Company: NET
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001477333-25-000043
Chunk: 129

Company: Cloudflare, Inc.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1C
Chunk 129
---
 training for all employees; and a comprehensive incident response process to identify, contain, and remediate cybersecurity incidents. We also engage with external cybersecurity assessors and consultants in evaluating and testing our risk management systems. These processes are integrated into our overall risk management systems and processes to promote a company-wide culture of cybersecurity risk management.We are aware of the risks associated with engaging third-party service providers, so we have implemented processes to oversee and manage these risks. We conduct security assessments of third-party providers who may have access to sensitive information before engagement and maintain ongoing monitoring of their compliance with our cybersecurity standards. The monitoring includes periodic reviews conducted by our security team. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

Governance

Our Board of Directors, including through its audit committee, oversees our enterprise risk management processes, including our cybersecurity risk exposure and the steps management has taken to monitor, control, and address such exposure. The audit committee regularly reviews and discusses with our senior management, our internal audit team, and our independent auditor, our policies and processes designed to identify, monitor, and address enterprise risks, including risks from cybersecurity threats and incidents. This oversight and review of our risks from cybersecurity threats includes, among other things, our SVP, Chief Security Officer (CSO) providing regular quarterly briefings to our Board of Directors regarding cybersecurity threats, processes for preventing and/or addressing current threats, ongoing cybersecurity initiatives and strategy and regulatory compliance; our internal audit team reporting on a quarterly basis to the audit committee regarding cybersecurity and other enterprise risk management efforts and related audits and management action plans to mitigate risks by internal audits; and periodic other updates to our Board of Directors by our CEO and CSO in the event of specific critical cybersecurity threats.Our CSO, who reports regularly and directly to our CEO, has primary responsibility for assessing, monitoring and managing our cybersecurity risks, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CSO, who joined us in 2023, has over 20 years of experience assessing and managing cybersecurity programs and cybersecurity risk at a number of different companies. Our internal security leadership team that reports to our CSO regularly communicates and meets to discuss cybersecurity threats and risk management, the effectiveness of our internal security programs, and cybersecurity emerging trends, risks, and incidents that may require increased focus. In addition, our internal audit team regularly reviews cybersecurity risks with our security team as part of our ongoing enterprise risk management program and conducts internal audits on various areas of cybersecurity risk. In addition,