Company: TJX
Filing Date: 2025-05-01
Form Type: DEF 14A
Source: 0000109198-25-000024
Chunk: 25

Company: TJX COMPANIES INC /DE/
Filing Date: 2025-05-01
Form: DEF 14A
Chunk 25
---
 and informal group meetings and presentations. We believe it is important to our long-term success that our management continue to focus on talent and leadership development, including training and mentoring, to foster expertise in our distinctive business model and to support our succession planning.

#### Cybersecurity
As a global retailer, we are mindful of the ongoing risks to our IT systems and operations from various sources and have implemented processes to monitor and mitigate these risks. We integrate cybersecurity risk into our broader enterprise risk management framework. Our Board has oversight of the systems and processes established to report and monitor the most significant risks to our business (including those related to cybersecurity) and administers this oversight with respect to cybersecurity directly and through our Audit and Finance Committee. Our Audit and Finance Committee reviews IT and cybersecurity risks and related topics with senior management on at least a quarterly basis. Significant cybersecurity risks identified by our Audit and Finance Committee are reported to the Board for review and consideration. Our Board has also had dedicated sessions during Board meetings on specific cybersecurity topics both led by our IT senior leaders and by outside advisors as part of its cybersecurity oversight practices. Additionally, outside of regular Board and committee meetings, the Chair of the IT Subcommittee of the Audit and Finance Committee meets with senior management (including the Chief Information Security Officer (CISO) and the Executive Vice President, Chief Information Officer (CIO)) on at least a quarterly basis to remain informed of and support the Company’s cybersecurity programs, including the Company’s assessment of current threats, defensive efforts, and other organizational initiatives.

For many years, we have maintained an Information Management Program that is overseen by TJX’s Information Management Steering Committee (IMSC), which is a cross-functional group consisting of senior leaders from areas such as IT, Cybersecurity, Risk and Compliance, Privacy, Legal, and Audit. This Committee is responsible for developing and updating policies to support TJX’s Information Management Program and enhance the overall privacy, information security, and records management posture of TJX. Our information security program is overseen by our CISO, who reports to our CIO. Our CISO is informed about and monitors the prevention, detection, and mitigation of cybersecurity threats through his management of, and participation in, TJX’s cybersecurity risk management and strategy processes.

#### Corporate Responsibility
The Board has oversight responsibility of our global corporate responsibility strategies, which include our global environmental sustainability and social compliance programs, among others. An executive steering committee, chaired by a Senior Executive Vice President (SEVP) who reports to the CEO and consisting of other senior executive leaders from functions including