UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM SD

SPECIALIZED DISCLOSURE REPORT

QUALYS, INC.

(Exact name of registrant as specified in its charter)

919 E. Hillsdale Boulevard, 4th Floor, Foster City, California 94404

(Address of principal executive offices) (Zip Code)

Bruce K. Posey, Chief Legal Officer and Corporate Secretary

(650) 801-6100

(Name and telephone number, including area code, of the person to contact in connection with this report)

Check the appropriate box to indicate the rule pursuant to which this form is being filed, and provide the period to which the information in this form applies:

SECTION 1 – CONFLICT MINERALS DISCLOSURE

Conflict Minerals Disclosure

This Specialized Disclosure Report on Form SD and the Conflict Minerals Report, filed as Exhibit 1.01 to this Form SD, are publicly available at https://investor.qualys.com/financials-filings/sec-filings.

The Conflict Minerals Report required by Item 1.01 is filed as Exhibit 1.01 to this Form SD.

SECTION 3 – EXHIBITS

Exhibit 1.01 – 2023 Conflict Minerals Report of Qualys, Inc. as required by Items 1.01 and 1.02 of this Form SD.

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the duly authorized undersigned.

Date: May 30, 2024

Exhibit 1.01

Qualys, Inc.

Conflict Minerals Report

For the Reporting Period from January 1, 2023 to December 31, 2023

This Conflict Minerals Report (this “Report”) of Qualys, Inc. (“we,” “Qualys” or the “Company”) has been prepared pursuant to Rule 13p-1 and Form SD (the “Rule”) promulgated under the Securities Exchange Act of 1934, as amended, for the reporting period from January 1, 2023 to December 31, 2023 (the “Reporting Period”).

The Rule requires disclosure of certain information when a company manufactures or contracts to manufacture products where the minerals specified in the Rule are necessary to the functionality or production of those products. The specified minerals are referred to as “Conflict Minerals,” which include gold, columbite-tantalite (coltan), cassiterite, wolframite and their derivatives, which are limited to tantalum, tin and tungsten. The “Covered Countries” for purposes of the Rule and this Report are the Democratic Republic of Congo (the “DRC”), the Republic of Congo, the Central African Republic, South Sudan, Uganda, Rwanda, Burundi, Tanzania, Zambia and Angola.

Company Overview

We are a pioneer and leading provider of a cloud-based platform delivering information technology (“IT”), security and compliance solutions that enable organizations to identify security risks to their IT infrastructures, help protect their IT systems and applications from ever-evolving cyber-attacks and achieve compliance with internal policies and external regulations.

Our cloud platform addresses the growing IT, security and compliance complexities and risks that are amplified by the dissolving boundaries between IT infrastructures and web environments, the rapid adoption of cloud computing, containers and serverless IT models, and the proliferation of geographically dispersed IT assets. Our integrated suite of IT, security and compliance solutions delivered on Qualys’ Enterprise TruRisk Platform enables our customers to identify and manage their IT and operational technology (“OT”) assets, collect and analyze large amounts of IT security data, discover and prioritize vulnerabilities, quantify cyber risk exposure, recommend and implement remediation actions and verify the implementation of such actions. Organizations use our integrated suite of solutions to cost-effectively obtain a unified view of their internal and external IT and OT asset inventory as well as security and compliance posture across globally-distributed IT infrastructures as our solution offers a single platform for information technology, information security, application security, endpoint, developer security and cloud teams.

Our cloud platform utilizes physical and virtual sensors, and cloud agents that provide our customers with continuous visibility enabling customers to respond to threats immediately. Our cloud platform automatically gathers and analyzes security and compliance data in a scalable, state-of-the-art backend. The technology underlying our cloud infrastructure enables us to ingest, process, analyze and store a high volume of sensor data coming from our agents, scanners and passive analyzers, and correlate information at very high speeds in a distributed manner for millions of devices.

Description of the Company’s Products Covered by this Report

This Report relates to our physical scanner appliances: (1) for which Conflict Minerals are necessary to their functionality or production, (2) that were manufactured, or contracted to be manufactured, by the Company, and (3) for which the manufacture was completed during the Reporting Period. In this Report, we refer to these products collectively as the “Covered Products.”

Description of the Company’s Reasonable Country of Origin Inquiry

We have determined that Conflict Minerals are necessary to the functionality or production of the Covered Products that were manufactured or contracted to be manufactured by us during the Reporting Period. As a result, we conducted in good faith a reasonable country of origin inquiry (“RCOI”) reasonably designed to determine if any of these Conflict Minerals originated in the Covered Countries and whether any of the Conflict Minerals may be from recycled or scrap sources.

