Company: JACK
Filing Date: 2025-11-19
Form Type: 10-K
Source: 0000807882-25-000072
Chunk: 51

Company: JACK IN THE BOX INC
Filing Date: 2025-11-19
Form: 10-K
Item: Item 1C
Chunk 51
---
ITEM 1C.    CYBERSECURITY

Cybersecurity Risk Management and StrategyThe Company maintains a comprehensive information security program that is designed to identify, protect against, detect, and respond to, and manage cybersecurity threats. The program contains security measures that include, but are not limited to, the following: security policies and procedures; physical and environmental protections; monitoring processes and systems; asset management; risk assessments; a vulnerability management and remediation program; and maintenance of a third-party risk management program.Our Information Security Policy provides guidance on the requirements necessary to ensure the security of the Company’s data, systems, and networks. It applies to all individuals who access IT resources or data processed by the Company. We use commercially reasonable efforts to follow industry standards and best practices, including the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework, for our IT Security Incident Response Plan.Our technology structures undergo an annual assessment to evaluate risk using the NIST Cybersecurity Framework. Our IT Security Incident Response Plan defines a cybersecurity incident and outlines the roles, responsibilities, and procedures for us to respond effectively. Having a structured plan enables a rapid response, effective recovery, clear communication and coordinated action to major security incidents. Our plan allows us to reduce recovery time and cost and to also maintain business continuity.Our IT Application Security Program includes reviews and assessments of security vulnerabilities and remediation. We use commercially reasonable efforts to update security systems regularly to protect against known vulnerabilities. We plan to perform vulnerability scans at least quarterly and penetration testing annually as well as after any significant infrastructure or application modification. Whitebox and blackbox security testing and manual penetration testing is performed to monitor security controls and defenses.All employees and third-party contractors with access to the Company’s IT infrastructure must annually acknowledge that they have read and understand the IT User Acceptance Policy. Employees and contractors must also complete information security awareness training upon initial hire and annually thereafter.

20

We have measures in place to protect the confidentiality, integrity and availability of franchise and customer information. Most personally identifiable information (“PII”) handled by our restaurants is associated with payment cards, which are protected by an EMV chip reader that encrypts and tokenizes customer data, so it passes through our networks without retaining any personal information. We do not store any credit or debit card information from customers. All information is processed through a third-party firm. To maintain the safety and security of our customers’ private payment information, we follow the Payment Card Industry Data Security Standard (“PCI DSS”) to ensure our processes and systems are well equipped for