Disclosure · Form 10-K · fiscal 2026
Stitch Fix, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2026
Filed September 24, 2026· period ended August 1, 2026· SFIX· CIK 1576942· Updated · filing on sec.gov ↗
Stitch Fix, Inc.'s Form 10-K for fiscal 2026, filed September 24, 2026, names the Chief Information Security Officer as its top security role, reporting to the Chief Product and Technology Officer, with oversight by the Audit Committee.
What Stitch Fix's Item 1C says
Stitch Fix's Form 10-K for fiscal 2026 places oversight of the cybersecurity program and the enterprise risk management process with the Audit Committee. The Chief Information Security Officer oversees the company's cybersecurity program in management.
Board and management oversight
The Audit Committee also evaluates enterprise level risks and strategies, including the company's cybersecurity risk. The Audit Committee receives updates from management on the effectiveness of the cybersecurity program. The Audit Committee reviews plans on how management will enhance the program, receives updates on special topics, and is notified in the event of certain cybersecurity incidents. The CISO chairs the Cybersecurity Governance Committee, which is made up of executive leaders across Legal, Finance, and Corporate Communications.
Who leads security
The CISO reports to the Chief Product and Technology Officer and has over 25 years of experience in information technology, risk, and cybersecurity leadership. The CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the company's overall risk management strategy, and communicating key priorities to relevant personnel.
How the company manages cyber risk
The company has implemented a cybersecurity risk management strategy and governance framework designed to identify, assess, manage, mitigate, and respond to cybersecurity risks and threats. The company trains its employees through annual security training, phishing simulations, and communications about cybersecurity topics and threats. The company's cybersecurity program includes tools and processes designed to detect unusual network activity, anomalous cybersecurity events, and breaches. The company has developed an incident response plan that includes predefined roles and responsibilities, communication protocols, and steps to contain and remediate vulnerabilities.
Third parties and incidents
The company uses third-party service providers from time to time, which may include threat intelligence providers, cybersecurity consultants, penetration testing firms, and forensic investigators. Its cybersecurity incident response processes include escalating information about certain incidents, depending on the circumstances, to the CISO, members of management, and the Audit Committee. The company states that it has not experienced a material cybersecurity breach.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a specific security framework or standard.
Read from the Form 10-K filed September 24, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Information Security Officer
Reports to
Chief Product and Technology Officer
“Our CISO, who reports to our Chief Product and Technology Officer ("CPTO"), has over 25 years of experience in information technology, risk, and cybersecurity leadership, and has previously held both CISO and Chief Technology Officer roles.”
Board oversight
Audit Committee
“The Audit Committee provides oversight for our cybersecurity program and our enterprise risk management process.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“Our CISO, who reports to our Chief Product and Technology Officer ("CPTO"), has over 25 years of experience in information technology, risk, and cybersecurity leadership, and has previously held both CISO and Chief Technology Officer roles.”
Material incident
The filing states none
“Although we have not experienced a material cybersecurity breach, we cannot guarantee that we will not experience a material cyber threat or incident in the future.”
The section
762 words, Form 10-K filed September 24, 2026 for the period ended August 1, 2026
Read by claude-sonnet-5-5 on November 1, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Stitch Fix, Inc. standard industrial classification 5961, Retail-catalog & mail-order houses (SEC SIC list). 3 other filers in our library have the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Trade & Services).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Caro Holdings Inc.FY 2026, filed July 15, 2026 | not identified | not identified | not identified |
| Innovative Payment Solutions, Inc.FY 2025, filed March 31, 2026 | not identified | not identified | not identified |
| AmazonFY 2025, filed February 6, 2026 | chief security officer | Chief Executive Officer | Security Committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| VIP Play, Inc.FY 2026, filed September 29, 2026 | Chief Technology Officer | not identified | full board |
| GenFlat Holdings, Inc.FY 2026, filed September 25, 2026 | Chief Executive Officer and Chief Financial Officer | not identified | full board |
| CreditRiskMonitor Com IncFY 2025, filed August 19, 2026 | Chief Technology Officer | not identified | Audit Committee |
| H&R BlockFY 2026, filed August 14, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Barnes & Noble Education, Inc.FY 2026, filed July 9, 2026 | Chief Information Security Officer | Chief Information Officer | Audit Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Stitch Fix, Inc.'s Form 10-K as filed with the SEC on September 24, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C.
