Company: CRCT
Filing Date: 2025-03-05
Form Type: 10-K
Source: 0001828962-25-000039
Chunk: 125

Company: Cricut, Inc.
Filing Date: 2025-03-05
Form: 10-K
Item: Item 1C
Chunk 125
---
 measures. Our CISO oversees our relationships with these third-party service providers. While we are not aware of any material data security breaches to date, for additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, “Risk Factors,” in this annual report on Form 10-K, including the risk factors under the heading “Risks Related to Privacy, Data Protection and Cybersecurity,” which is incorporated herein by reference.

62

Table of Contents

GovernanceOur board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee. Our CISO and our steering committee on information security, which includes members of our executive management as well as leaders of business functional areas, together with our Privacy and Data Protection Team, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our CISO has over 20 years of experience leading in the information security field at well-known publicly traded technology companies. He also received a CIO Executive Education Certificate from Stanford University. Our CISO and our steering committee on information security oversee our cybersecurity policies and processes, including those described in “Risk Management and Strategy” above. The processes by which our CISO and our steering committee on information security are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: risk assessment and management, policy development and implementation, prevention strategies, detection mechanisms, incident response and mitigation, remediation and recovery, reporting and communication, compliance and legal considerations, efforts at continuous improvement, and training and awareness.

Our CISO and representatives from our steering committee on information security provide quarterly briefings to the audit committee regarding our company’s cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Because many members of our board of directors regularly attend our audit committee meetings, the full board of directors regularly receives updates on cybersecurity.