Company: TJX
Filing Date: 2025-04-02
Form Type: 10-K
Source: 0000109198-25-000010
Chunk: 86

Company: TJX COMPANIES INC /DE/
Filing Date: 2025-04-02
Form: 10-K
Item: Item 1C
Chunk 86
---
 addition, our Audit and Finance Committee reviews IT and cybersecurity risks and related topics with senior management on at least a quarterly basis. Significant cybersecurity risks identified by our Audit and Finance Committee are reported to the Board for review and consideration. Our Board has also had dedicated sessions during Board meetings on specific cybersecurity topics both led by our IT senior leaders and by outside advisors as part of its cybersecurity oversight practices. Additionally, outside of regular Board and committee meetings, the Chair of the IT Subcommittee of the Audit and Finance Committee meets with senior management (including the Chief Information Security Officer (“CISO”) and the Executive Vice President, Chief Information Officer (“CIO”)) on at least a quarterly basis to remain informed of and support our cybersecurity programs, including our assessment of current threats, defensive efforts, and other organizational initiatives.

23

Management’s Role in Managing Risk

Our information security program is overseen by our CISO, who has over thirty-five years of cybersecurity, information governance, and IT experience in critical infrastructure, private industry, and government. Our CISO reports to our CIO, who has more than twenty-eight years of global information technology leadership experience. Our CISO is informed about and monitors the prevention, detection and mitigation of cybersecurity threats through his management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

As discussed in Item 1A in this Form 10-K, despite our continuing efforts, our IT systems, as well as those of our suppliers, service providers and other third parties whose IT systems we utilize directly or indirectly, are targeted by attempts to access or obtain personal or other sensitive information, attempts at monetary theft and attempts to disrupt business. These attempts continue to evolve and are becoming increasingly sophisticated (including through the use of artificial intelligence). While some of these attempts have resulted in cybersecurity incidents, the unauthorized intrusion into our network discovered late in 2006 is the only such cybersecurity incident to date that has been material to the results of our operations. For more information, see “Compromises of our cybersecurity, disruptions in our information technology systems, or failure to satisfy the information technology needs of our business could result in material loss or liability, materially impact our operating results or materially harm our reputation.” in Item 1A in this Form 10-K.