Item 9A. Controls and Procedures

(a) Evaluation of Disclosure Controls and Procedures

The SEC defines the term “disclosure controls and procedures” to mean a company’s controls and other procedures that are designed to ensure that information required to be disclosed in the reports that it files or submits under the Exchange Act is recorded, processed, summarized, and reported, within the time periods specified in the SEC’s rules and forms. “Disclosure controls and procedures” include, without limitation, controls and procedures designed to ensure that information required to be disclosed by an issuer in the reports that it files or submits under the Exchange Act is accumulated and communicated to the issuer’s management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure. Our disclosure controls and procedures are designed to provide reasonable assurance that such information is accumulated and communicated to our management. Our management (with the participation of our Chief Executive Officer and Chief Financial Officer) has conducted an evaluation of the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) of the Exchange Act).

Based on such evaluation, our Chief Executive Officer and our Chief Financial Officer have concluded that our disclosure controls and procedures were effective at the reasonable assurance level as of the end of the period covered by this Annual Report on Form 10-K.

(b) Management’s Report on Internal Control over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act) for Gen Digital. Our management, with the participation of our Chief Executive Officer and our Chief Financial Officer, has conducted an evaluation of the effectiveness of our internal control over financial reporting as of March 31, 2023, based on criteria established in Internal Control - Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

We acquired Avast during September 2022. Management excluded Avast from its assessment of the effectiveness of Gen’s internal control over financial reporting as of March 31, 2023. Total assets (excluding goodwill and intangibles) and total revenues of Avast represent approximately 3%, or $462 million and 16%, or $518 million, respectively, of the Consolidated Financial Statements amounts as of, and for the year ended, March 31, 2023. Management did not assess the effectiveness of internal controls over financial reporting of Avast due to the complexity associated with assessing internal control during integration efforts as well as the limited amount of time between the transaction date and the assessment date of March 31, 2023.

Our management has concluded that, as of March 31, 2023, our internal control over financial reporting was effective at the reasonable assurance level based on these criteria.

The effectiveness of our internal control over financial reporting, as of March 31, 2023, has been audited by KPMG LLP, an independent registered public accounting firm, as stated in their report, which is included in Part IV, Item 15 of this Annual Report on Form 10-K.

(c) Changes in Internal Control over Financial Reporting

During the quarter ended March 31, 2023, except for changes in connection with our Merger with Avast discussed above, there were no changes in our internal controls over financial reporting or in other factors, that have materially affected, or are reasonably likely to materially affect, our internal controls over financial reporting.

(d) Limitations on Effectiveness of Controls

Our management, including our Chief Executive Officer and Chief Financial Officer, does not expect that our disclosure controls and procedures or our internal controls will prevent all errors and all fraud. A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, within our company have been detected.