Company: KMX
Filing Date: 2025-04-11
Form Type: 10-K
Source: 0001170010-25-000024
Chunk: 44

Company: CARMAX INC
Filing Date: 2025-04-11
Form: 10-K
Item: Item 1C
Chunk 44
---
Item 1C.  Cybersecurity.

CarMax’s cybersecurity program is designed to help ensure the proper assessment, identification, and management of the company’s risks from cybersecurity threats and is integrated into our overall risk management system.  The company’s cybersecurity program is staffed by well-trained and experienced cybersecurity professionals and includes technology controls, proactive identification of data security vulnerabilities, and quarterly, or as needed, reporting by management to the Technology and Innovation Committee of the Board of Directors (the “Board”).  CarMax’s cybersecurity team manages the company’s Incident Response Plan, which establishes a comprehensive system and process for tracking and logging cybersecurity occurrences, reviewing the occurrences to determine whether remediation or escalation is appropriate and escalating certain occurrences to the company’s Chief Information Security Officer (the “CISO”) for further review and assessment.  CarMax has an established review and escalation process for assessing cybersecurity occurrences and, if necessary, escalating cybersecurity incidents to members of our senior management team.We monitor industry trends to prioritize and mitigate cybersecurity risk for our customers, associates and business, and to remain apprised of industry developments and emerging threats.  CarMax engages in testing to improve our cybersecurity 

19

approach internally and with third-party vendors and conducts exercises based on current threat intelligence.  Additionally, all CarMax associates are required to complete the company’s cybersecurity training program on an annual basis.The company engages a third-party with extensive experience in cybersecurity to periodically perform a maturity analysis of CarMax’s cybersecurity program as compared to peer companies.  We conduct annual tabletop exercises, guided by a third-party cybersecurity firm, with key members of our cybersecurity and legal teams to assess the company's readiness and capabilities to respond to a cyber-attack.  At least annually, we also conduct third-party penetration tests to enhance the security of our digital systems, and we employ network scanning to help us identify any newly developed vulnerabilities or threats.  Our third-party intake process incorporates cybersecurity risk into the assessment of our third-party vendors when we engage a new vendor or experience a change in relationship with an existing vendor.  Further, CarMax’s cybersecurity team conducts periodic reviews of the company’s third-party vendors depending on the vendor’s risk profile as determined by the company’s cybersecurity team.

The company’s cybersecurity program is led and overseen by our Chief Information and Technology Officer (the “CITO”) and our CISO.  The CITO joined CarMax in 2012, reports to our Chief Executive Officer and has served in various technology leadership roles in startup organizations and Fortune 500 companies