MongoDB

Cybersecurity Risk Management

At MongoDB, cybersecurity risk management is an integral part of our overall information security program, which we review and update at least annually to reflect changes to our organization, business practices, technology and services, and applicable legislation and regulations. Our information security program is designed to align with the National Institute of Standards and Technology Cyber Security Framework and provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third parties. This framework includes steps for assessing the severity of a cybersecurity threat or incident, identifying the source of a cybersecurity threat or incident including whether the cybersecurity threat or incident is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. In addition, our information security team provides ongoing education to and requires mandatory training at least once annually of all employees. To bolster the security of our products and services, we have appropriate technical and organizational measures in place to protect data that our customers upload to Atlas, which is certified against ISO 27001:2022, ISO 27017:2015, ISO 27018:2019, ISO 9001:2015, SOC 2 Type II, Payment Card Industry Data Security Standard v.4.0.1, and Cloud Security Alliance (“CSA”) Security, Trust, Assurance, Information Security Registered Assessors Program and Risk (“STAR”) Level 2 and are working to complete similar certifications for Voyage AI. We also engage third parties to perform annual audits of our standards-based certifications and we have undergone a Health Insurance Portability and Accountability Act examination validated by a qualified third-party assessor.

Governance

Our board of directors has overall oversight responsibility for our enterprise risk management, and delegates cybersecurity risk management oversight to its Security Committee, which was established in May 2024. The Security Committee is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which the Company is exposed and implement processes and programs designed to manage cybersecurity risks, including mitigation and remediation of cybersecurity threats and incidents. Under the Security Committee charter, the Security Committee meets with our Chief Technology Officer, (“CTO”), and other senior executives on a quarterly basis to perform more in-depth reviews of the Company’s cybersecurity programs, as well as relevant cybersecurity risks and mitigation strategies. Ahead of each such quarterly meeting, management, including the CTO and our information security team, prepares and provides cybersecurity reports that cover, among other topics, developments in cybersecurity and updates to the company’s cybersecurity programs and mitigation strategies, legislative developments affecting MongoDB's information security program, and notable security incidents and investigations. The Security Committee subsequently reports material cybersecurity matters to our full board of directors. In addition, our management follows a risk-based escalation process to notify the Security Committee outside of the regular reporting cycle when they identify an emerging cybersecurity risk.

Our cybersecurity programs are under the direction of our CTO, who receives reports from our security teams and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CTO and key security leaders are certified and experienced information systems security professionals, security engineers, and information security managers each with well over a decade of experience. Our CTO and security teams, along with our management, are responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining our cybersecurity programs.

Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see “Risk Factors – Risks Related to our Business and Industry” in this annual report on Form 10-K.