Company: FSLY
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001517413-25-000063
Chunk: 114

Company: Fastly, Inc.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 114
---
 our overall business objectives and reports the results to the board of directors, which evaluates our overall enterprise risk. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional services firms, including legal counsel; cybersecurity software providers; managed cybersecurity service providers; penetration testing firms; and forensic investigators. We use third-party service providers to perform a variety of functions throughout our business, such as providing cloud-based infrastructure, hosting third party applications, and delivering content to customers, as well as data center hosting. We have a formal vendor management program designed to manage cybersecurity risks associated with our use of these providers. The procurement organization conducts an initial risk assessment to determine the criticality of the vendor prior to onboarding. Depending on the criticality of the vendor–which is based on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider–our security organization conducts our vendor security review process, which involves different levels of assessment designed to identify cybersecurity risks associated with a provider prior to onboarding and on a periodic basis, including, for example: (1) a vendor security questionnaire; (2) results of audit reports and certifications; and (3) policies and standards detailing the third-party’s security program. Based on the results of the vendor security review, a decision is made on whether the third-party can be engaged. We review our most critical providers' audit reports and certifications on a regular basis to reassess whether or not they have experienced any material changes or degradations to their security programs since our initial review that may warrant re-evaluation. The Company 

64

generally attempts to engage reputable third-party service providers and when appropriate, imposes contractual obligations related to cybersecurity on its providers. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including “If we or our third-party providers fail to protect our IT Systems or Confidential Information, and/or experience