5 unchanged sentences
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.
−Removed: Our cybersecurity risk management program is guided by industry standards developed by the NIST, the International Organization for Standardization (“ISO”), and other relevant organizations.
+Added: Our cybersecurity risk management program is guided by industry standards and frameworks, including those published by the National Institute of Standards and Technology (“NIST”), the International Organization for Standardization (“ISO”), and other relevant organizations.
Our cybersecurity risk management program is integrated into our overall enterprise risk management program and utilizes common reporting channels and governance processes that apply across other risk areas.
While everyone at our company plays a part in managing cybersecurity risks, as discussed in more detail under “Cybersecurity Governance” below, our board of directors, both directly and through delegation to our Audit Committee (the “Audit Committee”), and our senior management team are actively involved in the oversight of our cybersecurity risk management program.
−Removed: In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach by engaging teams across the business.
+Added: In general, we seek to address and mitigate cybersecurity risks through a comprehensive, cross-functional approach by engaging teams across the business.
We expect these teams to operate pursuant to our Standard Operating Procedures.
−Removed: Our approach is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur through shared processes.
−Removed: Our cybersecurity risk management and strategy includes:
−Removed: • Our dedicated Security team, which performs periodic risk assessments to identify and assess cybersecurity threats, vulnerabilities, their severities, and potential mitigations.
+Added: Our approach is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
+Added: Our cybersecurity risk management and strategy program includes:
+Added: • Our dedicated Security team, which performs periodic risk assessments to identify and assess cybersecurity threats, including threats associated with artificial intelligence and machine learning technologies, vulnerabilities, their severities, and potential mitigations.
The team leverages both top-down and bottom-up risk processes and technologies to identify, manage and monitor cyber threats and vulnerabilities.
The team also manages our response to cybersecurity incidents.
−Removed: • Incident Response Playbooks and Standard Operating Procedures (“SOP”) outlining procedures for detecting, responding to, and mitigating cybersecurity incidents.
−Removed: Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors.
+Added: • Incident Response Playbooks and Standard Operating Procedures outlining procedures for detecting, responding to, and mitigating cybersecurity incidents, including maintaining business continuity and disaster recovery protocols.
+Added: Depending on the nature and severity of an incident, this process provides procedures for escalating notification to our CEO and the board of directors or relevant committee of the board of directors.
• The use of external service providers, where appropriate, to assess, test or otherwise assist with certain aspects of our security controls and processes, as well as maturity assessments of our cybersecurity program.
• Implementation of new hire and annual data privacy and cybersecurity training of all employees, including senior management;
−Removed: annual role-based training of employees with specific access to systems, devices, or locations, and targeted cybersecurity simulation training held on a recurring basis.
−Removed: • A third-party risk management process that identifies and mitigates cybersecurity threats associated with our use of third-party service providers.
−Removed: Such service providers are subject to risk tiering, security risk assessments, continuous monitoring including investigation of security incidents that have impacted our third-party service providers, as applicable.
+Added: annual role-based training of employees with access to sensitive systems, devices, or locations, and targeted cybersecurity simulation training held on a recurring basis.
+Added: • A third-party risk management process that identifies and mitigates cybersecurity threats associated with our use of third-party service providers, including supply chain risks.
+Added: Such service providers are subject to risk tiering, security risk assessments, and continuous monitoring, including investigation of security incidents that have impacted our third-party service providers, as applicable.
We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.
−Removed: While we have experienced cybersecurity incidents in the past, we believe our current processes, systems and oversight with respect to the management of risks associated with cybersecurity threats are effective.
+Added: We have not identified any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.
+Added: We believe our current processes, systems and oversight with respect to the management of risks associated with cybersecurity threats are effective.
If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition.
−Removed: For more information regarding the risks we face from cybersecurity threats see “Risk Factors.
+Added: For more information regarding the risks we face from cybersecurity threats, see Item 1A.
+Added: Risk Factors .
Cybersecurity Governance
−Removed: Securing the information of our customers, employees, contractors, and third-party service providers is important to us.
−Removed: We have adopted physical, technological, and administrative controls on data security, and have defined procedures for data incident detection, containment, response, and remediation.
−Removed: While everyone at our company plays a part in managing these risks, oversight responsibility is shared by our board of directors, our Audit Committee, and management.
−Removed: To facilitate coordinated supervision of cybersecurity matters, our management team provides regular cybersecurity updates to our board of directors and regular updates on cyber risk management, which include development regarding our cybersecurity program, broader cybersecurity trends, evolving industry standards, the threat environment and other topics, to the Audit Committee.
−Removed: Together with management, our Audit Committee and board of directors consider this information in their review of our cybersecurity risks and response to data breaches.
−Removed: We also maintain information security risk insurance coverage.
+Added: Oversight responsibility is shared by our board of directors, our Audit Committee, and management.
+Added: To facilitate coordinated oversight of cybersecurity matters, our management team provides regular cybersecurity updates to our board of directors and updates on cyber risk management, which include developments regarding our cybersecurity program, broader cybersecurity trends, evolving industry standards, the threat environment and other topics, to the Audit Committee.
+Added: Together with management, our Audit Committee and board of directors consider this information in
Docusign, Inc.
| 2026 Form 10-K | 39
−Removed: We have recently also established a Security Governance Council (“Council”) that provides strategic guidance for the protection of our information, technology, and physical assets, including the definition of security risks and the prioritization of the implementation of associated controls.
−Removed: The Council membership is led by the Chief Information Security Officer (“CISO”) and includes relevant senior executives and has begun to meet at least quarterly, and will reconvene on an emergency basis when necessary to respond to potentially material cybersecurity incidents.
+Added: their review of our cybersecurity risks and response to cybersecurity incidents.
+Added: We also maintain information security risk insurance coverage.
+Added: Our Security Governance Council (“Council”) provides strategic guidance for the protection of our information, technology, and physical assets.
+Added: The Council membership is led by the Chief Information Security Officer (“CISO”) and includes relevant members of senior management.
+Added: The Council meets periodically to review and assess potential material cybersecurity incidents and other cybersecurity governance matters as warranted.
The CISO reports to the Chief Information Officer (“CIO”) and is responsible for management of cybersecurity risks and the protection and defense of our networks, systems and data.
−Removed: The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.
−Removed: Our CISO has over 20 years of experience in IT and Information Security across security architecture, incident response, and threat intelligence programs.
−Removed: Our CISO also holds a bachelor’s degree in computer science and maintains Certified Information Systems Security Professional certification.
+Added: The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider risk and regulatory compliance.
+Added: Our CISO has nearly 30 years of experience in global data security, operations, and risk management, having served in leadership roles at publicly traded technology companies and more than two decades in the U.S.
Members of executive leadership are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described herein, including the operation of our incident response plan.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.