Disclosure · Form 10-K · fiscal 2026
Barnes & Noble Education, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2026
Filed July 9, 2026· period ended May 2, 2026· BNED· CIK 1634117· Updated · filing on sec.gov ↗
Barnes & Noble Education, Inc.'s Form 10-K for fiscal 2026, filed July 9, 2026, names the Chief Information Security Officer as its top security role, reporting to the Chief Information Officer, with oversight by the Audit Committee.
What Barnes & Noble Education's Item 1C says
Barnes & Noble Education's Form 10-K for fiscal 2026 places oversight of cybersecurity processes with the Board of Directors, Audit Committee and Legal team. The filing says the Chief Information Security Officer leads cybersecurity and reports directly to the Chief Information Officer.
Board and management oversight
Senior management gives quarterly updates to the Audit Committee and periodic briefings to the Board of Directors.
Who leads security
The CISO has over three decades of Information Technology experience, and the last two decades have focused on IT security. Previously, the CISO was the Director of IT Security and Infrastructure at The Children's Place Inc.
How the company manages cyber risk
The company's Cyber Security Team detects, mitigates and remediates cybersecurity threats. The company responds to incidents under documented incident response plans, engaging functional areas, internal escalations and stakeholders according to the nature and severity of the incident. Industry standards such as the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity inform the company's program. The company's Enterprise Risk Management program recognizes the ongoing nature of cybersecurity risks.
Third parties and incidents
Third-party auditors assess whether specific components of the technology environment align with industry standards such as the Payment Card Industry Data Security Standards. External experts conduct maturity assessments of the cybersecurity program. The filing says past incidents have been addressed without material impact on operations or financial standing.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed July 9, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Information Security Officer
Reports to
Chief Information Officer
“Reporting directly to our Chief Information Officer, our Chief Information Security Officer ("CISO") leads the charge, ensuring that our cybersecurity posture remains robust and adaptive.”
Board oversight
Audit Committee
“Through quarterly updates to the Audit Committee and periodic briefings to the Board of Directors , senior management keeps governance structures informed and aligned with our evolving cybersecurity landscape.”
How often the board or committee hears about it
Quarterly
“Through quarterly updates to the Audit Committee and periodic briefings to the Board of Directors , senior management keeps governance structures informed and aligned with our evolving cybersecurity landscape.”
CISO or other person named
not identified
Frameworks and standards named
NIST Cybersecurity Framework, PCI DSS
Where the filing names them
- NIST Cybersecurity Framework: “introduced new information security and computer risk management programs based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework across numerous platforms for multiple retail chains.”
- PCI DSS: “Rigorous assessments by third-party auditors validate the alignment of specific components of our technology environment with industry standards such as the Payment Card Industry Data Security Standards, ensuring robust compliance and resilience.”
Outside assessors, consultants or testers
Described
“Regular maturity assessments, conducted by external experts, ensure that our cybersecurity program remains at the forefront of industry best practices, tailored to our unique operational landscape.”
Experience of the security leadership, as stated
Stated
“With over a decade of dedicated service to BNED, our current CISO brings a wealth of experience and expertise to the organization, including over three decades of Information Technology ("IT") experience.”
Material incident
The filing states none
“While past incidents have been swiftly addressed without material impact on our operations or financial standing, we remain vigilant.”
