UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM SD

SPECIALIZED DISCLOSURE REPORT

QUALYS, INC.

(Exact name of registrant as specified in its charter)

919 E. Hillsdale Boulevard, 4th Floor, Foster City, California 94404

(Address of principal executive offices) (Zip Code)

Bruce K. Posey, Vice President, General Counsel and Corporate Secretary

(650) 801-6100

(Name and telephone number, including area code, of the person to contact in connection with this report)

Check the appropriate box to indicate the rule pursuant to which this form is being filed, and provide the period to which the information in this form applies:

Section 1 – Conflict Minerals Disclosure

Item 1.01 Conflict Minerals Disclosure and Report

With respect to the reporting period from January 1, 2018 to December 31, 2018, Qualys, Inc. (“Qualys” or the “Company”) evaluated its current products and determined that certain products it manufactures, or causes to be manufactured, contain gold, columbite-tantalite (coltan), cassiterite and wolframite, including their derivatives (“Conflict Minerals”). Following this initial determination, the Company conducted a reasonable country of origin inquiry and additional due diligence designed to conform with the Organisation for Economic Co-operation and Development Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas, including the related supplements on gold, tin, tantalum and tungsten (the “Framework”), in order to determine whether the Conflict Minerals contained in the Company’s products originated from the Democratic Republic of Congo, the Republic of Congo, the Central African Republic, South Sudan, Uganda, Rwanda, Burundi, Tanzania, Zambia or Angola (collectively, the “Covered Countries”).

Based on these due diligence efforts, the Company has reason to believe that certain Conflict Minerals contained in its products may have originated in the Covered Countries and may not be Conflict Minerals from recycled or scrap sources. However, the Company does not have sufficient information to conclusively determine the countries of origin of the Conflict Minerals contained in its products or whether such Conflict Minerals are from recycled or scrap sources. The Company conducted due diligence on the source and chain of custody of these Conflict Minerals and prepared the Conflict Minerals Report attached hereto as Exhibit 1.01.

Conflict Minerals Disclosure

This Form SD of Qualys is filed pursuant to Rule 13p-1 promulgated under the Securities Exchange Act of 1934, as amended, for the reporting period from January 1, 2018 to December 31, 2018.

A copy of Qualys’s Conflict Minerals Report is provided as Exhibit 1.01 to this Form SD, and is publicly available at https://investor.qualys.com/financials-filings/sec-filings.

Item 1.02 Exhibit

As specified in Section 2, Item 2.01 of this Form SD, Qualys is hereby filing its Conflict Minerals Report as Exhibit 1.01 to this Form SD.

Section 2 – Exhibits

Item 2.01 Exhibits.

Exhibit 1.01 – 2018 Conflict Minerals Report of Qualys, Inc. as required by Items 1.01 and 1.02 of this Form SD.

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the duly authorized undersigned.

Date: May 31, 2019

Exhibit 1.01

Qualys, Inc.

Conflict Minerals Report

For The Reporting Period from January 1, 2018 to December 31, 2018

This Conflict Minerals Report (this “Report”) of Qualys, Inc. (“we,” “Qualys” or the “Company”) has been prepared pursuant to Rule 13p-1 and Form SD (the “Rule”) promulgated under the Securities Exchange Act of 1934, as amended, for the reporting period from January 1, 2018 to December 31, 2018 (the “Reporting Period”).

The Rule requires disclosure of certain information when a company manufactures or contracts to manufacture products where the minerals specified in the Rule are necessary to the functionality or production of those products. The specified minerals are referred to as “Conflict Minerals,” which include gold, columbite-tantalite (coltan), cassiterite, wolframite and their derivatives, which are limited to tantalum, tin and tungsten. The “Covered Countries” for purposes of the Rule and this Report are the Democratic Republic of Congo (the “DRC”), the Republic of Congo, the Central African Republic, South Sudan, Uganda, Rwanda, Burundi, Tanzania, Zambia and Angola.

Company Overview

We are a pioneer and leading provider of a cloud-based platform delivering security and compliance solutions that enable organizations to identify security risks to their information technology (IT) infrastructures, help protect their IT systems and applications from ever-evolving cyber-attacks and achieve compliance with internal policies and external regulations. Our cloud solutions address the growing security and compliance complexities and risks that are amplified by the dissolving boundaries between internal and external IT infrastructures and web environments, the rapid adoption of cloud computing, containers and serverless IT models, and the proliferation of geographically dispersed IT assets. Our integrated suite of security and compliance solutions delivered on our Qualys cloud platform (Qualys Cloud Platform) enables our customers to identify and manage their IT assets, collect and analyze large amounts of IT security data, discover and prioritize vulnerabilities, recommend remediation actions and verify the implementation of such actions. Organizations use our integrated suite of solutions delivered on our Qualys Cloud Platform to cost-effectively obtain a unified view of their IT asset inventory as well as security and compliance posture across globally-distributed IT infrastructures as our solution offers a single platform for information technology, information security, application security, endpoint, developer security and cloud teams.

