Company: GPI
Filing Date: 2025-03-20
Form Type: PRE 14A
Source: 0001031203-25-000018
Chunk: 14

Company: GROUP 1 AUTOMOTIVE INC
Filing Date: 2025-03-20
Form: PRE 14A
Chunk 14
---
 meetings, directors receive updates regarding developments in the Company’s business as well as emerging risks.

#### Cybersecurity Risk Oversight
Our Board recognizes the importance of maintaining the trust and confidence of our customers, vendors, shareholders and employees, and devotes significant time and attention to oversight of risks from cybersecurity threats. The Board delegates oversight of our operations risk, including quarterly reviews of cybersecurity and data protection, to the FRM Committee, and delegates compliance with cybersecurity policies to the Audit Committee. Both the FRM Committee and the Audit Committee report to the full Board on cybersecurity matters. Additionally, on an annual basis, management reviews results from tests of key cybersecurity systems with the full Board and the steps taken to mitigate new cybersecurity risks. In particular, the Company seeks to assess, identify and manage cybersecurity risks through various processes, including through a multi-layered risk assessment system, security information and event management system, cybersecurity training and awareness, access controls and encryption and data protection. Our IT and Security team, which is headed by our Chief Information Officer (the “CIO”), is responsible for our efforts to comply with cybersecurity standards, establish industry-recognized protocols and protect the integrity, confidentiality and availability of our IT infrastructure. We engage outside experts as needed to supplement in-house expertise with industry-leading experts for incident response and recovery, digital forensics, penetration testing, and outside counsel specializing in cybersecurity matters. Our CIO and various members of the IT and Security team meet regularly with members of management to address key security and privacy issues, and upon the occurrence of a cybersecurity incident, would convene to assess the materiality of the event as well as the appropriate remediation and escalation procedures, including escalation to our Chief Executive Officer, the FRM Committee, the Audit Committee and the Board.

#### Compensation Risk Oversight
The CHR Committee believes that executive compensation payouts must:

#### •

#### Align with the Company’s financial performance
• Be earned in a manner consistent with Group 1’s Code of Conduct

• Promote long-term, sustainable value creation for shareholders

• Provide fair and equitable pay regardless of race and gender

• Strike a balance between appropriate levels of financial opportunity and risk

#### •

#### Create retention incentives

#### GROUP 1 AUTOMOTIVE2025 PROXY STATEMENT21
The CHR Committee identifies, monitors and mitigates compensation risk in the following ways:

| Sound Incentive Plan Design                                    |     | The CHR Committee establishes financial performance goals that are challenging, yet realistic. Our program design provides a balanced mix of cash and equity, annual