Company: COST
Filing Date: 2025-10-08
Form Type: 10-K
Source: 0000909832-25-000101
Chunk: 43

Company: COSTCO WHOLESALE CORP /NEW
Filing Date: 2025-10-08
Form: 10-K
Item: Item 1C
Chunk 43
---
 regularly to the Audit Committee. The Internal Audit team, in its periodic compliance and risk assessment updates to the Audit Committee, also reports on its reviews of certain of our cybersecurity risk exposures, controls, and management actions. The full Board also receives cybersecurity evaluations from time to time.Our information security organization is led by the CISO. The CISO is responsible for all aspects of our cybersecurity program, including cybersecurity engineering and architecture, cybersecurity operations, incident response, threat intelligence, identity and access management, cybersecurity risk and compliance, and vulnerability management. Our former CISO left the Company in June 2025, and we are actively sourcing a qualified replacement. In the interim, our Deputy CISO, who has over 20 years of cybersecurity and leadership experience, is managing the CISO responsibilities. The CISO position reports to our CIDO, who has more than 30 years experience in which he has led global digital responsibilities, including leading global cyber teams. Our CIDO reports to the Chief Executive Officer.

Risks from Material Cybersecurity Threats

We and our third-party service and merchandise providers have experienced cybersecurity incidents and threats. Based on the information available as of the date of this Form 10-K, we are not aware of any risks from actual cybersecurity incidents that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. It is possible that there have been intrusions into our systems that have not been identified by our controls and procedures and that might manifest in significant events at a later time. There can be no guarantee that the actions and controls we and our third-party service providers have implemented and are implementing will be sufficient to protect our systems, information or other property. See “Risk Factors” in Item 1A of this Form 10-K for more information on our cybersecurity-related risks.

19