to monitor and analyze information security threats in real time and promptly warn of security risks. In the post-event response phase, we put in place security orchestration, automation and response handling capabilities as well as manual handling processes to reduce the probability of security incidents by automatically or manually handling identified risks. Our approach to managing cybersecurity risks and safeguarding sensitive data is multi-faceted, involving technological safeguards, procedural protocols, a rigorous program of surveillance on our corporate network, regular internal and external evaluations of our security measures, a solid incident response framework, and cybersecurity training sessions for our employees. Our cybersecurity department is actively engaged in continuous monitoring of our websites and apps to ensure prompt identification and response to potential issues, including emerging cybersecurity threats. As of the date of this annual report, we have not experienced any material cybersecurity incidents or identified any material cybersecurity threats that have affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.
Governance
Our corporate governance committee is responsible for overseeing our cybersecurity risk management. Our corporate governance committee shall (i) maintain oversight of the disclosure related to cybersecurity matters in current reports or periodic reports of our company, (ii) review updates to the status of any material cybersecurity incidents or material risks from cybersecurity threats to our company, and the relevant disclosure issues, if any, presented