CYBERSECURITY.
RISK MANAGEMENT AND STRATEGY
At Stitch Fix, we recognize the importance of robust cybersecurity measures to protect our systems, data, and the interests of our stakeholders. We have implemented a cybersecurity risk management strategy and governance framework designed to identify, assess, manage, mitigate, and respond to cybersecurity risks and threats, including risks arising from emerging technologies and the use of artificial intelligence. Our risk management strategy and governance framework is designed to identify, assess and manage material risks from cybersecurity threats to our systems, networks, and data infrastructure, including intellectual property, customer data, and data that is proprietary, strategic or competitive in nature ("Information Systems and Data").
We use third-party service providers to assist us from time to time to identify, assess, and manage risks from cybersecurity threats, which may include professional services firms (such as legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, penetration testing firms, dark web monitoring services, and forensic investigators.
Stitch Fix views its cybersecurity strategy through a multi-pronged lens encompassing prevention, detection, and response to ensure holistic coverage of our Information Systems and Data, along with the environments in which they operate.
Prevention
Our cybersecurity program starts with prevention, which includes risk assessment and identification. We utilize that information to design a layer of controls as a baseline. We conduct assessments to identify and evaluate potential cybersecurity risks. This process involves analyzing our Information Systems and Data to identify vulnerabilities and potential threats. Our risk assessment processes also consider cybersecurity risks associated with the use of artificial intelligence and other emerging technologies, including risks to sensitive data, access to Company systems and information, third-party AI tools and service providers, and the security of information processed through such technologies. Our cybersecurity program also includes third-party risk management, in which we oversee the identification and mitigation of risk associated with outsourcing to third-party vendors and service providers, particularly focused on vendors who process sensitive information .
In addition to our risk assessment processes, we prioritize cybersecurity awareness and training programs for our employees. These initiatives are designed to educate our workforce about potential threats, best practices for data protection, and the importance of maintaining security measures. We train our employees through annual security training, phishing simulations, and communications about cybersecurity topics and threats.
Detection
Our cybersecurity program includes tools and processes designed to detect unusual network activity, anomalous cybersecurity events, and breaches. We utilize a variety of monitoring processes and detective controls designed to identity anomalous activity and potential cybersecurity events.
Response
We have developed an incident response plan to ensure a swift and effective response in the event of a cybersecurity incident. This plan includes predefined roles and responsibilities, communication protocols, and steps to contain and remediate any vulnerabilities that may lead to a breach.
GOVERNANCE
Our Chief Information Security Officer ("CISO") oversees the Company's cybersecurity program. Our CISO, who reports to our Chief Product and Technology Officer ("CPTO"), has over 25 years of experience in information technology, risk, and cybersecurity leadership, and has previously held both CISO and Chief Technology Officer roles. Our CISO chairs the Company's Cybersecurity Governance Committee, comprised of executive leaders
across Legal, Finance, and Corporate Communications, that has oversight responsibilities regarding the Company's information security functions, including infrastructure, governance, privacy, and compliance.
Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, including those associated with emerging technologies, and communicating key priorities to relevant personnel. The Information Security Team conducts exercises to prepare for cybersecurity incidents, approves cybersecurity processes, and reviews security assessments and other security-related reports.
Our cybersecurity incident response processes include the escalation of information about certain cybersecurity incidents, depending on the circumstances, to our CISO, members of management, and the Audit Committee of the Board of Directors.
The Audit Committee provides oversight for our cybersecurity program and our enterprise risk management process. The Audit Committee also evaluates enterprise level risks and strategies, including our cybersecurity risk. The Audit Committee receives updates from management on the effectiveness of our cybersecurity program. The Audit Committee also reviews plans on how management will enhance the program, receives updates on special topics that help the Committee provide effective oversight of the program, and is notified in the event of certain cybersecurity incidents.
