Disclosure · Form 10-K · fiscal 2026
Walmart 10-K cybersecurity disclosure (Item 1C), fiscal 2026
Filed March 13, 2026· period ended January 31, 2026· WMT· CIK 104169· Updated · filing on sec.gov ↗· company page
Walmart's Form 10-K for fiscal 2026, filed March 13, 2026, names the Chief Information Security Officer as its top security role, with oversight by the Audit Committee. On CISO Tribune's record, the Executive Vice President and Chief Information Security Officer of Walmart is Jerry R. Geisler III (verified November 8, 2026; record).
- Walmart: who leads security, and the seat's history
- Jerry R. Geisler III, Executive Vice President and Chief Information Security Officer of Walmart on our record
- How other retail-variety stores filers describe the seat
What Walmart's Item 1C says
Walmart's Form 10-K for fiscal 2026 places oversight of cybersecurity risk with the Audit Committee, to which the Board of Directors has delegated that responsibility. The filing states that the Chief Information Security Officer leads Walmart's Information Security organization and oversees the cybersecurity program.
Board and management oversight
The Audit Committee receives periodic updates from the Chief Information Security Officer, the Chief Technology Officer and other members of management on risks related to information security and cybersecurity. The Board of Directors receives regular reports from the Audit Committee chair on these and other risk-related matters as deemed necessary. The CISO or other members of management provide information to the Audit Committee under risk-based escalation protocols for cybersecurity incidents that exceed established reporting thresholds. Several Board members, including certain members of the Audit Committee, have backgrounds or professional experience in risk management, digital platforms, information technology or cybersecurity.
Who leads security
The CISO has been a Walmart associate for over 30 years and has served in various roles in information technology and information security for more than 20 years. The Chief Technology Officer, to whom the CISO reports, has served as Walmart's CTO since 2019.
How the company manages cyber risk
The cybersecurity program is informed by various industry frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF). Walmart maintains incident response and recovery plans that address its response to cybersecurity incidents. Walmart provides recurring information security training to its associates and certain third parties based on access, risk, roles, policies, standards and behaviors. Walmart engages in periodic assessment and testing of its policies, standards, processes and practices that are designed to address cybersecurity threats. Cybersecurity is described as an important component of the overall approach to enterprise risk management.
Third parties and incidents
Walmart regularly engages assessors, consultants, auditors or other third parties to assist with its assessments and testing. Walmart maintains a risk-based approach to managing cybersecurity threats presented by third-party systems that support its operations, including vendors, service providers and subcontractors. Certain systems of Walmart and of its third-party service providers have experienced cybersecurity incidents and threats. Walmart states it is not aware of cybersecurity risks that have materially affected it or are reasonably likely to do so, based on information available as of the date of the Form 10-K.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed March 13, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Information Security Officer
Reports to
not identified
Board oversight
Audit Committee
“Our Board of Directors, which has primary responsibility for overseeing risk management, has delegated risk management oversight responsibility for information systems, information security, data privacy and cybersecurity to the Audit Committee.”
CISO or other person named
not identified
Frameworks and standards named
NIST Cybersecurity Framework
Where the filing names it
- NIST Cybersecurity Framework: “Our cybersecurity program is informed by various industry frameworks including the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF), which are reflected in our related policies, standards, processes and practices.”
Outside assessors, consultants or testers
Described
“We regularly engage assessors, consultants, auditors or other third parties to assist with our assessments and testing.”
Experience of the security leadership, as stated
Stated
“Our CISO has been a Walmart associate for over 30 years, has served in various roles in information technology and information security at Walmart for more than 20 years, and has received industry-recognized information security certifications.”
Material incident
The filing states none
“Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.”
The section
1,048 words, Form 10-K filed March 13, 2026 for the period ended January 31, 2026
Read by claude-sonnet-5-5 on October 18, 2026; every quote verified in the stored text by code; 1 proposed field not found in the text and left empty.
