Company: COST
Filing Date: 2025-10-08
Form Type: 10-K
Source: 0000909832-25-000101
Chunk: 42

Company: COSTCO WHOLESALE CORP /NEW
Filing Date: 2025-10-08
Form: 10-K
Item: Item 1C
Chunk 42
---
Item 1C—Cybersecurity

Risk Management and Global StrategyWe have implemented processes, technologies, and controls to seek to assess, identify, and manage risks associated with cybersecurity threats. Management considers cybersecurity risks within our overall approach to enterprise risk management. We evaluate these risks based on several frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), Center for Internet Security (CIS) 18 Critical Security Controls, and the Payment Card Industry Data Security Standard. Our governance policies, including our Information Security Policy, outline high-level objectives designed to meet compliance and regulatory requirements.We undertake regular NIST CSF and CIS 18 Critical Security Controls assessments, conducted by a third-party, to measure program maturity. We have implemented a variety of technologies, leveraging third-party security providers for some, and engage in multiple activities to seek to identify and mitigate vulnerabilities and risks in systems. These include, among other activities, scanning for common vulnerabilities and exposures, penetration tests on internal and external networks, code scans on applications, allowed application listing, configuration management tools, employee awareness and training, and internal and external audits. We also review with various frequencies and on a risk-based priority select third parties with whom we do business, in an effort to reduce the likelihood of security 

18

Table of Contents

incidents or business interruptions. We maintain cybersecurity insurance that would apply to certain losses arising from significant security incidents.We maintain a security operations center, supported by external providers and our employees, which provides threat detection and incident response capabilities. We maintain cyber incident response plans and related playbooks in coordination with stakeholders (including legal counsel). Significant incidents will be escalated to a Cybersecurity Materiality Committee to assess materiality based on qualitative and quantitative factors. The Committee is composed of a cross-divisional group of executives representing the core business functions of Information Technology and Security, Operations, Administration, Finance and Accounting, and Legal. We conduct periodic tabletop exercises, including at the executive level, to review our response processes and incident management procedures.

GovernanceOur Board of Directors has delegated certain responsibilities to the Audit Committee of the Board. The Audit Committee reviews and discusses with management the identification and mitigation of cybersecurity risks, including (among other things) the effectiveness of risk-management policies and practices designed to help safeguard our operations, financial systems, and data. Our Chief Information and Digital Officer (CIDO) and his executive team, including the Vice President of Information Security and Chief Information Security Officer (CISO), present cybersecurity-related topics, including program maturity progress,