Company: TJX
Filing Date: 2025-04-02
Form Type: 10-K
Source: 0000109198-25-000010
Chunk: 85

Company: TJX COMPANIES INC /DE/
Filing Date: 2025-04-02
Form: 10-K
Item: Item 1C
Chunk 85
---
ITEM 1C.  Cybersecurity

Risk Management and Strategy

As a global retailer, we are mindful of the ongoing risks to our IT systems and operations from various sources and have implemented processes to monitor and mitigate these risks. We have adopted a cybersecurity program designed to identify, assess, and manage material risks from cybersecurity threats and have integrated cybersecurity risk into our broader enterprise risk management framework. We incorporate third-party assessments into our risk management program using recognized standards that are relevant to our business and we periodically self-assess various functional areas of our organization.We use a variety of strategies and techniques designed to identify cybersecurity risks and reduce the risk of unauthorized access to our organization’s confidential information (including customer, vendor, and Associate data) and critical business systems. This approach includes various assessment activities (e.g. threat actor emulation and penetration testing), tabletop exercises, security awareness and training activities (e.g. simulated phishing campaigns and specialized training for cybersecurity personnel), encryption of certain types of information, and certain controls governing access to TJX facilities and systems, among other threat- and risk-based safeguards. The scope and level of our risk-based initiatives in these areas varies across functions and across the business.We maintain an Information Management Program that is overseen by our Information Management Steering Committee (the “IMSC”), which is a cross-functional group consisting of senior leaders from areas such as IT, Cybersecurity, Risk and Compliance, Privacy, Legal, and Audit. The IMSC is responsible for developing and updating policies to support TJX’s Information Management Program and enhance the overall privacy, information security, and records management posture of our business. Within our Cybersecurity department, our Security Operations Center provides threat detection and incident response capabilities. We also have an incident response plan which describes roles and responsibilities for internal stakeholders in responding to and escalating potential cybersecurity incidents. We periodically test this plan through tabletop exercises with relevant stakeholders across various functions of our business, including members of senior management. 

We also have processes in place designed to identify and mitigate risks from third party technology and service providers, including, as appropriate, pre-contractual due diligence, review of contractual terms addressing cybersecurity and data protection, and periodic re-assessment based on assessed vendor risk.  

Board of Directors Oversight

Our Board of Directors has oversight of the systems and processes established to report and monitor the most significant risks to our business (including those related to cybersecurity) and administers this oversight with respect to cybersecurity directly and through our Audit and Finance Committee. Our Board of Directors has oversight of our enterprise risk management program and, in