How peers in the same industry describe the seat
The SEC assigns Walmart standard industrial classification 5331, Retail-variety stores (SEC SIC list). 2 other filers in our library have the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Trade & Services).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Dollar General CorpFY 2026, filed March 20, 2026 | Senior Vice President of Technology and Chief Information Security Officer | Executive Vice President and Chief Information Officer | Audit Committee of our Board of Directors |
| Ollie's Bargain Outlet Holdings, Inc.FY 2026, filed March 19, 2026 | Chief Information Officer | not identified | Audit Committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| VIP Play, Inc.FY 2026, filed September 29, 2026 | Chief Technology Officer | not identified | full board |
| GenFlat Holdings, Inc.FY 2026, filed September 25, 2026 | Chief Executive Officer and Chief Financial Officer | not identified | full board |
| Stitch Fix, Inc.FY 2026, filed September 24, 2026 | Chief Information Security Officer | Chief Product and Technology Officer | Audit Committee |
| CreditRiskMonitor Com IncFY 2025, filed August 19, 2026 | Chief Technology Officer | not identified | Audit Committee |
| H&R BlockFY 2026, filed August 14, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Caro Holdings Inc.FY 2026, filed July 15, 2026 | not identified | not identified | not identified |
More disclosures from filers CISO Tribune files under Retail & Consumer: AutoNation, Coca-Cola, Home Depot, Marriott International, Nike, PENN Entertainment, Primo Brands, Ralph Lauren.
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Walmart's Form 10-K as filed with the SEC on March 13, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C.
CYBERSECURITY
Walmart seeks to build and maintain the trust of customers, associates, shareholders and other stakeholders with respect to our use of technology and data. Our digital trust commitments, in line with our Company's values of service, excellence, integrity and respect for the individual, provide a foundation for our approach to cybersecurity.
The Board of Directors, committees of the Board of Directors and management coordinate risk oversight and management responsibilities, and cybersecurity represents an important component of our overall approach to enterprise risk management. In general, we seek to address cybersecurity risks through a cross-functional approach focused on protecting business operations and preserving the confidentiality, integrity and availability of information by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
Board of Directors' oversight of risks from cybersecurity threats
Our Board of Directors, which has primary responsibility for overseeing risk management, has delegated risk management oversight responsibility for information systems, information security, data privacy and cybersecurity to the Audit Committee. Several of our Board members, including certain members of our Audit Committee, have backgrounds or professional experience in risk management, digital platforms, information technology or cybersecurity.
The Audit Committee receives periodic updates from our Chief Information Security Officer ("CISO"), Chief Technology Officer ("CTO") and other members of management on risks related to information systems, information security, data privacy and cybersecurity. Specific topics may include updates to our company's approach to cybersecurity risk management; recent developments; key initiatives; the threat landscape; trends; and the results of certain assessments and testing. The Board of Directors receives regular reports from the Audit Committee chair on these and other risk-related matters as deemed necessary. Our CISO or other members of management provide information to the Audit Committee pursuant to risk-based escalation protocols for cybersecurity incidents that exceed established reporting thresholds.
Management's role in assessing and managing material risks from cybersecurity threats
Our CISO leads Walmart's Information Security organization and has responsibility for overseeing our Company's cybersecurity program. To operationalize our program, we deploy multidisciplinary teams, including cybersecurity personnel and professionals, to address cybersecurity threats and respond to cybersecurity incidents, including for those recently acquired and non-wholly owned subsidiaries whose systems have not been fully integrated into Walmart's networks. Through ongoing engagement with these teams and certain third-party service providers, our CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. Cybersecurity incidents that reach established thresholds are reported to senior management and the Audit Committee and are analyzed for external reporting requirements.
Our CISO has been a Walmart associate for over 30 years, has served in various roles in information technology and information security at Walmart for more than 20 years, and has received industry-recognized information security certifications. Our CTO, to whom the CISO reports, has served as Walmart's CTO since 2019 and prior to that had experience managing technology and other risks at several other large public companies.