Our cloud platform utilizes physical and virtual sensors, and cloud agents that provide our customers with continuous visibility enabling customers to respond to threats immediately. The Qualys Cloud Platform automatically gathers and analyzes security and compliance data in a scalable, state-of-the-art backend. The technology underlying our cloud infrastructure enables us to ingest, process, analyze and store a high volume of sensor data coming from our agents, scanners and passive analyzers, and correlate information at very high speeds in a distributed manner for millions of devices.

Description of the Company’s Products Covered by this Report

This Report relates to our managed scanner appliances: (i) for which Conflict Minerals are necessary to their functionality or production, (ii) that were manufactured, or contracted to be manufactured, by the Company, and (iii) for which the manufacture was completed during the Reporting Period. In this Report, we refer to these products collectively as the “Covered Products.”

Description of the Company’s Reasonable Country of Origin Inquiry

We have determined that Conflict Minerals are necessary to the functionality or production of the Covered Products that were manufactured or contracted to be manufactured by us during the Reporting Period. As a result, we conducted in good faith a reasonable country of origin inquiry (“RCOI”) reasonably designed to determine if any of these Conflict Minerals originated in the Covered Countries and whether any of the Conflict Minerals may be from recycled or scrap sources.

Our supply chain is complex, and there are many third parties in the supply chain between the ultimate manufacturer of the Covered Products and the original sources of Conflict Minerals. We do not directly purchase Conflict Minerals from mines, smelters or refiners. Therefore, we must rely on our contract manufacturers to provide information regarding the country of origin of Conflict Minerals that are included in the Covered Products. In designing our RCOI, we determined to survey all of our first tier contract manufacturers.

As such, our RCOI primarily consisted of requesting the Conflict-Free Sourcing Initiative’s (“CFSI”) Conflict Minerals Reporting Template (“CMRT”) be completed and returned to us from our first tier contract manufacturers. Responses were reviewed for completeness, reasonableness, and consistency, and we followed up with our contract manufacturers for corrections and clarifications as needed.

We requested from our eight contract manufacturers that they complete the CMRT, and we received a 100% response rate. One manufacturer reported that it did not source from the Covered Countries. Based on the smelter lists provided by our suppliers via the CMRTs, an aggregate of 297 facilities or smelters were used by our contract manufacturers to fulfill their requirements for Conflict Minerals. Of these 297 facilities and smelters, we have identified 253 facilities or smelters that are deemed to be compliant with the Conflict-Free Smelter Program (“CFSP”). There are two more smelters or refiners that are deemed “active” by the CFSP, which means such smelters or refiners have committed to undergo a CFSP audit or are participating in one of the cross-recognized certification programs: LBMA Responsible Gold Certification or Responsible Jewelry Program Chain-of-Custody Certification. The remaining 42 facilities or smelters identified by our contract manufacturers are not on the CFSI lists for compliant or active smelters. We have assessed these 42 facilities and determined that most of these are of low risk due to their geographic location. There are two smelters or refiners that may be considered at greater risk because they are geographically located in Africa. However, there is no guarantee that these 42 facilities or smelters are present in our supply chain as our contract manufacturers were only able to provide company-level CMRTs, rather than product-level CMRTs directly linking smelters or refiners to the Covered Products.

Based on these due diligence efforts, we do not have sufficient information to conclusively determine the countries of origin of the Conflict Minerals contained in the Covered Products or whether the Conflict Minerals in the Covered Products are from recycled or scrap sources.

Description of the Company’s Due Diligence Process

Based on the information provided by our contract manufacturers, we performed additional due diligence on the source and chain of custody of these Conflict Minerals which was designed to conform to the Organisation for Economic Co-operation and Development (“OECD”) Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas, including the related supplements on gold, tin, tantalum and tungsten (the “Framework”), in order to determine if any Conflict Minerals included in our Covered Products may have originated in the Covered Countries and if so, whether they benefited armed groups in those countries.

After performing the RCOI and due diligence designed to conform with the Framework, we were unable to comprehensively establish the origin of all Conflict Minerals used in our Covered Products, the facilities used to process them, their country of origin, and their mine or location of origin.

In accordance with the five-step Framework, the design of our due diligence includes the following five steps: (i) establishment of strong company management systems, (ii) identification and assessment of risks in the supply chain, (iii) designing and implementing a strategy to respond to identified risks, (iv) carrying out an independent third-party audit of smelter’s/refiner’s due diligence practices, and (v) reporting on supply chain due diligence. A description of certain activities undertaken by us with respect to each of the five steps of the Framework is described below.

We have completed a number of steps to establish a management system for addressing the sourcing of Conflict Minerals in our Covered Products. These actions include:

Lastly, we have communicated to our contract vendors who have listed facilities or smelters which have an indeterminable status, that we are evaluating their responses and may elect to seek alternative arrangements with other contract manufacturers. We expect to continue our efforts to ensure that the minerals in our products do not originate from the Covered Countries and do not directly or indirectly finance armed conflict or benefit armed groups.