Our supply chain is complex, and there are many third parties in the supply chain between the ultimate manufacturer of the Covered Products and the original sources of Conflict Minerals. We do not directly purchase Conflict Minerals from mines, smelters or refiners. Therefore, we must rely on our contract manufacturers to provide information regarding the country of origin of Conflict Minerals that are included in the Covered Products. In designing our RCOI, we determined to survey all of our first tier contract manufacturers.

As such, our RCOI primarily consisted of requesting the Conflict-Free Sourcing Initiative’s (“CFSI”) Conflict Minerals Reporting Template (“CMRT”) be completed and returned to us from our first tier contract manufacturers. Responses were reviewed for completeness, reasonableness, and consistency, and we followed up with our contract manufacturers for corrections and clarifications as needed.

We requested from our seven contract manufacturers that they complete the CMRT, and we received a 100% response rate. Based on the smelter lists provided by our suppliers via the CMRTs, an aggregate of 352 facilities or smelters were used by our contract manufacturers to fulfill their requirements for Conflict Minerals. Of these 352 facilities and smelters, we have identified 223 facilities or smelters that are deemed to be compliant with the Conflict-Free Smelter Program (“CFSP”). There are four other smelters or refiners that are deemed “active” by the CFSP, which means such smelters or refiners have committed to undergo a CFSP audit or are participating in one of the cross-recognized certification programs: LBMA Responsible Gold Certification or Responsible Jewelry Program Chain-of-Custody Certification. The remaining 125 facilities or smelters identified by our contract manufacturers are not on the CFSI lists for compliant or active smelters. We have assessed these 125 facilities and determined that most of these are of low risk due to their geographic location. There is one smelter or refiner that may be considered at greater risk because it is geographically located in a Covered Country. Further, there is no guarantee that these 125 facilities or smelters are present in our supply chain as our contract manufacturers were only able to provide company-level CMRTs, rather than product-level CMRTs directly linking smelters or refiners to the Covered Products.

Based on these due diligence efforts, we do not have sufficient information to conclusively determine the countries of origin of the Conflict Minerals contained in the Covered Products or whether the Conflict Minerals in the Covered Products are from recycled or scrap sources.

Description of the Company’s Due Diligence Process

Based on the information provided by our contract manufacturers, we performed additional due diligence on the source and chain of custody of these Conflict Minerals which was designed to conform to the Organisation for Economic Co-operation and Development (“OECD”) Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas, including the related supplements on gold, tin, tantalum and tungsten (the “Framework”), in order to determine if any Conflict Minerals included in our Covered Products may have originated in the Covered Countries and if so, whether they benefited armed groups in those countries.

After performing the RCOI and due diligence designed to conform with the Framework, we were unable to comprehensively establish the origin of all Conflict Minerals used in our Covered Products, the facilities used to process them, their country of origin, and their mine or location of origin.

In accordance with the five-step Framework, the design of our due diligence includes the following five steps: (1) establishment of strong company management systems, (2) identification and assessment of risks in the supply chain, (3) designing and implementing a strategy to respond to identified risks, (4) carrying out an independent third-party audit of smelter’s/refiner’s due diligence practices, and (5) reporting on supply chain due diligence. A description of certain activities undertaken by us with respect to each of the five steps of the Framework is described below.

1. Establishment of Strong Company Management Systems

We have completed a number of steps to establish a management system for addressing the sourcing of Conflict Minerals in our Covered Products. These actions include:

Lastly, we have communicated to our contract vendors who have listed facilities or smelters which have an indeterminable status, that we are evaluating their responses and may elect to seek alternative arrangements with other contract manufacturers. We expect to continue our efforts to ensure that the minerals in our products do not originate from the Covered Countries and do not directly or indirectly finance armed conflict or benefit armed groups.

2. Identification and Assessment of Risks in the Supply Chain

Because of our position within our supply chain, it is difficult for us to identify actors upstream from our first tier contract manufacturers. As discussed above, we identified seven first tier contract manufacturers and we have relied upon them to provide us with the necessary information about the source of Conflict Minerals contained in the products that we contract with them to manufacture for us. Our contract manufacturers are similarly reliant upon information provided by their suppliers to provide information regarding the country of origin of Conflict Minerals that are included in the Covered Products.

