Company: CLX
Filing Date: 2025-10-07
Form Type: DEF 14A
Source: 0001552781-25-000311
Chunk: 12

Company: CLOROX CO /DE/
Filing Date: 2025-10-07
Form: DEF 14A
Chunk 12
---
 Board Matters | 31 |

Oversight of Key Risks

Cybersecurity Risk Management and Preparedness

The Company’s technology risk management team is led by our chief information and data officer and our chief information security and infrastructure officer. Some key features of our cybersecurity risk management program:

•Structure that leverages the National Institute of Standards and Technology (NIST) Cybersecurity and Zero Trust Architecture frameworks for managing cybersecurity risks.

•Maintenance of security policies and standards, regular updates to response planning and protocols, and monitoring vulnerabilities, emerging threats and risks through industry information sharing channels and new technology.

•A cybersecurity response plan designed to facilitate cross-functional coordination across the Company (including escalation based on severity of the impact of an incident), mitigate brand and reputational damage, and comply with applicable legal obligations, which includes guidance to support the Company’s assessment of whether an incident is considered “material” for purposes of U.S. securities laws.

•Executive and information technology team tabletop exercises.

•A cybersecurity insurance program to reimburse, up to policy limits, covered costs, losses and claims relating to a data or security breach.

•Use of consultants, third-party service providers and information security firms to provide technology systems or support aspects of this program, conduct assessments of the Company’s cybersecurity practices and penetration testing, and cybersecurity, risk management and legal experts.

•A third-party vendor risk management process that utilizes a risk-based approach for vendors engaged through the Company’s procurement process.

•Cybersecurity awareness training for all employees who have access to company email and connected devices, periodic phishing awareness simulations, and cybersecurity and phishing awareness content on the Company’s intranet site.

The Board, through the Audit Committee, is responsible for oversight of the Company’s compliance with legal and regulatory requirements relating to data privacy, cybersecurity and IT risks and its framework and guidelines with respect to risk assessment and risk management. In order to fulfill its duties, the Audit Committee receives regular updates from our chief information security and infrastructure officer, chief information and data officer, and chief legal and external affairs officer & corporate secretary on these topics. The Board and Audit Committee include directors with knowledge, skills and experience in data security, privacy, IT governance, and management of cyber risk.

Information security and cybersecurity risks are also reviewed by the full Board as part of the Board’s oversight of enterprise risks. The Board also engages in various activities to stay abreast of the evolving cyber landscape.

Sustainability and Climate

The Board actively oversees sustainability risks and issues, including climate change and environmental sustainability policies, programs, goals and