What 8X8 INC /DE/ tells the SEC about who runs cybersecurity

ITEM 1C. Cybersecurity

8x8 recognizes that cybersecurity is critical to the trust placed in our platform by customers, partners, and other stakeholders. The Company is committed to maintaining the confidentiality, integrity, and availability of its systems and data through a comprehensive cybersecurity risk management and governance framework.

Cybersecurity Risk Management and Strategy

8x8 maintains a global cybersecurity risk management program aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. This program is integrated and embedded within the Company's overall enterprise risk management, or ERM, process and designed to proactively identify, assess, and manage cybersecurity threats that could materially affect our business operations, financial condition, or reputation.

Key components of the program include:

• Continuous threat monitoring and intelligence , with real-time detection capabilities across cloud and on-premise environments.

• Periodic risk assessments and threat modeling , covering internal assets and supply chain exposure.

• Third-party penetration testing , security audits, and independent assessments conducted at least annually.

• A vulnerability management lifecycle to identify, prioritize, and remediate security flaws in infrastructure and applications.

• Employee cybersecurity training and phishing simulations , tailored by role and location.

8x8 engages reputable external security firms and consultants to support ongoing evaluations , and has obtained certifications and attestations across various jurisdictions and industries (including ISO/IEC 27001, CyberEssentials Plus et al, and compliance with frameworks applicable to communications and cloud service providers).

To date, the Company has not experienced any cybersecurity incidents that have materially impacted its operations or financial condition. Nevertheless, cybersecurity threats continue to evolve, and the Company has developed and implemented a comprehensive Incident Response Plan to effectively manage cybersecurity incidents. The plan is regularly reviewed, tested, and updated to facilitate its effectiveness in mitigating and responding to cybersecurity threats promptly.

Governance

The Company's board of directors, through its Technology & Cybersecurity Committee, oversees 8x8's cybersecurity risk management strategy. This committee meets quarterly and receives briefings from senior leadership on cybersecurity risk trends, controls testing and efficacy, compliance posture, and incident management preparedness. The full board of directors is informed at least annually on cybersecurity matters, with additional updates as needed.

The Company's Chief Information Security Officer, or CISO, leads the cybersecurity program and reports functionally to the Chief Legal Officer, and periodically to the CEO, the Executive Risk Management Committee, and the board of directors. The CISO has over 25 years of global cybersecurity, information security, disaster recovery, and business continuity experience, including leadership roles across UK national infrastructure and global Fortune 100 and 500 companies. The CISO holds an M.S. in Information Technology Security (with distinction), and is a Certified Information Security Manager, or CISM, and Certified Information Systems Security Professional, or CISSP.

While the board of directors has not formally designated a cybersecurity expert under SEC regulations, the Technology & Cybersecurity Committee includes directors with backgrounds in technology, data governance, and risk oversight, and all directors participate in training sessions to continue to enhance their understanding of cybersecurity issues and their implications for the Company.

ITEM 1C. CYBERSECURITY

8x8 recognizes the critical importance of cybersecurity in maintaining the integrity, confidentiality, and availability of its systems and data. As a leading provider of communication and collaboration solutions, 8x8 is committed to safeguarding its assets, including customer data, from evolving cybersecurity threats.

NIST Framework Adoption:

8x8's cybersecurity program is aligned with the National Institute of Standards and Technology, or NIST, cybersecurity framework, a widely recognized set of guidelines for managing and mitigating cybersecurity risks. By leveraging the National Institute of Standards and Technology framework, 8x8 has implemented a comprehensive and structured approach to identifying, protecting, detecting, responding to, and recovering from cybersecurity incidents.

Governance Structure:

At 8x8, cybersecurity is integral to the enterprise-wide risk management program. The Chief Information Security Officer, or CISO holds a pivotal role in overseeing the Company's cybersecurity initiatives. The Company's Chief Information Security Officer has served in various security leadership roles, including at a Fortune 500 technology company, and is a Certified Information System Security Professional, or CISSP, and a Licensed Private Investigator, and completed Harvard University's Cybersecurity Managing Risk in 2021. He also held a United States Top Secret / Sensitive Compartmentalized Information, or TS/SCI, security clearance when he advised the White House, Pentagon, National Security Agency, Central Intelligence Agency, and Federal Bureau of Investigation on classified projects. Reporting directly to the Chief Legal Officer, who in turn reports to the CEO, the Chief Information Security Officer is empowered to lead the Executive Risk Management Committee. Through this committee, critical cybersecurity issues are monitored, addressed, and escalated as necessary.

