Company: BL
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0001666134-25-000003
Chunk: 75

Company: BLACKLINE, INC.
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 75
---
 well as members of our Board and the Audit Committee of the Board (the “Audit Committee”) and Technology and Cybersecurity Committee of the Board (the “Technology and Cybersecurity Committee”) regarding cybersecurity threats and incidents.•Governance: The Board’s oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with our risk management function and Chief Information Security Officer (“CISO”). In February 2024, the Board formed a standing Technology and Cybersecurity Committee, which is comprised of independent members of the Board and assists the Board in fulfilling its oversight responsibilities with respect to risks relating to our information security, data privacy and disaster recovery capabilities.

A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, and other exercises focused on evaluating effectiveness. We periodically engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. The results of such assessments and reviews are reported to the Board, the Audit Committee, and the Technology and Cybersecurity Committee, and we make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews. The Audit Committee and the Technology and Cybersecurity Committee are responsible for oversight relating to cybersecurity. The Board, the Audit Committee, and the Technology and Cybersecurity Committee regularly receive presentations and reports on cybersecurity risks from the CISO, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and cybersecurity considerations arising with respect to our peers and vendors. Our incident response process includes escalation of potentially material cybersecurity incidents to relevant members of our executive management team. The Board, the Audit Committee, and the Technology and Cybersecurity Committee are updated as appropriate. Periodically, the Audit Committee discusses our approach to cybersecurity risk management with our CISO. Our Technology and Cybersecurity Committee receives regular reports from our CISO as part of its assessment of our cybersecurity threat landscape, and the quality and effectiveness of our information security programs.Our CISO is the member of our management who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across BlackLine. She has over 15 years of experience as a chief information security officer responsible for enterprise-wide oversight of information security programs. She holds CISSP and CISM certifications, and a BS in Computer Science. She leads a team of 

37