Company: CAVA
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-007882
Chunk: 204

Company: CAVA GROUP, INC.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 204
---
40

Table of Contents

Item 1C. Cybersecurity

Risk Management and Strategy

We have developed a cybersecurity program that continuously evaluates material risks to our business and applies controls in an attempt to help avoid or mitigate them. Our key cybersecurity risks include, among others: brand and reputational damage, business disruption, regulatory and compliance risk, sensitive data loss, and reliance on third parties.We recognize cybersecurity as an enterprise risk, and accordingly cybersecurity risk has been integrated into our overall risk management process.  As part of our overall enterprise risk management process, we have established our management-level Risk Committee, composed of our Chief Information Officer, Chief Information Security Officer, Chief Legal Officer and Chief Financial Officer, among others, which assesses overall risks to the Company based on input from our other business leaders.  We have also implemented an incident response process that is overseen by our Chief Information Security Officer, who reports to the Chief Information Officer and is supported by a multi-level incident response process led by our cybersecurity team.  This is a documented framework that addresses our processes to assess, identify, and manage material risks from cybersecurity threats and incidents, which are prioritized for response and remediation efforts.  Our incident response process includes analysis of the impact of a cybersecurity threat or incident for materiality to ensure proper reporting.  Our incident response process is continually enhanced and validated through tabletop exercises and engagements with third-party partners. We engage third parties and auditors to assess our cybersecurity program, including the use of select penetration testing and threat intelligence services, and to assist us in adopting and implementing industry-standard practices to improve our cybersecurity program.  We have also retained third parties for cybersecurity incident response engagement in the event that a cybersecurity threat or incident requires capabilities beyond those of our own cybersecurity program.  In addition, we have a third-party managed security operations center that provides 24/7 monitoring and alerting, threat intelligence, and posture recommendations.  We are members of the Retail and Hospitality Information Sharing and Analysis Center, with more than 250 member companies from the retail, hospitality, and travel industries, which enables us to benchmark our cybersecurity risks, identify and adopt industry-standard practices for our cybersecurity program, subscribe to threat intelligence alerts, and contribute to the collective defense of our industries.We have a process to oversee and identify material risks from cybersecurity threats associated with the use of third-party service providers.  We conduct a third-party risk assessment program through the use of assessment templates, surveys and contractual requirements that evaluates certain potential and current vendors in connection with our security standards.