GENERAL MILLS INC

Cybersecurity Risk Management and Strategy

Our

enterprise

risk

framework

considers

risk

alongside

other

company

risks,

as

part of

our

overall

risk

process.

We

leverage

an

industry-leading

framework,

the

Institute

of Standards

and

Framework, and assess our maturity against that framework in partnership

with an independent firm on an annual basis.

We

assess

and

manage

our

risk

using

various

mechanisms,

starting

with

threat

intelligence,

which

us

a

necessary viewpoint to help

us identify trends, understand

how certain attacks may affect

us, and prepare for

evolutions in threat actor

behavior

that

may

require

changes

to

our

posture.

To

drive

readiness,

we

perform

adversarial

testing

of

our

posture through

penetration

testing, using

both internal

resources

and

external expertise,

as well

as table-top

and

“red

team” exercises to understand where processes or controls may be insufficient

based on adversarial techniques.

Our

audit team performs

regular assessments

of our

program and

selected components.

We

also

leverage

retrospectives from

previous

incidents

to

understand

weaknesses

and

to

improve

our

controls.

We

assess

our

regularly for cybersecurity risk

and prescribe remediation

activities when necessary.

As a part of

a collaborative defense approach,

we

regularly participate in multiple cybersecurity forums to share threat

intelligence, best practices, and points of caution.

We

train

our

through

annual

training,

phishing

simulations,

and

regular

communications

about

timely

topics

and

threats.

We

have

a

documented

and

well-tested

incident

plan

that

guides

us

in

responding,

containing,

and

eradicating

threats

that

have

breached

our

preventative

controls.

We

regularly

practice

technical recovery,

and we maintain cybersecurity insurance.

Cybersecurity Governance

Our

program

is

led by

our

Chief

Digital

and

Officer

(CDTO)

and

Vice

of

Cyber

Security

&

Enterprise

Architecture.

Our Vice

of Cyber

Security &

Enterprise Architecture,

who

reports to

our CDTO,

has a

master’s

degree

in

assurance,

and

more

than

years

of

working

in

this

field,

more

than

years

with

General Mills. He has strategic and operational responsibility

for all aspects of the Company’s

cybersecurity program, from how cyber

risks are identified, to how General Mills detects, responds, contains, and recovers

from cybersecurity threats.

The

Audit

of

our

Board

of

oversight

for

our

program.

The

Audit

receives

regular

updates

from

on

the

of

our

program,

reviews

plans

on

how

will

continually

mature

the

program,

and

receives

updates

on

special

topics

that

help

the

provide

oversight

of

the

program.

Our

Security &

Resilience Governance

Committee provides

oversight and

governance

for the

cybersecurity risk

through

meetings,

monthly

dashboard

on

management-aligned

program

targets,

and

as-needed

updates

on

incidents.

This

is

composed

of

our

Chief

General

Counsel,

Chief

Human

Officer, Chief Supply Chain Officer,

and CDTO.

Like

most

companies,

our

systems are

continually

subjected

to

threats.

Although

we

have

not

experienced

a

cybersecurity breach,

we cannot guarantee

that we will

not experience

a cyber threat

or incident in

the future.

Additional information

on cybersecurity

risks we

face is included

in Item 1A

of this report,

which should

be read

in conjunction

information in

this