The section
587 words, Form 10-K filed July 9, 2026 for the period ended May 2, 2026
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Barnes & Noble Education, Inc. standard industrial classification 5940, Retail-miscellaneous shopping goods stores (SEC SIC list). One other filer in our library has the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Trade & Services).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Sportsman'S Warehouse Holdings, Inc.FY 2026, filed March 31, 2026 | VP of Information Technology | not identified | audit committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| VIP Play, Inc.FY 2026, filed September 29, 2026 | Chief Technology Officer | not identified | full board |
| GenFlat Holdings, Inc.FY 2026, filed September 25, 2026 | Chief Executive Officer and Chief Financial Officer | not identified | full board |
| Stitch Fix, Inc.FY 2026, filed September 24, 2026 | Chief Information Security Officer | Chief Product and Technology Officer | Audit Committee |
| CreditRiskMonitor Com IncFY 2025, filed August 19, 2026 | Chief Technology Officer | not identified | Audit Committee |
| H&R BlockFY 2026, filed August 14, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Caro Holdings Inc.FY 2026, filed July 15, 2026 | not identified | not identified | not identified |
| Addentax Group Corp.FY 2026, filed June 29, 2026 | Chief Financial Officer | not identified | audit committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Barnes & Noble Education, Inc.'s Form 10-K as filed with the SEC on July 9, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. CYBERSECURITY
Cybersecurity Risk Management and Strategic Approach
The company's information security program is meticulously crafted, integrating administrative, technical, and physical safeguards. Embracing a risk-based approach, we proactively mitigate cybersecurity risks to ensure the confidentiality, integrity, and availability of our information systems and data assets. This comprehensive framework extends to overseeing service-provider relationships, aligning with the specific risks associated with each engagement.
Deploying a multi-tiered defense strategy, we fortify our defenses with layers of controls designed to identify, protect against, detect, respond to, and recover from cybersecurity incidents. Central to this effort is our Cyber Security Team, entrusted with the critical task of swiftly detecting, mitigating, and remediating cybersecurity threats. Guided by our documented incident response plans, we orchestrate a swift and decisive response, engaging functional areas, internal escalations, and stakeholders as dictated by the nature and severity of the incident.
Key to our cybersecurity resilience, we strategically leverage third-party expertise and tools to augment our defenses, ensuring a proactive stance against evolving threats. Rigorous assessments by third-party auditors validate the alignment of specific components of our technology environment with industry standards such as the Payment Card Industry Data Security Standards, ensuring robust compliance and resilience.
Industry standards such as the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity inform our program and are the basis of our compliance commitment. Regular maturity assessments, conducted by external experts, ensure that our cybersecurity program remains at the forefront of industry best practices, tailored to our unique operational landscape.
Although cybersecurity threats are an inherent part of the digital landscape, we stand resilient. While past incidents have been swiftly addressed without material impact on our operations or financial standing, we remain vigilant. Our Enterprise Risk Management program recognizes the ongoing nature of cybersecurity risks and our commitment to mitigating potential impacts on our operations, business strategy, and financial health.
Cybersecurity Governance
Our Board of Directors, Audit Committee and Legal team oversee the cybersecurity processes of identifying and mitigating cybersecurity risks. Reporting directly to our Chief Information Officer, our Chief Information Security Officer ("CISO") leads the charge, ensuring that our cybersecurity posture remains robust and adaptive. Through quarterly updates to the Audit Committee and periodic briefings to the Board of Directors , senior management keeps governance structures informed and aligned with our evolving cybersecurity landscape.
With over a decade of dedicated service to BNED, our current CISO brings a wealth of experience and expertise to the organization, including over three decades of Information Technology ("IT") experience. The last two decades have focused on IT security and innovative ways to manage and lead a security team. Previously, the CISO was the Director of IT Security and Infrastructure at The Children's Place Inc. The CISO is experienced in deploying a Zero Trust framework, Identity and Access Management programs, Email and Web Gateways, managing IT compliance for SOX, PCI, and ADA, and has developed and
Index to Form 10-K Index to FS
introduced new information security and computer risk management programs based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework across numerous platforms for multiple retail chains.
Supported by a dynamic leadership team comprised of seasoned professionals, our cybersecurity initiatives are not just policies; they are a testament to our commitment to securing customer information and upholding our privacy promises. Embedded in our Code of Conduct & Ethics and reinforced through our security awareness training program, cybersecurity awareness is not just a task; it is a shared responsibility, woven into the fabric of our corporate culture.
