Company: SBH
Filing Date: 2025-11-13
Form Type: 10-K
Source: 0001193125-25-280122
Chunk: 12

Company: Sally Beauty Holdings, Inc.
Filing Date: 2025-11-13
Form: 10-K
Item: Item 1C
Chunk 12
---
Risk Management Strategies

Our Company is committed to protecting the privacy and security of customer information and the integrity of our information technology systems. We have developed and implemented a cybersecurity risk management program (“Cybersecurity Program”) that is tailored to address specific risks in the retail industry, using a flexible approach informed by our deep understanding of attacker methodologies, targeted assets, and industry best practices. The Cybersecurity Program is intended to protect the confidentiality, availability, and integrity of our information and critical systems by continually monitoring, assessing, identifying, and mitigating cybersecurity risks. The Cybersecurity Program is part of our integrated risk management process and includes, but is not limited to, the following features:

•Regularly simulated phishing attacks and comprehensive cybersecurity training for all employees, with special focus on high-risk individuals using a new security awareness platform.

•Cybersecurity insurance coverage to mitigate financial impacts from potential cyber incidents.

•Endpoint detection and response technologies (EDR) to monitor systems continuously for malicious activity.

•Behavior analytics tools that help track normal behavior patterns and quickly detect any anomalies.

•Cloud security measures, offering comprehensive protection and vulnerability management for our cloud environments.

•Digital risk protection that includes brand protection, social media monitoring, dark web surveillance, and proactive response to phishing, fraud, and account takeovers.

•Zero-day vulnerability management, with third-party monitoring to prioritize critical vulnerabilities based on real-time risk assessments and active exploitation.

•Comprehensive vendor risk management program, including penetration tests, Service Organization Control (“SOC”) reports, and security architecture reviews, especially for third parties managing sensitive data or accessing internal systems.

In addition, we have a written cybersecurity incident response plan (“Response Plan”) that is reviewed and updated, if necessary, at least annually. The Response Plan includes a cross-functional incident response team comprised of various key executive representatives from different departments in our organization, such as our Chief Information Security Officer (“CISO”) and General Counsel, that are tasked with assessing the scope, nature, and potential impact of incidents. Findings are reported to the Chief Executive Officer (“CEO”), Chief Financial Officer (“CFO”), our