Risk Management and Strategy
Our cybersecurity program is informed by various industry frameworks including the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF), which are reflected in our related policies, standards, processes and practices. We may implement changes to our cybersecurity program when deemed appropriate based on updates to laws or industry standards among other things. We have multiple layers of security designed to detect and prevent cybersecurity events, as well as dedicated teams of cybersecurity personnel and professionals, which assist our CISO in helping to assess, identify, monitor, detect and manage cybersecurity risks, threats, vulnerabilities and incidents. We collaborate with public and private entities and industry groups and engage third-party service providers to expand the capabilities and capacity of our cybersecurity program when deemed appropriate. Certain key components of our cybersecurity program include the following:
Protecting our technology and information systems: When we implement significant changes to our technologies or information systems, we conduct risk-based security and privacy impact assessments and deploy technical safeguards that are designed to reasonably protect our technology and information systems from cybersecurity threats. We actively monitor and proactively research potential cybersecurity threats to our technologies and information systems. We use what we learn to evolve our security controls over time to mitigate risks posed by such threats.
Incident response and recovery planning: We maintain incident response and recovery plans that address our response to cybersecurity incidents, including incidents that we become aware of at third parties that support our operations. These plans guide how we evaluate and assign incident severity levels and reporting thresholds; escalate and engage incident response teams; and manage and mitigate the related risks.
Third-party risk management: We maintain a risk-based approach to identifying and managing cybersecurity threats presented to Walmart by third-party systems that support our operations, as well as third-party users of our data and systems, including vendors, service providers and subcontractors.
Training and awareness: We provide recurring information security training (which includes cybersecurity training) to our associates and certain third parties based on access, risk, roles, policies, standards and behaviors.
Assessments and testing: We engage in periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats. These efforts include tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage assessors, consultants, auditors or other third parties to assist with our assessments and testing. Where appropriate we adjust our cybersecurity policies, standards, processes and practices accordingly based on internal and external assessment and testing results.
Certain of Walmart's systems and those of our third-party service providers have experienced cybersecurity incidents and threats. Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. Additional information about cybersecurity risks we face is discussed in " Item 1A. Risk Factors ," which should be read in conjunction with the information above.
Earlier filings on record
Fiscal 2025 Form 10-K, filed March 14, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“Our Board of Directors, which has primary responsibility for overseeing risk management, has delegated risk management oversight responsibility for information systems, information security, data privacy and cybersecurity to the Audit Committee.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our CISO has been a Walmart associate for over 30 years, has served in various roles in information technology and information security at Walmart for more than 20 years, and has received industry-recognized information security certifications.”
Material incident
The filing states none
“Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 18, 2026; every quote verified in the stored text by code; 1 proposed field not found in the text and left empty.
ITEM 1C.
CYBERSECURITY
Walmart seeks to build and maintain the trust of customers, associates, shareholders and other stakeholders with respect to our use of technology and data. Our digital trust commitments, in line with our Company's values of service, excellence, integrity and respect for the individual, provide a foundation for our approach to cybersecurity.
The Board of Directors, committees of the Board of Directors and management coordinate risk oversight and management responsibilities, and cybersecurity represents an important component of our overall approach to enterprise risk management. In general, we seek to address cybersecurity risks through a cross-functional approach focused on protecting business operations and preserving the confidentiality, integrity and availability of information by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
Board of Directors' oversight of risks from cybersecurity threats
Our Board of Directors, which has primary responsibility for overseeing risk management, has delegated risk management oversight responsibility for information systems, information security, data privacy and cybersecurity to the Audit Committee. Several of our Board members, including certain members of our Audit Committee, have backgrounds or professional experience in risk management, digital platforms, information technology or cybersecurity.
The Audit Committee receives periodic updates from our Chief Information Security Officer ("CISO"), Chief Technology Officer ("CTO") and other members of management on risks related to information systems, information security, data privacy and cybersecurity. Specific topics may include updates to our company's approach to cybersecurity risk management; recent developments; key initiatives; the threat landscape; trends; and the results of certain assessments and testing. The Board of Directors receives regular reports from the Audit Committee chair on these and other risk-related matters as deemed necessary. Our CISO or other members of management provide information to the Audit Committee pursuant to risk-based escalation protocols for cybersecurity incidents that exceed established reporting thresholds.
