UNIFIRST CORP

Cybersecurity Risk Management and Strategy

Our cybersecurity risk management strategy is designed to detect, evaluate, and manage risks from cybersecurity threats and incidents. Our program is intended to identify cybersecurity risks facing our organization and inform our risk-based approach to cybersecurity preparedness and incident response procedures.

Our cybersecurity risk management program is supported by our third-party vendors and service providers, and includes, but is not limited to, periodic penetration testing and endpoint detection, and automated tools to monitor our network and systems to detect vulnerabilities or unusual activity that could lead to unauthorized access to our systems or data. We conduct assessments, as appropriate, of critical third-party service providers, which generally include a cybersecurity questionnaire and a review of security assessments and certifications. We also provide cybersecurity awareness training to employees with access to our network.

We also have a policy for responding to and mitigating cybersecurity incidents. Our incident response procedures were overseen until recently by our Chief Information Officer (“CIO”). In connection with the upcoming retirement of our CIO, we recently hired a new Chief Information & Technology Officer (“CITO”) who oversees our incident response procedures. Our incident response procedures are reviewed and updated periodically.

We have not identified cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information, please see the Risk Factor titled “If our information technology systems suffer interruptions or failures, including as a result of cyber-attacks, our business operations could be disrupted or other material adverse impacts on our business could result.”

Cybersecurity Governance

Our CITO, who reports to our Chief Financial Officer, is responsible for leading our information security team and overseeing the Company’s cybersecurity risk management efforts. Our CITO has significant experience as a chief technology officer.

Our cybersecurity risk management program is overseen by our Board of Directors. As was the case with our CIO, members of the Board of Directors and the Audit Committee will periodically meet with our CITO to discuss material cybersecurity risks facing our organization and significant changes or updates to our cybersecurity processes. The full Board of Directors receives a cybersecurity risk management update from management generally on a quarterly basis.