Fossil Group, Inc.

Risk Management and Strategy

We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats that may affect our business, operations, or financial condition. Our cybersecurity risk management processes are integrated into our broader enterprise risk management framework and are designed to enable timely identification and escalation of risks.

Our program includes risk-based assessments of our information systems and applications, including those managed or hosted by vendors and service providers. We conduct periodic evaluations of risks, taking into account the evolving threat landscape, business initiatives, and changes to our technology environment. Identified risks are prioritized based on likelihood and potential impact and are tracked through established risk governance processes. Cybersecurity risks are evaluated in the context of potential operational disruption, financial exposure, legal and regulatory impact, and reputational harm.

Our internal audit function ("Audit Services") plays a key role in assessing and monitoring risks associated withkey vendors and service providers. Audit Services is informed of certain vendor engagements and conducts risk-based reviews as part of its ongoing oversight processes, including evaluation of contractual security provisions and periodic assessments of vendors that access our systems or data. Matters identified through these reviews are incorporated into the quarterly reporting provided to the Audit Committee of the Board as part of its oversight responsibilities.

We maintain policies and procedures designed to govern the collection, use, sharing, retention and disposal of personal information in compliance with applicable data protection laws. We periodically review and update our privacy notices and related controls to reflect evolving legal and regulatory requirements.

We utilize technical and administrative safeguards, including continuous security monitoring, a 24/7 security operations capability, and threat intelligence resources, designed to identify and mitigate unauthorized access and other cybersecurity threats. We also conduct periodic security awareness testing, including phishing simulations, to reinforce employee awareness and inform targeted training initiatives.

Audit Services conducts periodic reviews of controls, procedures, and applications and monitors remediation activities. In addition, we conduct annual external penetration testing and periodically perform internal reviews and benchmarking of our cybersecurity program, including alignment to recognized security frameworks such as the Center for Internet Security (CIS) benchmarks. We also leverage data analytics and automated tools, including AI–enabled capabilities, to support policy management, risk identification, and evaluation of control gaps. We use the results of these assessments to inform ongoing program enhancements. We maintain documented incident response plans designed to detect, respond to, and manage cybersecurity incidents. These plans include defined escalation protocols and are tested periodically, including through tabletop exercises that may involve external advisors.

In the event of a cybersecurity incident, we follow established procedures to assess its scope, impact, and materiality, including cross-functional involvement by members of management, such as our Chief Information Security Officer (“CISO”), Chief Financial Officer, and Chief Legal Officer, as appropriate. These procedures are designed to support timely assessment and disclosure consistent with applicable securities law requirements. If a cybersecurity incident is determined to be material, we will disclose such incident as required by applicable securities laws.

We maintain cybersecurity insurance coverage and review coverage limits and policy terms annually as part of our enterprise risk management processes.

We face a number of cybersecurity risks in connection with our business. Although cybersecurity risks and incidents have not materially affected us, including our business strategy, results of operations, or financial condition, we have experienced threats to our data and systems, including malware and computer virus attacks. For a description of cybersecurity-related risks that may materially affect us and how they may do so, see the risk factors under Part I, Item 1A, “Risk Factors,” including “Any material disruption of our information systems could disrupt our business and reduce our sales” and “A data security or privacy breach could damage our reputation, harm our customer relationships, expose us to litigation or government actions, and result in a material adverse effect to our business, financial condition and results of operations.”

Governance

Our Board oversees cybersecurity risk as part of its overall risk oversight responsibilities. The Board has delegated primary responsibility for oversight of cybersecurity risk management to the Audit Committee. The Audit Committee receives regular reports, at least quarterly, from our CISO regarding our cybersecurity program, including significant threats, risk assessments, mitigation initiatives, and any material incidents. The Audit Committee provides updates to the full Board regarding cybersecurity matters as appropriate. The Board also receives periodic updates regarding our overall cybersecurity posture and risk management efforts. Our CISO is responsible for developing, implementing, and maintaining our information security program. The CISO has over a decade of experience leading cybersecurity oversight and reports regularly to executive leadership and to the Audit Committee. Members of our information security team possess relevant cybersecurity experience and certifications, including certifications such as Certified Information Systems Security Professional (CISSP). We maintain a cybersecurity incident response process that includes defined escalation procedures to senior management and, where appropriate, to the Audit Committee. In addition to the regular updates described above, certain cybersecurity incidents are escalated in accordance with our incident response procedures. All employees are required to complete annual cybersecurity awareness training, and employees in certain roles complete additional role-based cybersecurity training.