Driven Brands Holdings Inc.

We maintain a risk-based cybersecurity program designed to protect our information and our customers’ information from cybersecurity threats against us, our franchisees, our third-party vendors, and service providers, which may result in a material adverse effect on the confidentiality, integrity, and availability of our information systems.

Cybersecurity Governance

Management’s Role in Cybersecurity Risk Management

The Company’s cybersecurity program is led by our Chief Information Security Officer (“CISO”), who has extensive experience in enterprise cybersecurity leadership, including responsibility for cybersecurity risk management, incident response, and security governance within large, and complex organizations.

In consultation with senior management and the Board of Directors, the CISO establishes the Company’s cybersecurity strategy and oversees the implementation, operation, and maintenance of the cybersecurity program. In alignment with the Company’s enterprise-wide risk program, the program includes structured processes for the assessment, prevention, detection, mitigation, and remediation of cybersecurity threats. The CISO is supported by a dedicated team of information security and risk professionals.

The CISO receives ongoing reporting regarding cybersecurity risks, threats, vulnerabilities, and control effectiveness, and regularly reviews and updates the Company’s risk management measures to identify, prioritize, and mitigate cybersecurity risks. Cybersecurity matters that meet certain established thresholds are reported to senior management and, as appropriate, to the Audit Committee and Board of Directors.

Board of Directors Oversight

The Board of Directors, in coordination with its Audit Committee, oversees the Company’s enterprise risk management program, including risks arising from cybersecurity threats. Both the Board of Directors and the Audit Committee periodically review the measures that we have implemented in the context of the Company’s strategic priorities and risk tolerance to identify and mitigate data protection and cybersecurity risks.

The Audit Committee, as part of the governance and oversight of company risk management, also periodically receives reports and presentations from the CISO regarding the Company’s cybersecurity risk management. The Board receives reports of Audit Committee discussions regarding its oversight of cybersecurity risk. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, are reported to the Board and/or Audit Committee.

Cybersecurity Risk Management and Strategy

We employ a defense-in-depth cybersecurity framework consisting of layered technical, administrative, and procedural controls designed to assess, identify, prevent, detect, and reduce the potential impact of cybersecurity threats affecting the Company and its third-party vendors and service providers.

Key elements of our cybersecurity program include, among others: multi-factor authentication, privileged access management, continuous network and endpoint monitoring, email and cloud security platforms, immutable backup systems, vulnerability management, third-party risk assessments, and continuous monitoring and testing.

The Company’s cybersecurity risk management program is designed to protect the confidentiality, integrity, and availability of its information assets and incorporates people, processes, and technologies, including ongoing monitoring, alerting, scanning, testing, training, tabletop exercises, and independent assessments, to identify and manage risks arising from cybersecurity threats, system vulnerabilities, and third-party relationships.

We regularly evaluate and update our cybersecurity program to align with emerging technical threats, including those associated with the increasing use of artificial intelligence, changes in regulatory requirements, and developments in industry best practices. In addition to internal resources, weengage independent consultants and third-party service providers as appropriate to enhance our understanding of cybersecurity risks and support the implementation of risk-based defensive measures.

Incident Response

We maintain a formal Cybersecurity Incident Response Plan (“IRP”) that establishes a coordinated framework for the identification, investigation, containment, remediation, documentation, and reporting of cybersecurity incidents.

The IRP defines roles, responsibilities, communication protocols, and escalation procedures, including timely involvement of senior management and, where appropriate, reporting to the Board of Directors and/or Audit Committee, and is designed to support compliance with applicable regulatory and legal notification requirements.

The IRP applies to Company personnel, including third-party contractors, vendors, and partners with access to Company information systems, and to applicable devices, networks, and services.

Material Cybersecurity Risks, Threats and Incidents

To date, risks from cybersecurity threats, including those associated with prior cybersecurity incidents, have not materially affected the Company’s business strategy, results of operations, or financial condition. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A “Risk Factors” under the heading “Risks Related to Intellectual Property and Technology,” which should be read in conjunction with the foregoing information.