GENERAL MILLS INC

Cybersecurity Risk Management and Strategy

Our

enterprise

risk

framework

considers

risk

alongside

other

company

risks,

as

part

of

our

overall

risk

process.

We

leverage

an

industry-leading

framework,

the

Institute

of Standards

and

Framework, and assess our maturity against that framework in partnership

with an independent firm on an annual basis.

We

assess

and

manage

our

risk

using

various

mechanisms,

starting

with

threat

intelligence,

which

us

a

necessary viewpoint to help

us identify trends, understand

how certain attacks may affect

us, and prepare for

evolutions in threat actor

behavior

that

may

require

changes

to

our

posture.

To

drive

readiness,

we

perform

adversarial

testing

of

our

posture through

penetration

testing, using

both internal

resources

and

external expertise,

as well

as table-top

and

“red

team” exercises to understand where processes or controls may be insufficient

based on adversarial techniques.

Our internal

audit team performs

regular assessments

of our

program and

selected components.

We

also leverage

retrospectives from

previous

incidents

to

understand

weaknesses

and

to

improve

our

controls.

We

assess

our

regularly for cybersecurity risk

and prescribe remediation

activities when necessary.

As a part of

a collaborative defense approach,

we

regularly participate in multiple cybersecurity forums to share threat

intelligence, best practices, and points of caution.

We

train

our

through

annual

training,

phishing

simulations,

and

regular

communications

about

timely

topics

and

threats.

We

have

a

documented

and

well-tested

incident

plan

that

guides

us

in

responding,

containing,

and

eradicating

threats

that

have

breached

our

preventative

controls.

We

regularly

practice

technical recovery,

and we maintain cybersecurity insurance.

Cybersecurity Governance

Our

program

is led

by our

Chief

Digital

and Technology

Officer

(CDTO)

and

Vice

of

Cyber Security.

Our

Vice

President of

Cyber Security,

who reports

to our CDTO,

has a master’s

degree in

information assurance,

and more than

20 years

of experience

working in

this field,

including more

than 12

years with

General Mills.

He has

strategic and

operational responsibility

for all

aspects of

the company’s

cybersecurity program,

from how

cyber risks

are identified,

to how

detects, responds,

contains, and recovers from cybersecurity threats.

The

Audit

of

our

Board

of

for

our

program.

The

Audit

regular

updates

from

on

the

of

our

program,

reviews

plans

on

how

will

continually

mature

the

program,

and

updates

on

special

topics

that

help

the

provide

of

the

program.

Our Security

& Resilience

Governance

Committee provides

and governance

for the

company’s

cybersecurity risk

through

meetings,

monthly

dashboard

on

management-aligned

program

targets,

and

as-needed

updates

on

incidents.

This

is

composed

of

our

Chief

General

Counsel,

Chief

Human

Officer, Chief Supply Chain Officer,

and CDTO.

Like

most

companies,

our

systems are

continually

subjected

to

threats.

Although

we

have

not

a

cybersecurity breach,

we cannot guarantee

that we will

not experience

a cyber threat

or incident in

the future.

Additional information

on cybersecurity

risks we

face is included

in Item 1A

of this report,

which should

be read

in conjunction

information in

this