KURA SUSHI USA, INC.

Risk Management and Strategy

Our cybersecurity risk management program is designed to monitor and control cybersecurity risk exposure, response, and mitigation, as well as protect confidentiality, integrity and availability of our critical systems and information. Our cybersecurity policies and processes are fully integrated into our Enterprise Risk Management program. Our cybersecurity risk management program is informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) version 2.0 and incorporates its principles in assessing, identifying, and managing cybersecurity risks relevant to our business. While we leverage the NIST CSF as a foundational guide, our program is tailored to our specific operational and risk environment.

Our cybersecurity risk management program includes:

•

Ongoing risk assessments to help identify material cybersecurity risks to our critical systems and information by performing regular scans of our environment, assessing incident trends and internal assessments of our cybersecurity practices;

•

The use of external service providers, where appropriate, to monitor, identify, assess, test and remediate, or otherwise assist with aspects of our security controls, this includes quarterly and annual SOC 1/2 report reviews;

•

Our technical security controls include but are not limited to firewalls, network segmentation, multi-factor authentication (“MFA”), endpoint detection & response (“EDR”), and managed detection & response (“MDR”). Our network segmentation is designed to prevent connectivity between the corporate network and restaurant systems;

•

Mandatory cybersecurity awareness training for employees and simulated phishing attacks;

•

A disaster recovery and business-continuity plan and controls designed to protect against business interruption, including the backing up of our critical systems;

•

A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, internal reporting to management and the board of directors;

•

Cybersecurity insurance which is assessed annually; and

•

Ongoing enhancements to our risk management processes for service providers, suppliers, and vendors. We monitor our third-party access to our systems and we have a system development life cycle (“SDLC”) where early in the procurement process, we determine the level of risk that a third-party may present to the firm. The SDLC program is further enhanced through the application of risk-mitigating controls to monitor and evaluate risk on a continual basis.

Cybersecurity risks are monitored on an ongoing basis, and the security program and practices are adjusted to keep pace with the dynamic threat environment. We are not currently aware of risks from known cybersecurity threats that have materially affected orare reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

Cybersecurity Governance

Our board of directors considers cybersecurity risk as part of its risk oversight function and oversees management’s implementation of our cybersecurity risk management program, including the steps taken to monitor, minimize or control such risks or exposures.

The Audit Committee receives quarterly reports from management regarding the status of the cybersecurity risk management program, current activities, planned projects, and security assessments. In addition, management will update the board of directors, as necessary, regarding our cybersecurity risk management program and any significant cybersecurity incidents that we may experience.

Our management team isresponsible for assessing and managing emerging cybersecurity developments, our material risks from cybersecurity threats and the strategy to mitigate cybersecurity risks. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Our cybersecurity risk management team is led by our Vice President of Information Security who has extensive experience in information technology and has held leadership roles at national restaurant companies.

Additional information on cybersecurity risks is discussed in Part I, Item 1A, “Risk Factors,” under the heading “We rely significantly on information technology and cybersecurity, and any material failure, weakness, interruption or breach of security could prevent us from effectively operating our business.”