Amazon 10-K cybersecurity disclosure (Item 1C), fiscal 2025

Item 1C. Cybersecurity

We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a security incident at a third-party vendor or customer. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions .

As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually.

We have a unified and centrally-coordinated team, led by our chief security officer , that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at Amazon in close coordination with senior leadership and other teams across Amazon. Reporting to our chief security officer are a number of experienced chief information security officers responsible for various parts of our business, including AWS, each of whom is supported by a team of trained cybersecurity professionals. In addition to our extensive in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by the Audit Committee and our Board of Directors. Such risks and mitigations are also subject to oversight by the Security Committee of our Board of Directors. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "We Could Be Harmed by Data Loss or Other Security Incidents," which should be read in conjunction with the information above.

The Security Committee, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. The Security Committee receives reports regarding such risks from management, including our chief security officer, and reports to the Board at least annually. The Security Committee also oversees the Board's response to any significant cybersecurity incidents.

Our chief security officer, who has extensive cybersecurity knowledge and skills gained from over 15 years of work experience on the security team at Amazon and an extensive career in the technology and cybersecurity industries as a senior executive in the federal government, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at Amazon and reports directly to the Chief Executive Officer.

Item 1C. Cybersecurity

We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of

mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a security incident at a third-party vendor or customer. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.

As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually.

We have a unified and centrally-coordinated team, led by our chief security officer, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at Amazon in close coordination with senior leadership and other teams across Amazon. Reporting to our chief security officer are a number of experienced chief information security officers responsible for various parts of our business, including AWS, each of whom is supported by a team of trained cybersecurity professionals. In addition to our extensive in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by the Audit Committee and our Board of Directors. Such risks and mitigations are also subject to oversight by the Security Committee of our Board of Directors. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "We Could Be Harmed by Data Loss or Other Security Breaches," which should be read in conjunction with the information above.

The Security Committee, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. The Security Committee receives reports regarding such risks from management, including our chief security officer, and reports to the Board at least annually. The Security Committee also oversees the Board's response to any significant cybersecurity incidents.

Our chief security officer, who has extensive cybersecurity knowledge and skills gained from over 15 years of work experience on the security team at Amazon and an extensive career in the technology and cybersecurity industries as a senior executive in the federal government, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at Amazon and reports directly to the Chief Executive Officer.