Company: RRGB
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001171759-25-000012
Chunk: 50

Company: RED ROBIN GOURMET BURGERS INC
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 50
---
ITEM 1C. Cybersecurity

Risk Management and StrategyThe Company has an enterprise risk management program to identify, assess, monitor, and manage significant risks of the Company. The Company evaluates cybersecurity risks alongside other critical business risks under this program, and the Company also has a standalone cybersecurity program. The Company's approach to assessing, identifying, and managing material risks from cybersecurity threats is grounded in established frameworks, including those set forth by the National Institute of Standards and Technology (NIST) and other industry standards and requirements as defined by various compliance frameworks. Our cybersecurity program prioritizes key areas such as:•Policies, Standards, and Practices: We maintain comprehensive policies, standards, and practices aligned with industry practices and regulatory requirements. These documents serve as the foundation for our cybersecurity program, providing clear guidelines for safeguarding our information systems and data assets.•Threat Monitoring and Assessment: Continuous monitoring and assessment of cyber threats and vulnerabilities are integral to our risk management strategy. We utilize advanced monitoring tools and threat intelligence sources to proactively identify and address potential security risks. The Company uses third-party service providers to support its operations. The Company evaluates third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider’s cybersecurity posture or a recommendation of specific mitigation controls.•Audits and Assessments: Regular audits and assessments are conducted by both internal and external experts (consultants, auditors, and other third parties) to evaluate the effectiveness of our cybersecurity controls and processes 

20

Table of Contents

and recommend improvements. These assessments help us achieve compliance with internal policies as well as external regulations and standards.•Incident Response Planning: We have developed comprehensive incident response plans to mitigate cybersecurity incidents. These plans outline clear procedures for detecting, responding to, and recovering from security breaches, minimizing the impact on our operations and stakeholders. External technical, legal, and law enforcement support is engaged as needed to support response efforts.The Company employs a multifaceted approach through in house capabilities and in partnership with external cybersecurity experts to safeguard its assets, including technical and organizational measures. These include the deployment of technology focused on identifying and remediating threats, ongoing employee training exercises, regular incident response capability reviews and exercises, cybersecurity insurance coverage, and business continuity mechanisms.

Governance

Our Board, with the assistance of our Audit Committee, oversees the Company’s cybersecurity program and strategies. The Audit Committee receives regular reports and updates, typically quarterly, from senior management on a wide range of cybersecurity topics. These reports include detailed insights into risk assessments, mitigation strategies, emerging threats