Docusign

Cybersecurity Risk Management and Strategy

We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

Our cybersecurity risk management program is guided by industry standards and frameworks, including those published by the National Institute of Standards and Technology (“NIST”), the International Organization for Standardization (“ISO”), and other relevant organizations.

Our cybersecurity risk management program is integrated into our overall enterprise risk management program and utilizes common reporting channels and governance processes that apply across other risk areas. While everyone at our company plays a part in managing cybersecurity risks, as discussed in more detail under “Cybersecurity Governance” below, our board of directors, both directly and through delegation to our Audit Committee (the “Audit Committee”), and our senior management team are actively involved in the oversight of our cybersecurity risk management program. In general, we seek to address and mitigate cybersecurity risks through a comprehensive, cross-functional approach by engaging teams across the business. We expect these teams to operate pursuant to our Standard Operating Procedures. Our approach is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

Our cybersecurity risk management and strategy program includes:

•Our dedicated Security team, which performs periodic risk assessments to identify and assess cybersecurity threats, including threats associated with artificial intelligence and machine learning technologies, vulnerabilities, their severities, and potential mitigations. The team leverages both top-down and bottom-up risk processes and technologies to identify, manage and monitor cyber threats and vulnerabilities. The team also manages our response to cybersecurity incidents.

•Incident Response Playbooks and Standard Operating Procedures outlining procedures for detecting, responding to, and mitigating cybersecurity incidents, including maintaining business continuity and disaster recovery protocols. Depending on the nature and severity of an incident, this process provides procedures for escalating notification to our CEO and the board of directors or relevant committee of the board of directors.

•The use of external service providers, where appropriate, to assess, test or otherwise assist with certain aspects of our security controls and processes, as well as maturity assessments of our cybersecurity program.

•Implementation of new hire and annual data privacy and cybersecurity training of all employees, including senior management; annual role-based training of employees with access to sensitive systems, devices, or locations, and targeted cybersecurity simulation training held on a recurring basis.

•A third-party risk management process that identifies and mitigates cybersecurity threats associated with our use of third-party service providers, including supply chain risks. Such service providers are subject to risk tiering, security risk assessments, and continuous monitoring, including investigation of security incidents that have impacted our third-party service providers, as applicable.

We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. We have not identified any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. We believe our current processes, systems and oversight with respect to the management of risks associated with cybersecurity threats are effective. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding the risks we face from cybersecurity threats, see Item 1A. Risk Factors.

Cybersecurity Governance

Oversight responsibility is shared by our board of directors, our Audit Committee, and management. To facilitate coordinated oversight of cybersecurity matters, our management team provides regular cybersecurity updates to our board of directors and updates on cyber risk management, which include developments regarding our cybersecurity program, broader cybersecurity trends, evolving industry standards, the threat environment and other topics, to the Audit Committee. Together with management, our Audit Committee and board of directors consider this information in

Docusign, Inc. | 2026 Form 10-K | 39

their review of our cybersecurity risks and response to cybersecurity incidents. We also maintain information security risk insurance coverage.

Our Security Governance Council (“Council”) provides strategic guidance for the protection of our information, technology, and physical assets. The Council membership is led by the Chief Information Security Officer (“CISO”) and includes relevant members of senior management. The Council meets periodically to review and assess potential material cybersecurity incidents and other cybersecurity governance matters as warranted. The CISO reports to the Chief Information Officer (“CIO”) and is responsible for management of cybersecurity risks and the protection and defense of our networks, systems and data. The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider risk and regulatory compliance. Our CISO has nearly 30 years of experience in global data security, operations, and risk management, having served in leadership roles at publicly traded technology companies and more than two decades in the U.S. Government.

Members of executive leadership are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described herein, including the operation of our incident response plan. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to members of executive leadership, and the Audit Committee. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.