UNRESOLVED STAFF COMMENTS
+Added: Docusign, Inc.
+Added: | 2025 Form 10-K | 37
CYBERSECURITY
1 unchanged sentence
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.
−Removed: Our cybersecurity risk management program is guided by industry standards developed by the National Institute of Standards and Technology (“NIST”), the International Organization for Standardization (“ISO”), and other relevant organizations.
+Added: Our cybersecurity risk management program is guided by industry standards developed by the NIST, the International Organization for Standardization (“ISO”), and other relevant organizations.
Our cybersecurity risk management program is integrated into our overall enterprise risk management program and utilizes common reporting channels and governance processes that apply across other risk areas .
While everyone at our company plays a part in managing cybersecurity risks, as discussed in more detail under “Cybersecurity Governance” below, our board of directors, both directly and through delegation to our Audit Committee (the “Audit Committee”), and our senior management team are actively involved in the oversight of our cybersecurity risk management program.
−Removed: In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
+Added: In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach by engaging teams across the business.
+Added: We expect these teams to operate pursuant to our Standard Operating Procedures.
+Added: Our approach is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur through shared processes.
Our cybersecurity risk management and strategy includes:
17 unchanged sentences
While everyone at our company plays a part in managing these risks, oversight responsibility is shared by our board of directors, our Audit Committee, and management.
−Removed: Accordingly, our management team provides regular cybersecurity updates to our board of directors and
−Removed: DocuSign, Inc.| 2024 Form 10-K | 39
−Removed: regular updates on cyber risk management to the Audit Committee.
+Added: To facilitate coordinated supervision of cybersecurity matters, our management team provides regular cybersecurity updates to our board of directors and regular updates on cyber risk management, which include development regarding our cybersecurity program, broader cybersecurity trends, evolving industry standards, the threat environment and other topics, to the Audit Committee.
+Added: Together with management, our Audit Committee and board of directors consider this information in their review of our cybersecurity risks and response to data breaches.
We also maintain information security risk insurance coverage.
+Added: Docusign, Inc.
+Added: | 2025 Form 10-K | 38
We have recently also established a Security Governance Council (“Council”) that provides strategic guidance for the protection of our information, technology, and physical assets, including the definition of security risks and the prioritization of the implementation of associated controls.
3 unchanged sentences
Our CISO has over 20 years of experience in IT and Information Security across security architecture, incident response, and threat intelligence programs.
−Removed: Our CISO also holds a bachelor’s degree in computer science and maintains Certified Information Systems Security Professional (“CISSP”) certification.
+Added: Our CISO also holds a bachelor’s degree in computer science and maintains Certified Information Systems Security Professional certification.
Members of executive leadership are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described herein, including the operation of our incident response plan.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.