REGIS CORP

We have defined policies and procedures for cybersecurity incident detection, containment, response, and remediation and have adopted physical, technological, and administrative cybersecurity and data privacy controls. The Company established a cybersecurity incident response plan, which includes classification of cybersecurity incidents, to whom to escalate an incident, and when to escalate a cybersecurity incident, including direct communication to the Chief Digital Officer ("CDO") and VP of IT, Director, and President. The Company regularly conducts risk assessments and tracks remediation to completion. Critical systems are periodically audited against industry standards.

Key elements of our cybersecurity risk management program include, but are not limited to, the following:

•Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

•A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;

•The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes;

•Cybersecurity awareness training of our employees;

•A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and

•A third-party risk management process for service providers based on our assessment of their criticality to our operations and respective risk profile.

Our CDO directs, coordinates, plans, and organizes information security activities throughout the Company, including leading the development of our cybersecurity risk management strategy.

We have not historically been materially impacted by risks from cybersecurity threats and as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business.