Company: FWRG
Filing Date: 2025-04-08
Form Type: ARS
Source: 0001789940-25-000033
Chunk: 60

Company: First Watch Restaurant Group, Inc.
Filing Date: 2025-04-08
Form: ARS
Chunk 60
---
 financial condition and results of operations. Changes in accounting principles applicable to us could have a material adverse effect on our financial condition and results of operations. Generally accepted accounting principles in the U.S. are subject to interpretation by the Financial Accounting Standards Board (“FASB”, the American Institute of Certified Public Accountants, the SEC and various bodies formed to promulgate and interpret appropriate accounting principles. A change in these principles or interpretations could have a significant effect on our financial condition and results of operations, and could affect the reporting of transactions completed before the announcement of a change. Our insurance may not provide adequate levels of coverage against claims. We believe that we maintain insurance customary for businesses of our size and type. However, there are types of losses we may incur that cannot be insured against or that we believe are not economically reasonable to insure. Such losses could have a material adverse effect on our business, financial condition and results of operations. 35

Item 1B. Unresolved Staff Comments None Item 1C. Cybersecurity Risk Management and Strategy We deploy a cybersecurity program modelled on Center for Internet Security (CIS Critical Security Controls, commonly referred to as CIS Controls. We believe our program’s control focus provides immediate protection and scalability for our business. Our program defines our governance and management oversight, and includes (i continual training to enhance user vigilance and resistance to phishing attempts and cyber-attacks, (ii evaluation of compliance with privacy and data security regulations and (iii reporting obligations in the event of an incident. As part of our program, we partner with a security operations center for continuous monitoring and alerting across all of our information technology systems. Additionally, our Information Technology leadership meets monthly with a cyber advisor to review progress on tools, scoring and management of our cybersecurity programs. On an annual basis, we engage an external partner to conduct a comprehensive risk assessment of our cybersecurity program, identify gaps based on best practices and recommend improvements. We have also developed vendor scoring criteria to assess cybersecurity, incidence readiness and cyber insurance of our critical vendors and service providers. Additionally, we conduct ongoing internal and external vulnerability and penetration scans. Our internal security team is led by a manager with over 40 years of experience who reports directly to our Chief Information Officer. Security incidents or breaches have from time to time occurred and may in the future occur involving our systems, the systems of the parties with whom we communicate or collaborate (including franchisees or the systems of third-party providers. As of the date of this Annual Report on Form 10-K, we have not experienced