Company: RRGB
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001171759-25-000012
Chunk: 51

Company: RED ROBIN GOURMET BURGERS INC
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 51
---
, vulnerabilities, incidents, and prevailing industry trends. After each such report, the Chair of the Audit Committee updates the full Board for transparency and accountability in cybersecurity governance. Additionally, at least annually and as needed from time to time, the Board receives similar cybersecurity updates directly from senior management. Further, the Board oversees cybersecurity as part of our enterprise risk management program.To further bolster the Board's understanding of cybersecurity issues, management facilitates ongoing educational opportunities. The Board routinely engages in discussions with cybersecurity experts on building resilience to cyber risk and receives updates regarding management tabletop exercises. These educational initiatives empower Board members to make informed decisions and actively contribute to the oversight of cybersecurity governance.Currently, our Vice President of Infrastructure and Security assumes primary responsibility for assessing and managing material cybersecurity risks. With experience spanning restaurant, retail, financial, and technology brands, including serving in similar roles overseeing information security programs at other companies, and a degree in Computer Science, our Vice President of Infrastructure and Security brings experience and expertise to the role. Our Vice President of Infrastructure and Security leads a team of professionals who oversee the prevention, detection, and remediation activities within our cybersecurity environment.Our Company has established robust policies and processes governing the assessment, response, and notifications associated with cybersecurity incidents. These protocols ensure a systematic and coordinated approach to incident management, with collaboration among engineering, legal, and senior leadership to oversee compliance with legal and regulatory requirements and have clear mechanisms in place for escalating notifications to our CEO and the Board based on the nature and severity of each incident.

While we have experienced cybersecurity incidents in the past, in the last fiscal year we have not identified risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see “Risk Factors."