Company: VEEV
Filing Date: 2025-03-24
Form Type: 10-K
Source: 0001393052-25-000022
Chunk: 44

Company: VEEVA SYSTEMS INC
Filing Date: 2025-03-24
Form: 10-K
Item: Item 1A
Chunk 44
---
 IT teams. In addition, a security council, chaired by our CISO, meets monthly to discuss the security program, security incidents, and ongoing program objectives. The council is comprised of senior leaders in product development, operations, security, quality, and services, and helps ensure that security remains a top priority across the enterprise. 

Risks Management and Strategy

Information Security Management SystemWe maintain a comprehensive Information Security Management System (ISMS) that is designed to ensure the confidentiality, integrity, and availability of customer data, corporate data (such as intellectual property or source code), employee data, and our systems. Our ISMS is founded on the following industry-leading and regulatory standards:•ISO 9001:2015 – Quality Management Systems•ISO/IEC 27001:2013 – Information Security Management•SOC2 Type II – System and Organization Controls•SEI Capability Maturity Model Integration (v1.3)•IT Infrastructure Library (ITIL) version 3•ICH Q9 – Quality Risk ManagementWe have achieved ISO 27001 certification for our ISMS, which is managed by our CISO. As a data processor, we are the custodian of customer information that can be both confidential and sensitive. We are also certified to ISO 27018 for privacy controls.Critical elements of our ISMS include:•Operational measures to monitor and respond to data breaches and cyberattacks. We have application, database, network, and resource monitoring in place that are designated to identify vulnerabilities, protect our applications, and alert incident response personnel. Security incidents are addressed by our Security Incident Management Policy, which includes a formal incident response process. We also provide a trust site that displays upcoming maintenance downtimes, data center incidents, and relevant security communications. •Preventative measures to hinder or limit cyberattacks. We procure, develop, deploy, and maintain preventative solutions and follow preventative practices for our corporate IT and product engineering infrastructures, as well as the production infrastructure that processes our customer data. These solutions and practices include identity and access management, separation of duties, secure software development, network and data security, and system hardening.

Veeva Systems Inc. | Form 10-K32

Table of Contents

•Vulnerability and penetration testing. We commission annual vulnerability and penetration testing of certain systems by industry-recognized, third-party security specialists. In addition, our software products undergo internal vulnerability testing using automated and manual methods prior to general availability.•Training. We require role-based security and security awareness training. All employees receive