Company: WRBY
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001504776-25-000010
Chunk: 284

Company: Warby Parker Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 284
---
 management program.Our Audit Committee receives reports from management on our cybersecurity risks on at least a quarterly basis, and more frequently as needed. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.Our Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives an annual briefing from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from the Chief Technology Officer (“CTO”) and the Senior Director of Information Security.Our management team, including our CTO and Senior Director of Information Security, are responsible for assessing and managing our material risks from cybersecurity threats, and our Chief Financial Officer and General Counsel are responsible for associated materiality assessments. Our CTO and cybersecurity team have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Their experience includes decades spent managing the security programs of publicly traded corporations, formal cybersecurity education programs from accredited academic institutions, and numerous security certifications such as CISSP, CCSP, CySA+ and AWS Architect & Security Specializations.Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. The Company maintains a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.