Although we have not experienced a material cybersecurity breach, we cannot guarantee that we will not experience a material cyber threat or incident in the future. For more information regarding the cybersecurity risks we face , see Item 1A. Risk Factors in this Annual Report.
Earlier filings on record
Fiscal 2025 Form 10-K, filed September 25, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
Chief Product and Technology Officer
“Our CISO, who reports to our Chief Product and Technology Officer ("CPTO"), has over 20 years of experience in information technology, risk, and cybersecurity leadership, and has previously held both CISO and Chief Technology Officer roles.”
Board oversight
Audit Committee
“The Audit Committee provides oversight for our cybersecurity program and our enterprise risk management process.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our CISO, who reports to our Chief Product and Technology Officer ("CPTO"), has over 20 years of experience in information technology, risk, and cybersecurity leadership, and has previously held both CISO and Chief Technology Officer roles.”
Material incident
The filing states none
“Although we have not experienced a material cybersecurity breach, we cannot guarantee that we will not experience a material cyber threat or incident in the future.”
Read by claude-sonnet-5-5 on November 1, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY.
RISK MANAGEMENT AND STRATEGY
At Stitch Fix, we recognize the importance of robust cybersecurity measures to protect our systems, data, and the interests of our stakeholders. We have implemented a comprehensive cybersecurity risk management strategy and governance framework to identify, assess, manage, mitigate, and respond to cybersecurity risks and threats. Our risk management strategy and governance framework is designed to identify, assess and manage material risks from cybersecurity threats to our systems, networks, and data infrastructure, including intellectual property, customer data, and data that is proprietary, strategic or competitive in nature ("Information Systems and Data").
We use third-party service providers to assist us from time to time to identify, assess, and manage risks from cybersecurity threats, which may include professional services firms (such as legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, penetration testing firms, dark web monitoring services, and forensic investigators.
Stitch Fix views its cybersecurity strategy through a multi-pronged lens encompassing prevention, detection, and response to ensure holistic coverage of our Information Systems and Data, along with the environments in which they operate.
Prevention
Our cybersecurity program starts with prevention, which includes risk assessment and identification. We utilize that information to design a layer of controls as a baseline. We conduct assessments to identify and evaluate potential cybersecurity risks. This process involves analyzing our Information Systems and Data to identify vulnerabilities and potential threats. Our cybersecurity program also includes third-party risk management, in which we oversee the identification and mitigation of risk associated with outsourcing to third-party vendors and service providers, particularly focused on vendors who process sensitive information .
In addition to our risk assessment processes, we prioritize cybersecurity awareness and training programs for our employees. These initiatives are designed to educate our workforce about potential threats, best practices for data protection, and the importance of maintaining security measures. We train our employees through annual security training, phishing simulations, and communications about cybersecurity topics and threats.
Detection
Our cybersecurity program includes tools and processes designed to detect unusual network activity, anomalous cybersecurity events, and breaches. We utilize a variety of preventative measures and detective tools.
Response
We have developed an incident response plan to ensure a swift and effective response in the event of a cybersecurity incident. This plan includes predefined roles and responsibilities, communication protocols, and steps to contain and remediate any vulnerabilities that may lead to a breach.
GOVERNANCE
Our Chief Information Security Officer ("CISO") oversees the Company's cybersecurity program. Our CISO, who reports to our Chief Product and Technology Officer ("CPTO"), has over 20 years of experience in information technology, risk, and cybersecurity leadership, and has previously held both CISO and Chief Technology Officer roles. Our CISO chairs the Company's Cybersecurity Governance Committee, comprised of executive leaders across Legal, Finance, and Corporate Communications, that has oversight responsibilities regarding the Company's information security functions, including infrastructure, governance, privacy, and compliance.
Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Information Security Team conducts exercises to prepare for cybersecurity incidents, approves cybersecurity processes, and reviews security assessments and other security-related reports.
Our cybersecurity incident response processes include the escalation of information about certain cybersecurity incidents, depending on the circumstances, to our CISO, members of management, and the Audit Committee of the Board of Directors.
