Company: KMX
Filing Date: 2025-04-11
Form Type: 10-K
Source: 0001170010-25-000024
Chunk: 45

Company: CARMAX INC
Filing Date: 2025-04-11
Form: 10-K
Item: Item 1C
Chunk 45
---
 across the retail, travel, hospitality, finance, and technology industries for over 20 years.  The company’s CISO reports to the CITO, joined CarMax in 2015 and has served in various roles in information technology and cybersecurity for over 30 years, including prior service as the vice president of information security, risk and compliance for a Fortune 500 company.  Our CISO has various industry certifications, including the Certified in Risk and Information Systems Control (CRISC), the Certified in the Governance of Enterprise IT (CGEIT) and the Certified Information Systems Auditor (CISA) certifications. 

The Board’s Technology and Innovation Committee assists in the Board’s oversight of the company’s cybersecurity risk.  The Committee monitors and oversees the company’s exposure to cybersecurity occurrences as well as the company’s approach to managing cybersecurity risk, including how to reasonably control and monitor cybersecurity risks and effectively assign management oversight and responsibility.  CarMax’s management team, including the CITO and the CISO, provide quarterly updates to the Committee regarding the cybersecurity landscape and the company’s security posture in the context of external cybersecurity occurrences as well as updates on the latest issues related to cybersecurity risk as needed.

The company has not experienced any material cybersecurity incidents or incurred any material expenses resulting from a cybersecurity breach; however, we cannot provide assurance that our business strategy, results of operations and financial condition will not be materially affected in the future by such risks or any future material incidents.  For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to the risk factors captioned “We rely on third-party vendors for key components of our business” and “We collect sensitive confidential information from our customers.  A breach of this confidentiality, whether due to a cybersecurity or other incident, could result in harm to our customers and damage to our brand” set forth under the heading “Risk Factors” included in Part I, Item 1A of this Form 10-K.

20