OOMA INC

We are heavily reliant on our technology and infrastructure to provide our products and services to our customers. As a result, we have developed an information security program (referred to as our InfoSec Program) to enhance our network security measures, identify and mitigate information security risks, and protect and preserve the confidentiality, integrity, and continued availability of our own critical information as well as that of our customers and suppliers that is in our care. Our InfoSec Program includes development, implementation, and continual improvement of policies and procedures to safeguard information and ensure availability of critical data and systems. Our InfoSec Program further includes using third-party software to help us identify potential weaknesses and to conduct periodic network access penetration testing on a regular basis. In addition, in accordance with our InfoSec Program, we actively monitor known threats that could affect our products and services and we work with our suppliers to provide us with real-time reports of threats or vulnerabilities that may affect our enterprise-wide systems. Our InfoSec Program also includes a cyber incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident.

Management reports security instances to the Board as they occur, if material, and provides a summary multiple times per year to the full Board of Directors about periodic assessment of our internal response preparedness, and assessments led by outside advisors. We carry insurance intended to defray potential losses arising from a cybersecurity incident. We have not experienced any material information security breaches or incurred any material expenditures related to any information security breaches in the last three years. To date, we have not paid any penalties or settlements in connection with any information security breaches.