Furthermore, the Chief Information Security Officer provides regular updates and presentations directly to the Board of Directors on cybersecurity matters. This direct line of communication ensures that the Board remains informed and engaged in understanding and managing cybersecurity risks facing the Company.

To enhance oversight and governance in this area, 8x8's Board of Directors has established the Technology & Cybersecurity Committee. This committee focuses specifically on the Company's technology, products, and cybersecurity program, providing strategic guidance and oversight to ensure alignment with business objectives and industry standard practices.

Reporting and Communication:

Transparent reporting and communication are key components of 8x8's cybersecurity program. Incidents are promptly reported to the Chief Information Security Officer, who is responsible for escalating to relevant stakeholders, including executive leadership, the internal disclosure committee, and the Board of Directors, as required. Regular communication channels ensure that stakeholders are kept informed of the Company's cybersecurity posture and any emerging threats or incidents.

Determining Potential Impact and Materiality of Cybersecurity Incidents:

8x8 conducts thorough assessments to determine the potential impact and materiality of cybersecurity incidents. 8x8's Chief Information Security Officer is a member of 8x8's internal disclosure committee emphasizing the importance of cybersecurity as part of 8x8's disclosure controls and procedures. By evaluating factors such as the nature of the incident, the extent of data exposure, and potential regulatory implications, the Company assesses the significance of cybersecurity events, which helps it take appropriate measures to mitigate risks, minimize impact and properly report any material cybersecurity incidents.

Incident Response Plan (IRP) Implementation:

8x8 has developed and implemented a comprehensive Incident Response Plan, or IRP, to effectively manage cybersecurity incidents. The Incident Response Plan outlines clear reporting and escalation processes, delineating roles and responsibilities for incident response team members. The plan is regularly reviewed, tested, and updated to facilitate its effectiveness in mitigating and responding to cybersecurity threats promptly.

Integration with Overall Risk Management Program:

The cybersecurity program at 8x8 is fully integrated with the Company's overall risk management program through our Chief Information Security Officer's participation in such governance structures as the executive risk management committee, data protection committee, and internal disclosure committee and the incorporation of security in the Company's overall compliance and enterprise risk management programs. By aligning cybersecurity initiatives with 8x8's broader enterprise risk management initiatives, 8x8 pursues a holistic approach to identifying, assessing, and mitigating risks across the organization.

Risk Assessment and Identification:

8x8 conducts regular risk assessments to identify and prioritize cybersecurity risks. Through measures such as vulnerability assessments, and penetration testing, the Company identifies potential vulnerabilities and takes proactive steps to address them. 8x8 has also implemented technical, administrative and legal controls to manage our risk from third party service providers, including implementation of a third-party vendor risk management platform. Individuals or entities have attempted, and will continue to attempt, to penetrate our network security, and that of our platform, to try to cause harm to our business operations, including by misappropriating our proprietary information or that of our customers, employees and business partners or causing interruptions of our products and platform. See the sections entitled "Risks Related to our Products and Operations" and "Risks Related to Regulatory Matters" in Part I, Item 1A "Risk Factors" for more information on our cybersecurity risks.

Training and Awareness:

8x8 invests in comprehensive training and awareness programs to educate employees about cybersecurity best practices and their roles in safeguarding company assets. By promoting a culture of cybersecurity awareness, 8x8 strengthens its overall security posture and reduces the risk of human error leading to cybersecurity incidents.

Engagement with Third Parties:

8x8 collaborates with third-party auditors, consultants, and participates in bug bounty programs to enhance its cybersecurity capabilities. External audits and assessments provide independent validation of the effectiveness of 8x8's cybersecurity controls, while bug bounty programs leverage the collective expertise of the cybersecurity community to identify and address potential vulnerabilities.

Conclusion:

8x8 prioritizes cybersecurity as a fundamental aspect of its operations and is dedicated to maintaining a robust cybersecurity program aligned with industry practices and regulatory standards. Through strong governance, risk management, and continuous improvement efforts, 8x8 aims to protect its systems, data, and stakeholders from cybersecurity risks.