Management's role in assessing and managing material risks from cybersecurity threats
Our CISO leads Walmart's Information Security organization and has responsibility for overseeing our Company's cybersecurity program. To operationalize our program, we deploy multidisciplinary teams, including cybersecurity personnel and professionals, to address cybersecurity threats and respond to cybersecurity incidents, including for those recently acquired and non-wholly owned subsidiaries whose systems have not been fully integrated into Walmart's networks. Through ongoing engagement with these teams and certain third-party service providers, our CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and reports cybersecurity incidents that reach established thresholds to senior management and the Audit Committee, which are also analyzed for external reporting requirements.
Our CISO has been a Walmart associate for over 30 years, has served in various roles in information technology and information security at Walmart for more than 20 years, and has received industry-recognized information security certifications. Our CTO, to whom the CISO reports, has served as Walmart's CTO since 2019 and prior to that had experience managing technology and other risks at several other large public companies.
Risk Management and Strategy
Our cybersecurity program is informed by various industry frameworks including the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF), which are reflected in our related policies, standards, processes and practices. We may implement changes to our cybersecurity program when deemed appropriate based on updates to laws or industry standards among other things. We have multiple layers of security designed to detect and prevent cybersecurity events, as well as dedicated teams of cybersecurity personnel and professionals, which assist our CISO in helping to assess, identify, monitor, detect and manage cybersecurity risks, threats, vulnerabilities and incidents. We collaborate with public and private entities and industry groups and engage third-party service providers to expand the capabilities and capacity of our cybersecurity program when deemed appropriate. Certain key components of our cybersecurity program include the following:
Protecting our technology and information systems: When we implement significant changes to our technologies or information systems, we conduct risk-based security and privacy impact assessments and deploy technical safeguards that are designed to reasonably protect our technology and information systems from cybersecurity threats. We actively monitor and proactively research potential cybersecurity threats to our technologies and information systems. We use what we learn to evolve our security controls over time to mitigate risks posed by such threats.
Incident response and recovery planning: We maintain incident response and recovery plans that address our response to cybersecurity incidents, including incidents that we become aware of at third parties that support our operations. These plans guide how we evaluate and assign incident severity levels and reporting thresholds; escalate and engage incident response teams; and manage and mitigate the related risks.
Third-party risk management: We maintain a risk-based approach to identifying and managing cybersecurity threats presented to Walmart by third-party systems that support our operations, as well as third-party users of our data and systems, including vendors, service providers and subcontractors.
Training and awareness: We provide recurring information security training (which includes cybersecurity training) to our associates and certain third parties based on access, risk, roles, policies, standards and behaviors.
Assessments and testing: We engage in periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats. These efforts include tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage assessors, consultants, auditors or other third parties to assist with our assessments and testing. Where appropriate we adjust our cybersecurity policies, standards, processes and practices accordingly based on internal and external assessment and testing results.
Certain of Walmart's systems and those of our third-party service providers have experienced cybersecurity incidents and threats. Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. Additional information about cybersecurity risks we face is discussed in " Item 1A. Risk Factors ," which should be read in conjunction with the information above.
Fiscal 2024 Form 10-K, filed March 15, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
CTO
“Our CTO, to whom the CISO reports, has served as Walmart's CTO since 2019 and prior to that had experience managing technology and other risks at several other large public companies.”
Board oversight
Audit Committee
“Our Board of Directors, which has primary responsibility for overseeing risk management, has delegated risk management oversight responsibility for information systems, information security, data privacy and cybersecurity to the Audit Committee.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our CISO has been a Walmart associate for over 30 years, has served in various roles in information technology and information security at Walmart for almost 20 years, and has received industry-recognized information security certifications.”
Material incident
The filing states none
“Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 18, 2026; every quote verified in the stored text by code.
ITEM 1C.
CYBERSECURITY
Walmart seeks to build and maintain the trust of customers, associates, shareholders and other stakeholders with respect to our use of technology and data. Our digital trust commitments, in line with our Company's values of service, excellence, integrity and respect for the individual, provide a foundation for our approach to cybersecurity.
