Asbury Automotive Group, Inc.

• •Conduct regular training for cybersecurity awareness of employees, senior executives, and vendors
• •Perform phishing and social engineering simulations
• •Provide cybersecurity training for personnel with Company email and access
• •Disseminate security awareness communications to highlight emerging threats
• •Housed information and data security training in a Learning Management System (LMS)
• •Migrate acquired companies into current LMS
• •Chief Information Officer oversees cybersecurity, data privacy, and information security procedures
• •Maintain formal team of analysts
• •Board of Directors maintains ultimate oversight of enterprise risk management program
• •Audit committee oversees adequacy and effectiveness of internal controls
• •CIO reports on cybersecurity matters to audit committee quarterly
• •Audit committee provides updates to Board of Directors at regular meetings
• •Conduct security assessments of third-party providers before engagement
• •Establish monitoring procedures to mitigate risks related to data breaches from third parties
• •Engage third-party consultants, legal advisors, and audit firms
• •Employ multi-layered cybersecurity risk management program
• •Perform penetration tests, internal tests/code reviews, and simulations
• •Utilize Service Organization Controls (SOC)-as-a-Service
• •Utilize Security Information and Event Management (SIEM) software
• •Utilize Endpoint Detection and Response (EDR) software
• •Utilize Cloud monitoring
• •Maintain disaster recovery and incident response plans, including ransomware response plan

DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).