1 unchanged sentence
CYBERSECURITY
−Removed: Chegg and its Board of Directors (the “Board”) recognize the critical importance of maintaining the trust and confidence of our students, business partners, and employees.
−Removed: We have established an Information Security and Governance Program (“ISP") utilizing the National Institute of Standards and Technology Cybersecurity Framework as an authoritative source of cybersecurity standards and framework for measurement.
+Added: Chegg and its Board recognize the critical importance of maintaining the trust and confidence of our students, business partners, and employees.
+Added: We have established an ISP utilizing the National Institute of Standards and Technology Cybersecurity Framework as an authoritative source of cybersecurity standards and framework for measurement.
The ISP is comprised of the following components:
3 unchanged sentences
• compliance and cybersecurity teams enable the identification of emerging risks in daily operation of our business, providing compliance and oversight in the form of frameworks, policies, tools, and techniques to support management;
−Removed: • independent assessors provide objective evaluation by assessing whether the first and second functions above are operating successfully, providing assurance that controls are effective in both design and operation.
+Added: • third-party independent assessors provide objective evaluation by assessing whether the first and second functions above are operating successfully, providing assurance that controls are effective in both design and operation.
The Audit Committee of the Board (the “Audit Committee”) provides independent oversight of the ISP.
1 unchanged sentence
The Audit Committee provides guidance and oversight to help ensure the ISP meets the needs of all interested parties and fulfills its core functions.
+Added: Management provides the Audit Committee a quarterly update on cybersecurity risks and incidents.
+Added: Cybersecurity risks, including through oversight of the ISP, are considered alongside other operational and strategic risks as part of Chegg’s broader risk management and reporting.
Our Trust and Security organization (“T&S”) is responsible for implementing the ISP.
−Removed: T&S is led by our Chief Information Security Officer (“CISO”), Lonnie Benavides, who reports to our Chief Technology Officer (“CTO”), Chuck Geiger.
+Added: T&S is led by our Chief Information Security Officer (“CISO”) who reports to our Chief Technology Officer (“CTO”).
T&S is made up of two sub-teams, each led by a director who reports to the CISO:
• Information Security , which is responsible for implementing all aspects of the ISP and is structured around the following pillars:
−Removed: (i) Application Security, (ii) Infrastructure (Cloud) Security, (iii) Corporate IT Security, (iv) Security Operations, and (v) Governance and Risk Management.
+Added: (i) Application Security, (ii) Infrastructure (Cloud) Security, (iii) Corporate IT Security, and (iv) Security Operations.
• Compliance and Privacy , which is responsible for assessing and preparing internal teams for regulatory compliance pertaining to information security, secured financial reporting, and privacy and is structured around the following pillars:
−Removed: (i) Privacy, (ii) Compliance, (iii) Vendor Risk Management, and (iv) Security Awareness.
−Removed: T&S also partners with other dedicated teams which report to our CTO:
−Removed: • Operations and Analytics , which is responsible for identifying and measuring consumer fraud and abuse of our customer-facing services, implementing manual and automated operations to ensure these are within acceptable bounds, and working with our product and engineering teams to design and implement longer term solutions.
−Removed: • Security and Fraud Engineering , which is responsible for building libraries, services, and integrations that interface with both backend and vendor systems to support the objectives of T&S.
−Removed: Benavides joined Chegg in 2024 and has served various roles in information technology and security for over 25 years, including serving as CISO of a mortgage servicing company prior to joining Chegg.
−Removed: Benavides holds an undergraduate degree in Information Technology with a specialization in Information Assurance and Security and was a distinguished graduate of the US Air Force Secure Communications school.
−Removed: Geiger holds an undergraduate degree in computer science and has served in various roles in information technology for over 30 years, including serving as either the CTO or Executive Vice President of Technology of four companies prior to joining Chegg.
−Removed: Our CEO, CFO and General Counsel each hold degrees in their respective fields, and each have over 20 years of experience managing risks at Chegg and other companies, including risks arising from cybersecurity threats.
+Added: (i) Privacy, (ii) Compliance, (iii) Vendor Risk Management, (iv) Security Awareness, (v) Governance and Risk Management, and (vi) Privacy and Abuse Engineering.
+Added: Our CISO has served various roles in information technology and security for over 25 years, including serving as CISO.
+Added: Our CISO holds an undergraduate degree in Information Technology with a specialization in Information Assurance and Security and was a distinguished graduate of the US Air Force Secure Communications school.
+Added: Our CTO holds an undergraduate degree in computer science and has more than 25 years of experience in technology and operations.
+Added: Our CEO and CFO each hold degrees in their respective fields, and each have over 20 years of experience managing risks at Chegg and other companies, including risks arising from cybersecurity threats.
+Added: During the year ended December 31, 2025, Chegg did not experience any cybersecurity threats or incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition.
For discussion of our risk factors relating to cybersecurity and data privacy, see the “Risks Related to Data Privacy” section included in Part I, Item 1A, “Risk factors” of this Annual Report on Form 10-K.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.