p. 4: Use of risk management tool or software: "We evaluate and address risks of human trafficking and slavery through conformance to theSupplierCodeof Conductand using a risk-based approach. When new suppliers are onboarded, Cisco assessesfor modern slavery risks,which includes an assessment ofwhether the supplier employs vulnerable workers(for example, foreign migrant workersandyoung workers). If risks are identified, we follow up to determine if impacts need to be addressed prior to scaling business with the supplier.For existing suppliersand supplier entities that are integrated through mergers and acquisitions, Cisco follows its standard programs and due diligence processes, as follows:Cisco conducts an annual risk assessment by evaluating the supply base on social and environmental risk factors. This evaluation includes indicators for forced labor, young workers,and human trafficking risks in addition tothe potentialpresence of vulnerable worker groups. The outputs of the risk assessment identify which suppliers we will askto demonstrate theirconformance to the Code, using RBA’s assessment tools,such as the Supplier Self-AssessmentQuestionnaire (SAQ), Validated AuditProcess (VAP), oritsequivalent. Cisco assesses the effectiveness of the risk assessment process and continuously works to improvethe process, including an annual review tomaintainrelevanceto our operationswith updated risk indicators, newly availabledata,and accountsfor lessons learned over the past year. We alsoregularlyconvene or attend teleconferences, webinars,and other meetings sothat we may betterunderstand and monitor risks associated with labor recruitment practices."

Added risk-based questionnaires (p.4, "....The outputs of the risk assessment identify which suppliers we will ask to demonstrate their conformance to the Code, using RBA’s assessment tools, such as the Supplier Self-Assessment Questionnaire (SAQ), Validated Audit Process (VAP), or its equivalent.")