CLOROX CO DE

The Company’s management, with the participation of the Company’s Chief Executive Officer and Chief Financial Officer, evaluated the effectiveness of the Company’s disclosure controls and procedures as of the end of the period covered by this Report. Based on that evaluation, the Chief Executive Officer and Chief Financial Officer concluded that the Company’s disclosure controls and procedures, as of the end of the period covered by this Report, were effective such that the information required to be disclosed by the Company in reports filed under the Exchange Act is (i) recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms and (ii) accumulated and communicated to management, including the Chief Executive Officer and Chief Financial Officer, as appropriate to allow timely decisions regarding required disclosure.

No change in the Company’s internal control over financial reporting occurred during the second fiscal quarter of the fiscal year ending June 30, 2024, that has materially affected, or is reasonably likely to materially affect, the Company’s internal control over financial reporting.

On Monday, August 14, 2023, the Company disclosed it had identified unauthorized activity on some of its Information Technology (IT) systems; see Note 2 in the condensed consolidated financial statements in this Report. That activity began on Friday, August 11, 2023 and after becoming aware of it that evening, the Company immediately began taking steps to stop and remediate the activity. The Company also took certain systems offline and engaged third-party cybersecurity experts to support its investigation and recovery efforts. The Company implemented its business continuity plans, including manual ordering and processing procedures at a reduced rate of operations in order to continue servicing its customers. However, the incident resulted in wide-scale disruptions to the Company’s business operations throughout the remainder of the first fiscal quarter of the fiscal year ending June 30, 2024.

During the disruptions caused by the cyberattack, we deployed additional interim controls in response to taking certain systems offline during the period to maintain our internal control over financial reporting.