Core & Main, Inc.

Board Skills and Diversity

The following table sets forth how each of our Board members self-identifies regarding gender and race/ethnicity.

The terms used in the above table are defined as follows:

•"African American or Black" means a person who has origins in any of the Black racial groups of Africa and is not of Hispanic or Latinx origin.

•"Asian" means a person having origins in any of the original peoples of the Far East, Southeast Asia, or the Indian subcontinent, including, for example, Cambodia, China, India, Japan, Korea, Malaysia, Pakistan, the Philippine Islands, Thailand and Vietnam.

•"White" means a person who has origins in any of the original peoples of Europe, the Middle East, or North Africa and is not of Hispanic or Latinx origin.

Executive Sessions of Our Independent Directors

Our independent directors meet quarterly (i) at scheduled executive sessions without management and (ii) with the CEO without other executive officers being present. Our Lead Independent Director or another independent director selected during the executive session acts as chair at such meetings.

Board’s Role in Risk Oversight

Our Board has overall responsibility for overseeing our risk management. Under its charter, the Audit Committee is responsible for reviewing and discussing the Company’s risk management practices, including the effectiveness of the systems and policies for risk assessment and risk management, discussion of the Company’s major financial and operational risk exposures and the steps management has taken to monitor and control such exposures. The Board also evaluates and manages risk through operation of its committees in relation to their respective areas of responsibility. For example, the Talent and Compensation Committee oversees the potential risks associated with our compensation policies and practices. The Audit Committee oversees our procedures governing related person transactions and the internal audit function as well as holding primary responsibility for overseeing our cybersecurity program. The Company’s chief information security officer regularly reports to the Audit Committee on the current state of our cybersecurity program (including but not limited to, the current threat landscape, cybersecurity risks, and as needed, any significant incidents). The Audit Committee may provide updates to the Board on the substance of these reports and any recommendations for improvements to our cybersecurity program that the Audit Committee deems appropriate. In addition to the committees’ work in overseeing risk management, our full Board regularly engages in discussions of the most significant risks that the Company is facing and how these risks are being managed.

The Company’s heads of internal audit and cybersecurity teams each have regularly scheduled sessions with the Audit Committee without other members of management present. The Board believes that the work undertaken by the committees of the Board, together with the work of the full Board and our CEO, enables the Board to oversee effectively the Company’s risk management function.

Corporate Governance Guidelines, Committee Charters and Codes of Conduct and Financial Ethics

Our Corporate Governance Guidelines are available on the Governance section of our investor relations website at

https://ir.coreandmain.com/governance. The charters for each of the Audit, Talent and Compensation and Nominating and Governance Committees are also available on our investor relations website.