Earlier filings on record
Fiscal 2025 Form 10-K, filed December 23, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
Chief Information Officer
“Reporting directly to our Chief Information Officer, our Chief Information Security Officer ("CISO") leads the charge, ensuring that our cybersecurity posture remains robust and adaptive.”
Board oversight
Audit Committee
“Through quarterly updates to the Audit Committee and periodic briefings to the Board of Directors , senior management keeps governance structures informed and aligned with our evolving cybersecurity landscape.”
Person named in the filing
not identified
Experience, as stated
Stated
“With over a decade of dedicated service to BNED, our current CISO brings a wealth of experience and expertise to the organization, including over three decades of Information Technology ("IT") experience.”
Material incident
The filing states none
“While past incidents have been swiftly addressed without material impact on our operations or financial standing, we remain vigilant.”
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
Item 1C. CYBERSECURITY
Cybersecurity Risk Management and Strategic Approach
The company's information security program is meticulously crafted, integrating administrative, technical, and physical safeguards. Embracing a risk-based approach, we proactively mitigate cybersecurity risks to ensure the confidentiality, integrity, and availability of our information systems and data assets. This comprehensive framework extends to overseeing service-provider relationships, aligning with the specific risks associated with each engagement.
Deploying a multi-tiered defense strategy, we fortify our defenses with layers of controls designed to identify, protect against, detect, respond to, and recover from cybersecurity incidents. Central to this effort is our Cyber Security Team, entrusted with the critical task of swiftly detecting, mitigating, and remediating cybersecurity threats. Guided by our documented incident response plans, we orchestrate a swift and decisive response, engaging functional areas, internal escalations, and stakeholders as dictated by the nature and severity of the incident.
Key to our cybersecurity resilience, we strategically leverage third-party expertise and tools to augment our defenses, ensuring a proactive stance against evolving threats. Rigorous assessments by third-party auditors validate the alignment of specific components of our technology environment with industry standards such as the Payment Card Industry Data Security Standards, ensuring robust compliance and resilience.
Industry standards such as the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity inform our program and are the basis of our compliance commitment. Regular maturity assessments, conducted by external experts, ensure that our cybersecurity program remains at the forefront of industry best practices, tailored to our unique operational landscape.
Although cybersecurity threats are an inherent part of the digital landscape, we stand resilient. While past incidents have been swiftly addressed without material impact on our operations or financial standing, we remain vigilant. Our Enterprise Risk Management program recognizes the ongoing nature of cybersecurity risks and our commitment to mitigating potential impacts on our operations, business strategy, and financial health.
Cybersecurity Governance
Our Board of Directors, Audit Committee and Legal team oversee the cybersecurity processes of identifying and mitigating cybersecurity risks. Reporting directly to our Chief Information Officer, our Chief Information Security Officer ("CISO") leads the charge, ensuring that our cybersecurity posture remains robust and adaptive. Through quarterly updates to the Audit Committee and periodic briefings to the Board of Directors , senior management keeps governance structures informed and aligned with our evolving cybersecurity landscape.
With over a decade of dedicated service to BNED, our current CISO brings a wealth of experience and expertise to the organization, including over three decades of Information Technology ("IT") experience. The last two decades have focused on IT security and innovative ways to manage and lead a security team. Previously, the CISO was the Director of IT Security and Infrastructure at The Children's Place Inc. The CISO is experienced in deploying a Zero Trust framework, Identity and Access Management programs, Email and Web Gateways, managing IT compliance for SOX, PCI, and ADA, and has developed and introduced new information security and computer risk management programs based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework across numerous platforms for multiple retail chains.
Index to Form 10-K Index to FS
Supported by a dynamic leadership team comprised of seasoned professionals, our cybersecurity initiatives are not just policies; they are a testament to our commitment to securing customer information and upholding our privacy promises. Embedded in our Code of Conduct & Ethics and reinforced through our security awareness training program, cybersecurity awareness is not just a task; it is a shared responsibility, woven into the fabric of our corporate culture.
