Commvault Systems

Risk Management and Strategy

Commvault has established a cybersecurity program designed to protect the company, our customers, partners and other stakeholders. The cybersecurity program includes policies, processes and practices that are designed to assess, identify and manage material risks from cybersecurity threats and is integrated into our enterprise risk management program. Led by the Chief Security Officer ("CSO"), Commvault’s cybersecurity program leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, with the primary objective of securing systems and data from cyber threats. We partner with industry-leading cybersecurity experts for continuous monitoring, alerting, mitigation and responsiveness related to our cybersecurity program. We adopt industry best practices and security technologies and have established a Security Incident Response Plan ("SIRP") which outlines our processes for incident preparation, detection, analysis, containment, eradication, and post-incident analysis. In addition to the SIRP, we maintain a Crisis Management Plan to organize roles and responsibilities in the event of a crisis, a Disaster Recovery Plan to provide guidance in the recovery of systems following an outage, and a Business Continuity Plan to identify alternative means of conducting business in the event of business disruption. We partner with third party service providers to enhance our monitoring and response capabilities, facilitate readiness activities including tabletop exercises, and perform various methods of cybersecurity penetration testing. All employees are required to undergo annual security awareness training on current and potential cybersecurity threats and report suspicious activity. We assess cybersecurity risks associated with third-party service providers through diligence, evaluation of provider cybersecurity controls, contractual protections and ongoing oversight, as appropriate.

Commvault maintains a variety of third-party certifications and undergoes annual assessments for SOC 2 Type 2, ISO 27001, HIPAA, and PCI DSS. Commvault also undergoes periodic assessments and testing in support of these certifications and compliance frameworks, and our products undergo security testing as part of these processes. Annually, internal auditors also perform risk-based reviews of certain business operations and control environments, and relevant findings, observations and recommendations are shared with Management, including the CEO, CFO, Chief Accounting Officer, Chief Trust Officer, CSO, Deputy Chief Information Security Officer ("Deputy CISO"), and Chief Information Officer ("CIO"), Chief Products Officer, and with the Audit Committee, and escalated to the full Board, as appropriate.

Given the increasingly complex and sophisticated cyber threat landscape, we seek to identify, assess, and mitigate cybersecurity threats. Commvault has prioritized cyber resilience measures and leverages governance processes and procedures to mitigate potential business impacts if and when an adverse event occurs. To date, we are not aware of any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Commvault, including its business strategy, results of operations or financial condition. Although no material impacts have been recorded to date, IT system failures, network disruptions, cybersecurity incidents, and data breaches could adversely impact our business, internal controls, results of operations, and financial condition.

For additional description of cybersecurity risks and potential related impacts on Commvault, refer to the risk factor captioned "Risks Related to Technology and Security – We may be subject to IT system failures, network disruptions, cybersecurity incidents and breaches in data security" in Part I, Item 1A. "Risk Factors."

Governance

Commvault’s Board of Directors (the "Board") provides oversight of Commvault’s enterprise risk management strategy, which includes risks from cybersecurity threats. The Audit Committee receives quarterly briefings from the CSO on the cybersecurity program, material cybersecurity threats and incidents, and related mitigation and response activities. The Audit Committee also receives updates from the Chief Trust Officer on the Enterprise Risk Management Committee ("ERMC"). The Board is kept apprised of cybersecurity matters through quarterly reporting from the Audit Committee Chair and annual, or as needed, reporting directly from the CSO.

Commvault’s Management, including the Chief Financial Officer, Chief Trust Officer, CSO, Deputy CISO, CIO, and Chief Products Officer, is responsible for our cybersecurity risk management strategy, operational

decision-making, and incident preparedness and response. The current CSO holds a Bachelor of Science and Master of Business Administration from the University of Maryland, holds industry certifications including CISSP, PMP, CIPP/E, CIPP/US and CISA, is affiliated with various industry working groups focused on threat intelligence and privacy, and has over twenty years of experience in cybersecurity leading technical, operational, and strategic programs to protect critical data and infrastructure.

Management ensures cybersecurity risks are communicated through the ERMC and regular, or as needed, reporting to the Audit Committee and the Board. The ERMC is responsible for the implementation, maintenance, and execution of our enterprise risk management program. The ERMC meets quarterly, or as needed, to assess, consider, and manage material risks, including cybersecurity threats across the business. Management also uses the SIRP and related escalation procedures to evaluate and respond to cybersecurity incidents and to determine whether escalation to the Audit Committee, the Board, or external disclosure processes is appropriate. An Executive Security Council is responsible for the significant operational decisions in the event of an active cybersecurity incident. The Executive Security Council meets monthly, or as needed, with the Audit Committee Chair as an optional attendee, to provide counsel and foster productive communication between Management and the Board.