Company: GROVW
Filing Date: 2025-03-19
Form Type: 10-K
Source: 0001628280-25-013839
Chunk: 93

Company: Grove Collaborative Holdings, Inc.
Filing Date: 2025-03-19
Form: 10-K
Item: Item 1C
Chunk 93
---
Item 1C. Cybersecurity

Cybersecurity Risk Management and Strategy

We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. We invest in cybersecurity to protect intellectual property, customer and employee data, manage reputational risk, and maintain business continuity across our environment. We strive to ensure ongoing compliance with the requirements under applicable standards including the Payment Card Industry Data Security Standards and relevant data privacy and protection laws and regulations. Additionally, our teams reference the standards, guidelines, and practices from the NIST Cybersecurity Framework (CSF) to align our cybersecurity program and risk management practices. The foundation of our cybersecurity framework is based on written policies that govern different cybersecurity process areas.Identifying and assessing cybersecurity risk is part of our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third party assessments, IT Security Risk reviews, external audits and assessments, penetration tests, vulnerability scans, security monitoring activities and recurring review from our internal cybersecurity working group. We respond to cybersecurity incidents and address identified cybersecurity risks through our internal cybersecurity working group and report any material findings and incidents to the audit committee of our board of directors. The cybersecurity incident response process is governed by our Incident Response Plan (“IRP”) and overseen by leaders from our IT security and legal teams. The IRP guides how security events are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.We also conduct tabletop exercises annually, to simulate responses to cybersecurity incidents and ensure accuracy and continuous improvement of the incident response plan. Our team of cybersecurity professionals then collaborate with other stakeholders across our organization to further analyze the risk to the Company and form detection, mitigation and remediation strategies.We are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents.Leveraging our cybersecurity risk management processes, cybersecurity risk factors were identified, which are inherent to our business and industry. The risk factors discussed in this section should be considered together with information included elsewhere in this Annual Report on Form 10-K and should not be considered the only risks to which we are exposed. Additionally, mitigation of these risk factors is tracked by management as part of our cybersecurity maturity roadmap.•Disruptions in