3 unchanged sentences
GitLab’s cybersecurity program was designed in alignment with industry standards and recognized best practices to identify, assess, and manage material risks from cybersecurity threats.
−Removed: Our cybersecurity program is led by our Chief Information Security Officer, who has over 25 years of experience working at SaaS and technology companies, and consists of over 120 security practitioners located around the world.
−Removed: Our processes assess the likelihood and impact of various threats and risks including, but not limited to, our business operations, organizational output, brand reputation, business continuity, customers and stakeholders, legal, regulatory, and financial impact.
−Removed: Identified risks are assessed for criticality, prioritized for remediation, and reported by GitLab's security teams to various levels of our management including integration into our enterprise risk management program, led by Internal Audit.
+Added: Our cybersecurity program is led by our Chief Information Security Officer, and consists of over 120 security practitioners located around the world.
+Added: Our CISO vacated the CISO role February 26th, 2026 and our Security Operations Vice President is currently acting as our interim CISO while we conduct a search for a new CISO.
+Added: Our interim CISO has over 25 years of experience working at SaaS and technology companies and we expect our security program will continue to operate as it has in the prior fiscal year.
+Added: Our processes assess the likelihood and impact of various threats and risks including, but not limited to, our business operations, organizational output, brand reputation, business continuity, customers and stakeholders, legal, regulatory, AI, and financial impact.
+Added: Identified risks are assessed at least quarterly for
+Added: Table of Conte n t s
+Added: criticality, prioritized for remediation, and reported by GitLab's security teams to various levels of our management including integration into our enterprise risk management program, led by Internal Audit.
We also make judgments based on current data, assumptions about the risk, the company’s risk tolerance, impact to confidentiality, integrity, and availability, and reasonable analysis of costs associated with mitigating or reducing the severity of the risk.
9 unchanged sentences
Our board of directors is responsible for overseeing and advising our company so that it functions as effectively as possible.
−Removed: The audit committee consists of a subset of the board of directors.
+Added: The audit committee consists of a subset of the board of directors and its members are well versed in matters including but not limited to, matters of cybersecurity, security risk management, compliance, and governance.
The audit committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full board of directors for consideration.
−Removed: The audit committee performs oversight functions and meets regularly with management to review the company’s business and operations, including the oversight of risks from cybersecurity threats.
+Added: The audit committee meets regularly with management to review the company’s business and operations, including the oversight of risks from cybersecurity threats.
Management is responsible for and regularly discusses identifying, assessing, and managing material cybersecurity risks on an ongoing basis through programs led by the Chief Information Security Officer, Chief Legal Officer, and the Chief Financial Officer.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.