Company: BL
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0001666134-25-000003
Chunk: 74

Company: BLACKLINE, INC.
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 74
---
Item 1C.    Cybersecurity

Cybersecurity is a key component of BlackLine’s overall cross-functional approach to risk management. Our cybersecurity risk management practices are integrated into our overall risk management practices, and cybersecurity risks are among the core enterprise risks identified for oversight by our Board through our annual enterprise risk assessment. Our cybersecurity policies and practices are designed with the cybersecurity framework of the National Institute of Standards and Technology and certain other applicable industry standards in mind, and BlackLine maintains an information security management system, which is certified against certain international standards, such as ISO 27001 and ISO 27017. Our cybersecurity program includes: •Vigilance: We maintain a global cybersecurity threat operation that endeavors to detect, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to the business. 

36

•Collaboration: We have established collaboration mechanisms with public and private entities, including intelligence and enforcement agencies, industry groups, and third-party service providers to identify and assess cybersecurity risks. •Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion detection systems, anti-malware functionality, access controls, and ongoing vulnerability assessments. •Third-Party Management: We maintain a risk-based approach to identifying and overseeing cybersecurity risks with respect to third parties, including third parties who provide solutions we rely upon for our security measures. This includes contractually obligating third-party service providers with access to our systems or processing sensitive data on our behalf to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected security breach that may affect BlackLine. •Education: Employees outside of our corporate information security organization also have a role in our cybersecurity defenses, which we believe improves our cybersecurity. We provide training upon onboarding, and annually thereafter, for all personnel regarding cybersecurity threats, with additional role-based security training as applicable. We also provide periodic cybersecurity newsletters and updates to all employees, have a phishing awareness program that includes monthly simulations, and periodically host tabletop exercises with management and other employees to practice rapid cyber incident response.•Incident Response Planning: We have established and maintain an incident response plan that addresses our response to suspected cybersecurity incidents and is tested periodically. •Communication and Coordination: We utilize a cross-functional approach to addressing the risk from cybersecurity threats, involving management personnel from the information security, technology, operations, legal, risk management, internal audit, and other key business functions, as