Because of our position within our supply chain, it is difficult for us to identify actors upstream from our first tier contract manufacturers. As discussed above, we identified eight first tier contract manufacturers and we have relied upon them to provide us with the necessary information about the source of Conflict Minerals contained in the products that we contract with them to manufacture for us. Our contract manufacturers are similarly reliant upon information provided by their suppliers to provide information regarding the country of origin of Conflict Minerals that are included in the Covered Products.

We address any risks identified through the process described in Step 2 above on a case-by-case basis. During the Reporting Period, when our contract manufacturers did not provide us with complete or reliable responses to the CMRT, such matters were reported to members of our executive management team who considered a variety of responses to such manufacturers, including seeking alternative arrangements, with the further input from our internal compliance team. However, we have not yet identified any circumstances to date where it was necessary to terminate a contract or find a replacement contract manufacturer.

We do not have a direct relationship with any smelters or refiners in our supply chain and, therefore, we do not directly conduct audits. Instead, we have supported the development and implementation of independent third party audits of smelters such as the Conflict-Free Smelter Program by encouraging our contract manufacturers to purchase materials from audited, conflict-free smelters and determining whether the smelters that were used to process these minerals were validated as conflict-free as part of the Conflict-Free Smelter Program.

In 2018, we publicly filed the Form SD and this Report with the SEC, and a copy of this Report and the Form SD are publicly available at https://investor.qualys.com/financials-filings/sec-filings.

This Report includes information about the RCOI we undertook, our due diligence process designed to conform with the OECD Guidelines, the list of known smelters and refiners utilized in our supply chain identified in our due diligence process, and a description of our products that incorporate Conflict Minerals necessary to the functionality or production of such products.

Findings and Conclusions

Based on the information that was provided by our contract manufacturers and otherwise obtained through the due diligence process, we believe that, to the extent reasonably determinable, the facilities that were used to process the Conflict Minerals contained in the Covered Products included the smelters and refiners listed in Annex I below.

This table includes only facilities that are listed in the CMRT as “known smelters or refineries.” An indication of “Full Compliant” in the far right column of the table indicates that the smelter or refinery has received a “conflict free” designation from an independent third party audit program. An indication of “Active” in the far right column of the table indicates that the smelter or refinery has committed to undergo a CFSP audit or is participating in one of the cross-recognized certification programs: LBMA Responsible Gold Certification or Responsible Jewelry Program Chain-of-Custody Certification. An indication of “Indeterminable” in the far right column of the table indicates that the smelter or refinery was not included in the CFSI compliant or active lists and thus, the facility’s designation is indeterminable.

Because the CFSI lists generally did not indicate individual countries of origin of the Conflict Minerals processed by compliant smelters and refiners, we were not able to determine the countries of origin of the Conflict Minerals processed by the listed compliant smelters and refiners with greater specificity. In addition, for the listed compliant smelters and refiners, origin information is not disclosed by the CFSI. Furthermore, as stated earlier, submission of these smelters by our contract manufacturers does not guarantee that these smelters or refiners are present in the Company’s supply chain as our contract manufacturers were only able to provide company-level CMRTs and not able to provide product-level CMRTs directly linking those smelters or refiners to the Covered Products. Therefore, based on our due diligence efforts, we do not have sufficient information to conclusively determine the countries of origin of the Conflict Minerals contained in the Covered Products or whether the Conflict Minerals in the Covered Products are from recycled or scrap sources.

ANNEX I- SMELTER LIST

Future Steps

We have communicated our expectations to our contract manufacturers regarding our commitment to sourcing minerals for our products in a manner that does not finance or benefit armed groups in the Covered Countries. Since the end of 2018, we have continued, and plan to continue, to increase our engagement with our relevant first-tier contract manufacturers in order to build their knowledge and capacity so they are able to provide us with more complete and accurate information on the source and chain of custody of Conflict Minerals in our supply chain.

Additional Risk Factors

The statements above are based on the RCOI process and due diligence performed in good faith by Qualys. These statements are based on the infrastructure and information available at the time. A number of factors could introduce errors or otherwise affect our Conflict Minerals status. These factors include, but are not limited to, gaps in supplier data, gaps in smelter data, errors or omissions by suppliers, errors or omissions by smelters, the definition of a smelter not being finalized at the end of the 2018 reporting period, all instances of Conflict Minerals necessary to the functionality or manufacturing of our products possibly not yet having been identified, gaps in supplier education and knowledge, timeliness of data, public information not discovered during a reasonable search, errors in public data, language barriers and translation, supplier and smelter unfamiliarity with the protocol, oversight or errors in conflict free smelter audits, Covered Countries’ sourced materials being declared secondary materials, companies going out of business in 2018, certification programs being not equally advanced for all industry segments and metals, and smuggling of Conflict Minerals from the Covered Countries to other countries.