Company: CAVA
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-007882
Chunk: 140

Company: CAVA GROUP, INC.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 140
---
 collective defense of our industries.We have a process to oversee and identify material risks from cybersecurity threats associated with the use of third-party service providers.  We conduct a third-party risk assessment program through the use of assessment templates, surveys and contractual requirements that evaluates certain potential and current vendors in connection with our security standards.  If, following an evaluation, a third-party’s cybersecurity controls are assessed by us as inadequate based on risk, we work with our business partners to engage a replacement vendor and remediate or seek to reduce our exposure, if any.While we are subject to continuous cybersecurity threats and attacks like most companies, we are not aware of any current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.  However, as discussed more fully under Item 1A. “Risk Factors,” cybersecurity threats are continually evolving to become more sophisticated and there is a risk that we could experience compromise of our information technology systems and data.  Accordingly, while we continue to make significant investment in physical and technological security measures, including third-party services designed to help us anticipate cyber-attacks and prevent breaches, we cannot provide assurance that we will be successful in adequately responding to, or preventing, cyber-attacks. We also maintain cybersecurity insurance that is regularly reviewed to assess whether there is appropriate coverage.

Governance

Role of the BoardThe Audit Committee of the Board of Directors is responsible for the primary oversight of strategic risk, including cybersecurity risk oversight. The Audit Committee receives regular reports on at least a quarterly basis from our cybersecurity team, typically on, among other things, our cybersecurity posture, cybersecurity benchmarking, potential cybersecurity vulnerabilities, and other cybersecurity interest items such as the external cybersecurity environment, items requiring Audit Committee input, and our broader cybersecurity program roadmap, in order to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents.  The Audit Committee regularly reports to the full Board of Directors regarding its activities, including those related to cybersecurity.

41

Role of ManagementWe have established a management-level Risk Committee, that is led by the Chief Legal Officer, and also includes the Chief Information Officer and Chief Financial Officer, as well as certain of their respective Team Members.  The Risk Committee meets on at least a quarterly basis to review enterprise risks, including with respect to cybersecurity, as applicable. Enterprise risks, including cybersecurity risk, are briefed to the Audit Committee on at least a quarterly basis by our Chief Legal Officer in coordination with the Chief Information Officer and Chief Financial Officer,