Grocery Outlet Holding Corp.

The Company discloses its cybersecurity risk management and strategy in Item 1C of its 10-K filing. It integrates cybersecurity risks into its Enterprise Risk Management (ERM) process, overseen by the Audit and Risk Committee. The CIO reports to the CEO. The Company has implemented ISO-aligned policies, NIST framework assessments, MDR, vulnerability management, employee training, and third-party vendor reviews. It maintains a written incident response plan and conducts tabletop exercises. While the Company has experienced threats and attempted breaches (including malware/viruses), it states these have not materially affected operations or financial condition in fiscal 2025 or recent years. It carries cyber risk insurance.