WORKIVA INC

Risk Management and Strategy

We are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations, and reputation. It is important to develop, implement, and maintain comprehensive cybersecurity measures, which we do as part of our larger risk management program to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our risk management team works closely withour Business Technologyand Information Security (“InfoSec”) departments to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs, and is tasked with ensuring that adequate and ongoing discovery and cybersecurity risk management is integrated with our enterprise risk management program. Our information security program incorporates data encryption and access control, single sign-on and multi-factor authentication, vulnerability management, and malware protection for both laptops and servers. We require all employees to complete security awareness training upon onboarding, and annually thereafter, with additional role-based security training as applicable. We align with industry standards and frameworks, and we maintain FedRAMP Moderate authorization, an ISO 27001 certificate, and SOC 1 and 2 Type 2 reports to comply and adhere to industry standard practices. There can be no guarantee that, in every instance, our policies and procedures will be properly followed or that those policies and procedures will prevent malicious or unauthorized access to our information systems.

Engaging Third Parties on Risk Management

Recognizing the complexity and evolving nature of cybersecurity threats, we regularly engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights in order to adhere to industry standard practices. Our collaboration with these third-parties includes regular audits, risk and vulnerability assessments, and consultation on security enhancements.

Overseeing Third-Party Risk

We require that all third-party vendors that have access to or handle sensitive information undergo a risk-based vendor security assessment. Our Governance, Risk and Compliance team conducts security assessments of critical third-party providers before engagement and maintains ongoing annual monitoring to mitigate risks relating to data breaches or other security incidents originating from third-parties.

Risks from Cybersecurity Threats

We have not encountered any incidents from cybersecurity threats to date, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. Although we have not yet been materially impacted by any cybersecurity incident, we are subject to cybersecurity threats, as discussed in Item 1A. Risk Factors, including in the risk factor entitled “We face continually evolving cybersecurity risks, which could result in the loss, theft, misuse, unauthorized disclosure, access, or destruction of confidential information or data, disruption of our solutions, damage to our brands, reputation and relationships with customers, legal exposure and financial losses.”

Governance

The Board of Directors (the “Board”) has established oversight mechanisms designed to manage risks associated with cybersecurity threats.

Board of Directors Oversight

The Board is composed of members who have diverse expertise including, risk and financial management, technology, cybersecurity and finance, equipping the Board with the necessary skill set to effectively oversee cybersecurity risks.

Management’s Role Managing Risk

The Chief Information Security Officer (“CISO”) plays a pivotal role in informing the Board and the Audit Committee on cybersecurity risks and provides comprehensive briefings on a regular basis, with a minimum frequency of three times per year to the Audit Committee and once per year to the full Board. During committee reports, the Audit Committee apprises the full Board of any significant cybersecurity updates. These briefings encompass a broad range of topics, including:

•Current cybersecurity landscape and emerging threats;

•Status of ongoing cybersecurity initiatives and strategies;

•Incident reports and knowledge gleaned from any cybersecurity events; and

•Compliance with regulatory requirements and industry standards.

In addition to our scheduled meetings, the CISO and Chief Executive Officer inform and consult as appropriate with the Board regarding any significant developments in the cybersecurity domain.

The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of security controls and regular system audits to identify potential risks. In the event of a cybersecurity incident, the CISO is equipped with an incident response plan. This plan includes actions to mitigate the impact of any current cybersecurity incidents and long-term strategies for remediation and prevention of future incidents. Our CISO and other dedicated cybersecurity personnel are certified and experienced information systems security professionals and information security managers with decades of experience and industry certifications, including Certified Information Systems Security Professional; Offensive Security Certified Professional; Global Information Assurance Certification; Security Strategic Planning, Policy, and Leadership; and Certified Information Security Manager, among others.

Monitoring Cybersecurity Incidents and Reporting to Board of Directors

The CISO regularly informs the CEO, Chief Legal Officer, Chief Information Officer and in-house data privacy counsel regarding cybersecurity risks and incidents to keep senior management abreast of our cybersecurity posture and potential risks facing Workiva. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board to enable it to provide oversight and guidance on any critical cybersecurity issues.