Company: LW
Filing Date: 2025-08-07
Form Type: ARS
Source: 0001679273-25-000063
Chunk: 45

Company: Lamb Weston Holdings, Inc.
Filing Date: 2025-08-07
Form: ARS
Chunk 45
---
-party providers to undertake penetration testing and maturity assessments of the Company’s information security program based on the National Institute of Standards and Technology cybersecurity framework. With respect to third-party service providers, we perform information security assessments and due diligence reviews prior to entering into a contractual agreement. Further, after engagement, we periodically perform information security assessments of certain third-party service providers that we consider critical to our operations. In addition, in new or amended supplier contracts, we look to include provisions that require the suppliers to maintain an effective information 22

security management program and to notify us in the event of a known or suspected cyber incident. For suppliers with required access to our data or systems, a cybersecurity risk assessment is performed to identify potential risk to Company systems or data. If risks are identified, we implement measures to mitigate or remediate the risk and, in cases where we cannot do so effectively, we will not grant access to our data or systems to the supplier. We also consult with external advisors and specialists, as necessary, regarding opportunities and enhancements to strengthen our cybersecurity practices and policies and implement enhancements to our cybersecurity capabilities based on evolving threats. While we have experienced threats to our data and systems, to date, we are not aware of a cybersecurity incident being experienced by the Company that had, or is reasonably likely to have, a material impact on our business or operations; however, because of frequently changing attack techniques and the increased volume and sophistication of the attacks, there is the potential for the Company to be adversely impacted. This impact could result in reputational, competitive, operational, or other business harm as well as financial costs and regulatory action. See “Item 1A. Risk Factors–Technology Risks” of this Form 10-K for additional discussion of cybersecurity risks and potential related impacts on the Company. Corporate Governance Our Board has ultimate oversight of cybersecurity risk, which we manage as part of our ERM program. This program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board on its activities on a quarterly basis or more frequently as warranted. Our cybersecurity program is managed by our interim Chief Information Security Officer (“CISO”), who reports to our Chief Information Officer (“CIO”). Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the Company’s information security team, many of whom hold cybersecurity certifications such as a Certified Information Systems Security Professional or