The Board of Directors, committees of the Board of Directors and management coordinate risk oversight and management responsibilities, and cybersecurity represents an important component of our overall approach to enterprise risk management. In general, we seek to address cybersecurity risks through a cross-functional approach focused on protecting business operations and preserving the confidentiality, integrity and availability of information by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
Board of Directors' oversight of risks from cybersecurity threats
Our Board of Directors, which has primary responsibility for overseeing risk management, has delegated risk management oversight responsibility for information systems, information security, data privacy and cybersecurity to the Audit Committee. Several of our Board members, including certain members of our Audit Committee, have backgrounds or professional experience in risk management, digital platforms, information technology or cybersecurity.
The Audit Committee receives periodic updates from our Chief Information Security Officer ("CISO"), Chief Technology Officer ("CTO") and other members of management on risks related to information systems, information security, data privacy and cybersecurity. Specific topics may include updates to our company's approach to cybersecurity risk management; recent developments; key initiatives; the threat landscape; trends; and the results of certain assessments and testing. The Board of Directors receives regular reports from the Audit Committee chair on these and other risk-related matters as deemed necessary. Our CISO or other members of management provide information to the Audit Committee pursuant to risk-based escalation protocols for cybersecurity incidents that exceed established reporting thresholds.
Management's role in assessing and managing material risks from cybersecurity threats
Our CISO leads Walmart's Information Security organization and has responsibility for overseeing our Company's cybersecurity program. To operationalize our program, we deploy multidisciplinary teams, including cybersecurity personnel and professionals, to address cybersecurity threats and respond to cybersecurity incidents, including for those non-wholly owned subsidiaries whose systems have not been fully integrated into Walmart's networks. Through ongoing engagement with these teams and certain third-party service providers, our CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and reports cybersecurity incidents that reach established thresholds to senior management and the Audit Committee, which are also analyzed for external reporting requirements.
Our CISO has been a Walmart associate for over 30 years, has served in various roles in information technology and information security at Walmart for almost 20 years, and has received industry-recognized information security certifications. Our CTO, to whom the CISO reports, has served as Walmart's CTO since 2019 and prior to that had experience managing technology and other risks at several other large public companies.
Risk Management and Strategy
Our cybersecurity program is informed by various industry frameworks including the National Institute of Standards and Technology Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (NIST-CSF Version 1.1), which are reflected in our related policies, standards, processes and practices. We may implement changes to our cybersecurity program when deemed necessary based on updates to industry standards among other things. We have multiple layers of security designed to detect and block cybersecurity events, as well as dedicated teams of cybersecurity personnel and professionals, which assist our CISO in helping to assess, identify, monitor, detect and manage cybersecurity risks, threats, vulnerabilities and incidents. We collaborate with public and private entities and industry groups and engage third-party service providers to expand the capabilities and capacity of our cybersecurity program when deemed necessary. Certain key components of our cybersecurity program include the following:
Protecting our technology and information systems: When we implement significant changes to our technologies or information systems, we conduct risk-based security and privacy impact assessments and deploy technical safeguards that are designed to reasonably protect our technology and information systems from cybersecurity threats. We actively monitor and proactively research potential cybersecurity threats to our technologies and information systems. We use what we learn to evolve our security controls over time to mitigate risks posed by such threats.
Incident response and recovery planning: We maintain incident response and recovery plans that address our response to cybersecurity incidents, including incidents that we become aware of at third parties that support our operations. These plans guide how we evaluate and assign incident severity levels and reporting thresholds; escalate and engage incident response teams; and manage and mitigate the related risks.
Third-party risk management: We maintain a risk-based approach to identifying and managing cybersecurity threats presented to Walmart by third-party systems that support our operations, as well as third-party users of our data and systems, including vendors, service providers and subcontractors.
Training and awareness: We provide recurring information security training (which includes cybersecurity training) to our associates and certain third parties based on access, risk, roles, policies, standards and behaviors.
Assessments and testing: We engage in periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats. These efforts include tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to assist with our assessments and testing. Where appropriate we adjust our cybersecurity policies, standards, processes and practices accordingly based on internal and external assessment and testing results.
Certain of Walmart's systems and those of our third-party service providers have experienced cybersecurity incidents and threats. Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. Additional information about cybersecurity risks we face is discussed in " Item 1A . Risk Factors ," which should be read in conjunction with the information above.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.