The Audit Committee provides oversight for our cybersecurity program and our enterprise risk management process. The Audit Committee also evaluates enterprise level risks and strategies, including our cybersecurity risk. The Audit Committee receives updates from management on the effectiveness of our cybersecurity program. The Audit Committee also reviews plans on how management will enhance the program, receives updates on special topics that help the Committee provide effective oversight of the program, and is notified in the event of certain cybersecurity incidents.
Although we have not experienced a material cybersecurity breach, we cannot guarantee that we will not experience a material cyber threat or incident in the future. For more information regarding the cybersecurity risks we face , see Item 1A. Risk Factors in this Annual Report.
Fiscal 2024 Form 10-K, filed September 25, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
Chief Technology Officer
“Our CISO, who reports to our Chief Technology Officer ("CTO"), has over 20 years of experience in information technology, risk, and cybersecurity leadership, and has previously held both CISO and CTO roles.”
Board oversight
Audit Committee of our Board of Directors
“The Audit Committee of our Board of Directors provides oversight for our cybersecurity program and our enterprise risk management process, which evaluates enterprise level risks and strategies, including our cybersecurity risk.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our CISO, who reports to our Chief Technology Officer ("CTO"), has over 20 years of experience in information technology, risk, and cybersecurity leadership, and has previously held both CISO and CTO roles.”
Material incident
The filing states none
“Although we have not experienced a material cybersecurity breach, we cannot guarantee that we will not experience a cyber threat or incident in the future.”
Read by claude-sonnet-5-5 on November 1, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
Risk Management and Strategy
At Stitch Fix, we recognize the importance of robust cybersecurity measures to protect our systems, data, and the interests of our stakeholders. We have implemented a comprehensive cybersecurity risk management strategy and governance framework to identify, assess, manage, mitigate, and respond to cybersecurity risks and threats.
Stitch Fix views its cybersecurity strategy through a multi-pronged lens encompassing prevention, detection, and response to ensure holistic coverage of the program and our environments.
Prevention
Our cybersecurity program starts with prevention, which includes risk assessment and identification. We utilize that information to design an effective layer of controls as a baseline. We regularly conduct assessments to identify and evaluate potential cybersecurity risks. This process involves analyzing our systems, networks, and data infrastructure to identify vulnerabilities and potential threats. Our cybersecurity program also includes a dedicated function for third party risk management, in which we oversee the identification and mitigation of risk associated with outsourcing to third party vendors and service providers, particularly focused on vendors who process sensitive information.
In addition to our risk assessment processes, we prioritize cybersecurity awareness and training programs for our employees. These initiatives aim to educate our workforce about potential threats, best practices for data protection, and the importance of maintaining security measures. We train our employees through annual security training, phishing simulations, and regular communications about cybersecurity topics and threats.
Detection
Our cybersecurity program includes tools and processes designed to detect unusual network activity, anomalous cybersecurity events, and breaches. We utilize a variety of preventative measures and detective tools.
Response
We have developed an incident response plan to ensure a swift and effective response in the event of a cybersecurity incident. This plan includes predefined roles and responsibilities, communication protocols, and steps to contain and remediate any vulnerabilities that may lead to a breach.
Governance
Our Chief Information Security Officer ("CISO") oversees the Company's cybersecurity program. Our CISO, who reports to our Chief Technology Officer ("CTO"), has over 20 years of experience in information technology, risk, and cybersecurity leadership, and has previously held both CISO and CTO roles.
The Audit Committee of our Board of Directors provides oversight for our cybersecurity program and our enterprise risk management process, which evaluates enterprise level risks and strategies, including our cybersecurity risk. The Audit Committee receives updates from management on the effectiveness of our cybersecurity program. The Audit Committee also reviews plans on how management will enhance the program, receives updates on special topics that help the Committee provide effective oversight of the program, and is notified in the event of certain cybersecurity incidents.
Although we have not experienced a material cybersecurity breach, we cannot guarantee that we will not experience a cyber threat or incident in the future. For more information regarding the cybersecurity risks we face, see Item 1A. Risk Factors in this Annual Report.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.