3. Designing and Implementing a Strategy to Respond to Identified Risks

We address any risks identified through the process described in Step 2 above on a case-by-case basis. During the Reporting Period, when our contract manufacturers did not provide us with complete or reliable responses to the CMRT, such matters were reported to members of our executive management team who considered a variety of responses to such manufacturers, including seeking alternative arrangements, with the further input from our internal compliance team. However, we have not yet identified any circumstances to date where it was necessary to terminate a contract or find a replacement contract manufacturer.

4. Carrying Out Independent Third-Party Audit of Supply Chain Due Diligence at Identified Points in the Supply Chain

We do not have a direct relationship with any smelters or refiners in our supply chain and, therefore, we do not directly conduct audits. Instead, we have supported the development and implementation of independent third party audits of smelters such as the Conflict-Free Smelter Program by encouraging our contract manufacturers to purchase materials from audited, conflict-free smelters and determining whether the smelters that were used to process these minerals were validated as conflict-free as part of the Conflict-Free Smelter Program.

5. Reporting on Supply Chain Due Diligence

In 2023, we publicly filed the Form SD and this Report with the SEC, and a copy of this Report and the Form SD are publicly available at https://investor.qualys.com/financials-filings/sec-filings.

This Report includes information about the RCOI we undertook, our due diligence process designed to conform with the OECD Guidelines, the list of known smelters and refiners utilized in our supply chain identified in our due diligence process, and a description of our products that incorporate Conflict Minerals necessary to the functionality or production of such products.

Findings and Conclusions

Based on the information that was provided by our contract manufacturers and otherwise obtained through the due diligence process, we believe that, to the extent reasonably determinable, the facilities that were used to process the Conflict Minerals contained in the Covered Products included the smelters and refiners listed in Annex I below.

This table includes only facilities that are listed in the CMRT as “known smelters or refineries.” An indication of “Full Compliant” in the far right column of the table indicates that the smelter or refinery has received a “conflict free” designation from an independent third party audit program. An indication of “Active” in the far right column of the table indicates that the smelter or refinery has committed to undergo a CFSP audit or is participating in one of the cross-recognized certification programs: LBMA Responsible Gold Certification or Responsible Jewelry Program Chain-of-Custody Certification. An indication of “Indeterminable” in the far right column of the table indicates that the smelter or refinery was not included in the CFSI compliant or active lists and thus, the facility’s designation is indeterminable.

Because the CFSI lists generally did not indicate individual countries of origin of the Conflict Minerals processed by compliant smelters and refiners, we were not able to determine the countries of origin of the Conflict Minerals processed by the listed compliant smelters and refiners with greater specificity. In addition, for the listed compliant smelters and refiners, origin information is not disclosed by the CFSI. Furthermore, as stated earlier, submission of these smelters by our contract manufacturers does not guarantee that these smelters or refiners are present in the Company’s supply chain as our contract manufacturers were only able to provide company-level CMRTs and not able to provide product-level CMRTs directly linking those smelters or refiners to the Covered Products. Therefore, based on our due diligence efforts, we do not have sufficient information to conclusively determine the countries of origin of the Conflict Minerals contained in the Covered Products or whether the Conflict Minerals in the Covered Products are from recycled or scrap sources.

ANNEX I- SMELTER LIST

Future Steps

We have communicated our expectations to our contract manufacturers regarding our commitment to sourcing minerals for our products in a manner that does not finance or benefit armed groups in the Covered Countries. Since the end of 2023, we have continued, and plan to continue, our engagement with our relevant first-tier contract manufacturers in order to build their knowledge and capacity so they are able to provide us with more complete and accurate information on the source and chain of custody of Conflict Minerals in our supply chain.

Additional Risk Factors

The statements above are based on the RCOI process and due diligence performed in good faith by Qualys. These statements are based on the infrastructure and information available at the time. A number of factors could introduce errors or otherwise affect our Conflict Minerals status. These factors include, but are not limited to, gaps in supplier data, gaps in smelter data, errors or omissions by suppliers, errors or omissions by smelters, the definition of a smelter not being finalized at the end of the 2023 reporting period, all instances of Conflict Minerals necessary to the functionality or manufacturing of our products possibly not yet having been identified, gaps in supplier education and knowledge, timeliness of data, public information not discovered during a reasonable search, errors in public data, language barriers and translation, supplier and smelter unfamiliarity with the protocol, oversight or errors in conflict free smelter audits, Covered Countries’ sourced materials being declared secondary materials, companies going out of business in 2023, certification programs being not equally advanced for all industry segments and metals, and smuggling of Conflict Minerals from the Covered Countries to other countries.