Item 1B. Unresolved Staff Comments
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.
ITEM 1C. CYBERSECURITY
Chegg and its Board recognize the critical importance of maintaining the trust and confidence of our students, business partners, and employees. We have established an ISP utilizing the National Institute of Standards and Technology Cybersecurity Framework as an authoritative source of cybersecurity standards and framework for measurement. The ISP is comprised of the following components: (i) policies which describe the core requirements and design aspects of the program, (ii) standards that provide quantifiable and prescriptive requirements to meet the program's design, (iii) processes that provide operational requirements to meet the ISP's policies and standards consistently, and (iv) implementation playbooks which are created, maintained, and used by the respective team responsible for implementation.
The ISP has three core functions underlying its design, which are intended to provide Chegg with appropriate oversight and governance to execute, monitor, measure and report on the performance of the program in a consistent manner :
• management (control owners) have a responsibility to own and manage risks associated with day-to-day operations, including the design, implementation, and ongoing operation of controls;
• compliance and cybersecurity teams enable the identification of emerging risks in daily operation of our business, providing compliance and oversight in the form of frameworks, policies, tools, and techniques to support management; and
• third-party independent assessors provide objective evaluation by assessing whether the first and second functions above are operating successfully, providing assurance that controls are effective in both design and operation.
The Audit Committee of the Board (the “Audit Committee”) provides independent oversight of the ISP. As a component of the ISP, the Audit Committee receives a report on the health and performance of the ISP on at least an annual basis. The Audit Committee provides guidance and oversight to help ensure the ISP meets the needs of all interested parties and fulfills its core functions. Management provides the Audit Committee a quarterly update on cybersecurity risks and incidents. Cybersecurity risks, including through oversight of the ISP, are considered alongside other operational and strategic risks as part of Chegg’s broader risk management and reporting.
Our Trust and Security organization (“T&S”) is responsible for implementing the ISP. T&S is led by our Chief Information Security Officer (“CISO”) who reports to our Chief Technology Officer (“CTO”). T&S is made up of two sub-teams, each led by a director who reports to the CISO:
• Information Security , which is responsible for implementing all aspects of the ISP and is structured around the following pillars: (i) Application Security, (ii) Infrastructure (Cloud) Security, (iii) Corporate IT Security, and (iv) Security Operations.
35
Table of Contents
• Compliance and Privacy , which is responsible for assessing and preparing internal teams for regulatory compliance pertaining to information security, secured financial reporting, and privacy and is structured around the following pillars: (i) Privacy, (ii) Compliance, (iii) Vendor Risk Management, (iv) Security Awareness, (v) Governance and Risk Management, and (vi) Privacy and Abuse Engineering.
Our CISO has served various roles in information technology and security for over 25 years, including serving as CISO. Our CISO holds an undergraduate degree in Information Technology with a specialization in Information Assurance and Security and was a distinguished graduate of the US Air Force Secure Communications school. Our CTO holds an undergraduate degree in computer science and has more than 25 years of experience in technology and operations. Our CEO and CFO each hold degrees in their respective fields, and each have over 20 years of experience managing risks at Chegg and other companies, including risks arising from cybersecurity threats.
During the year ended December 31, 2025, Chegg did not experience any cybersecurity threats or incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. For discussion of our risk factors relating to cybersecurity and data privacy, see the “Risks Related to Data Privacy” section included in Part I, Item 1A, “Risk factors” of this Annual Report on Form 10-K.