Sally Beauty Holdings, Inc.

Risk Management Strategies

Our Company is committed to protecting the privacy and security of customer information and the integrity of our information technology systems. We have developed and implemented a cybersecurity risk management program (“Cybersecurity Program”) that is tailored to address specific risks in the retail industry, using a flexible approach informed by our deep understanding of attacker methodologies, targeted assets, and industry best practices. The Cybersecurity Program is intended to protect the confidentiality, availability, and integrity of our information and critical systems by continually monitoring, assessing, identifying, and mitigating cybersecurity risks. The Cybersecurity Program is part of ourintegrated risk management process and includes, but is not limited to, the following features:

•Regular phishing simulations and cybersecurity awareness training, including enhanced training for higher-risk users.

•Cybersecurity insurance coverage intended to help mitigate certain financial losses associated with potential cyber incidents.

•Security monitoring and protection capabilities for endpoints and cloud environments, including the detection of malicious activity and anomalous behavior.

•External threat monitoring and response capabilities designed to help identify and address phishing, fraud, account takeover, brand abuse, and other threats.

•A risk-based vulnerability management process that identifies, assesses, prioritizes, and addresses vulnerabilities based on factors such as severity and active exploitation.

•A risk-based third-party cybersecurity program that may include security assessments, SOC report reviews, penetration testing, and security architecture reviews based on the nature of the third-party relationship and the level of access to Company systems or sensitive information.

In addition, we have a written cybersecurity incident response plan (“Response Plan”) that is reviewed and updated, if necessary, at least annually. The Response Plan includes a cross-functional incident response team comprised of various key executive representatives from different departments in our organization, such as our Chief Information Security Officer (“CISO”) and General Counsel, that are tasked with assessing the scope, nature, and potential impact of incidents. Significant findings are communicated, as appropriate, to the Chief Executive Officer (“CEO”), Chief Financial Officer (“CFO”), the Board, and the Disclosure Committee, the latter of which is comprised of senior representatives from our finance, accounting, internal audit, and legal departments under the supervision of the CEO and CFO.

We regularly engage independent third parties to assess our Cybersecurity Program, including an annual cybersecurity risk and maturity assessment benchmarked against industry practices. We conduct annual third-party penetration testing focused on our highest-risk areas globally. These assessments are supplemented by red team exercises and real-world incident response simulations to continually improve our security posture.

As of the date of this Annual Report, we are not aware of any cybersecurity risks, including those resulting from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy,

• 22 - results of operations, or financial condition. For more information related to our cybersecurity risks, see Item 1A. “Risk Factors–Regulatory, Legal, and Cybersecurity Risks” within this Annual Report.

Governance

The Board understands the critical importance of managing evolving risks associated with cybersecurity threats. The Board has responsibility for overseeing risks related to the cybersecurity threat landscape, including data protection and security breach readiness. Our CISO reports directly to the Chief Information Officer and is responsible for the operation of our Cybersecurity Program. Our CISO brings over 25 years of experience in information security, including more than 10 years as a Chief Information Security Officer in the retail industry. This experience includes leading cybersecurity programs and implementing strategies to protect critical data and information systems.

The CISO is regularly informed of cybersecurity risks and incidents through the Company’s monitoring, risk-management and incident-response processes, with significant matters escalated to executive management and the Board as appropriate.

At least quarterly, the CISO delivers a detailed report to the full Board on data protection and cybersecurity matters. Topics covered by these reports include, but are not limited to, risk identification and management strategies, cybersecurity strategy and governance structure, consumer data protection, the Company’s ongoing risk mitigation activities, learnings from data security incidents of peer companies, results of third-party assessments and testing, and updates on annual associate training and other specific training initiatives.