Company: SVV
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0001883313-25-000013
Chunk: 80

Company: Savers Value Village, Inc.
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 80
---
Item 1C. Cybersecurity Risk Management, Strategy and Governance

Risk Management Strategy

Savers is committed to maintaining a cybersecurity risk management strategy that encompasses assessments, monitoring, and proactive measures to safeguard our assets and operations. Our approach involves a combination of internal and external risk assessments, monitoring, vulnerability scanning and remediation, external penetration testing and disaster recovery planning. On an annual basis, we conduct internal and external risk assessments to identify, evaluate, and prioritize potential risks to our business operations, data, and information systems. These assessments utilize industry-standard methodologies and frameworks to evaluate emerging threats and vulnerabilities. Specifically, we align our efforts with the National Institute of Standards and Technology framework, the Center for Internet Security (CIS) Controls 8.0 version and the Payment Card Industry Data Security Standard (PCI DSS) framework. Identified risks are categorized and assessed for potential impact, allowing us to implement targeted mitigation strategies.Continuous monitoring is a fundamental component of our risk management strategy. We employ appropriate technologies and tools to monitor our network, systems, and applications. This proactive approach supports our efforts to detect and respond to anomalies, potential threats, and emerging vulnerabilities. Our dedicated cybersecurity team conducts regular reviews of security logs and alerts, facilitating a swift and effective response to any deviations from established security baselines. We have also implemented a comprehensive third-party risk management program that includes a review of the third-party’s SOC I and II reports and their Service Level Agreements to ensure their security practices align with our standards.We employ regular vulnerability scanning processes to identify weaknesses and potential points of exploitation within our infrastructure. Following the identification of vulnerabilities, a systematic remediation process is initiated. Our activities to mitigate vulnerabilities on an ongoing basis include the application of patches and updates, and the implementation of compensating controls to address and mitigate the identified vulnerabilities. Our goal is to maintain a proactive stance in eliminating potential entry points for cyber threats.

40

Table of Contents

As part of our commitment to maintaining a robust security posture, we engage in annual external penetration testing conducted by reputable third-party security firms. These tests simulate real-world cyber-attacks to evaluate the effectiveness of our defenses and identify areas for improvement. The insights gained from penetration testing inform our ongoing security enhancements, aiding the resiliency of our systems against evolving cyber threats.We also have deployed a Disaster Recovery as a Service solution (DRaaS) that will enhance our ability to recover and restore data in the event of a cybersecurity incident or other event, such as a natural disaster. Our systems and data are categorized into tiers, with