Company: GROVW
Filing Date: 2025-03-19
Form Type: 10-K
Source: 0001628280-25-013839
Chunk: 94

Company: Grove Collaborative Holdings, Inc.
Filing Date: 2025-03-19
Form: 10-K
Item: Item 1C
Chunk 94
---
 the Company’s supply chain could result in an adverse impact on results of operations.•Network compromise or equipment sabotage could impact the operations of the fulfillment center sites which could impact the revenue.•Cybersecurity incidents, including breaches of confidential information, sensitive data, personal information, or intellectual property could damage the company’s reputation, disrupt operations, increase costs, and impact revenues.As part of the above processes, we regularly engage external advisors and consultants to assess our internal cybersecurity programs and compliance with applicable regulatory requirements and industry standards. Our external advisors also act as an extension of our teams to support on daily related security activities, by working closely with our Chief Information Officer and the leader of IT Operations. Our cybersecurity risk management program evaluates the risk associated when selecting third-party service providers. In addition to new vendor onboarding, critical vendors are reviewed annually to ensure we understand their cybersecurity posture, and their responsibility in protecting our assets appropriately.As of the date of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to 

44

Table of Contents

materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see Part I, Item 1A, Risk Factors-Risks Related to Our Business.

Cybersecurity Governance

Cybersecurity is an area of focus for our board of directors, audit committee, and management. As part of our board of directors’ overall responsibility for oversight of management’s general risk identification and management activities, the audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats. Members of the audit committee review and discuss with management and our auditors quarterly the Company’s cybersecurity risks and the steps that management has taken to protect against threats to the Company’s information systems and security and review risk and mitigation steps taken by management related to data privacy.

Our cybersecurity risk management and strategy processes are overseen by leaders from our IT Security, external advisors, and legal teams. These individuals are informed about, and monitor the identification, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.