Company: JACK
Filing Date: 2025-11-19
Form Type: 10-K
Source: 0000807882-25-000072
Chunk: 52

Company: JACK IN THE BOX INC
Filing Date: 2025-11-19
Form: 10-K
Item: Item 1C
Chunk 52
---
 proper data protection. Employees and third-party contractors with access to the Company’s cardholder data environment (“CDE”) or systems used to support the CDE, complete annual PCI awareness training. The Company’s corporate restaurant employees also receive periodic security training on devices that capture payment card data.In addition, the Company engages third parties to assist in assessing, identifying, and remediating material risks from cybersecurity threats. Our key cybersecurity controls applied to financial business processes and supporting information systems are regularly tested and audited by third-party service providers, which we retain to help identify vulnerabilities in our systems and to help maintain compliance to standards and regulatory requirements.

Cybersecurity Governance

Our Board of Directors has charged the Audit Committee with oversight of the Company's identification, assessment, and management of cybersecurity and data privacy risks. As part of its oversight of our enterprise risk management program, the Audit Committee periodically reviews and prioritizes key risks facing our Company, including cybersecurity risk. Our Chief Information Security Officer (“CISO”) and Chief Technology Officer (“CTO”) manage our network operations and software development across corporate and franchise locations. The Board of Directors receives regular updates from the CISO and CTO regarding our cybersecurity program and actions taken to manage cybersecurity risk, which include risk identification and management strategies, consumer data protection, security programs, ongoing risk mitigation activities and results of third-party assessments and testing.

21