Fiscal 2024 Form 10-K, filed July 1, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
Chief Information Officer
“Reporting directly to our Chief Information Officer, our Chief Information Security Officer ("CISO") leads the charge, ensuring that our cybersecurity posture remains robust and adaptive.”
Board oversight
Audit Committee
“Through quarterly updates to the Audit Committee and periodic briefings to the Board of Directors, senior management keeps governance structures informed and aligned with our evolving cybersecurity landscape.”
Person named in the filing
not identified
Experience, as stated
Stated
“With over a decade of dedicated service to BNED, our current CISO brings a wealth of experience and expertise to the organization, including over three decades of Information Technology ("IT") experience.”
Material incident
The filing states none
“While past incidents have been swiftly addressed without material impact on our operations or financial standing, we remain vigilant.”
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
Item 1C. CYBERSECURITY
Cybersecurity Risk Management and Strategic Approach
The company's information security program is meticulously crafted, integrating administrative, technical, and physical safeguards. Embracing a risk-based approach, we proactively mitigate cybersecurity risks to ensure the confidentiality, integrity, and availability of our information systems and data assets. This comprehensive framework extends to overseeing service-provider relationships, aligning with the specific risks associated with each engagement.
Deploying a multi-tiered defense strategy, we fortify our defenses with layers of controls designed to identify, protect against, detect, respond to, and recover from cybersecurity incidents. Central to this effort is our Cyber Security Team, entrusted with the critical task of swiftly detecting, mitigating, and remediating cybersecurity threats. Guided by our documented incident response plans, we orchestrate a swift and decisive response, engaging functional areas, internal escalations, and stakeholders as dictated by the nature and severity of the incident.
Index to Form 10-K Index to FS
Key to our cybersecurity resilience, we strategically leverage third-party expertise and tools to augment our defenses, ensuring a proactive stance against evolving threats. Rigorous assessments by third-party auditors validate the alignment of specific components of our technology environment with industry standards such as the Payment Card Industry Data Security Standards, ensuring robust compliance and resilience.
Industry standards such as the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity inform our program and are the basis our compliance commitment. Regular maturity assessments, conducted by external experts, ensure that our cybersecurity program remains at the forefront of industry best practices, tailored to our unique operational landscape.
Although cybersecurity threats are an inherent part of the digital landscape, we stand resilient. While past incidents have been swiftly addressed without material impact on our operations or financial standing, we remain vigilant. Our Enterprise Risk Management program recognizes the ongoing nature of cybersecurity risks and our commitment to mitigating potential impacts on our operations, business strategy, and financial health.
Cybersecurity Governance
Our Board of Directors, Audit Committee and Legal team oversee the cybersecurity processes of identifying and mitigating cybersecurity risks. Reporting directly to our Chief Information Officer, our Chief Information Security Officer ("CISO") leads the charge, ensuring that our cybersecurity posture remains robust and adaptive. Through quarterly updates to the Audit Committee and periodic briefings to the Board of Directors, senior management keeps governance structures informed and aligned with our evolving cybersecurity landscape.
With over a decade of dedicated service to BNED, our current CISO brings a wealth of experience and expertise to the organization, including over three decades of Information Technology ("IT") experience. The last two decades have focused on IT security and innovative ways to manage and lead a security team. Previously, the CISO was the Director of IT Security and Infrastructure at The Children's Place Inc. The CISO is experienced in deploying a Zero Trust framework, Identity and Access Management programs, Email and Web Gateways, managing IT compliance for SOX, PCI, and ADA and has developed and introduced new information security and computer risk management programs based on National Institute of Standards and Technology (NIST) Cybersecurity Framework across numerous platforms for multiple retail chains.
Supported by a dynamic leadership team comprised of seasoned professionals, our cybersecurity initiatives are not just policies; they're a testament to our commitment to securing customer information and upholding our privacy promises. Embedded in our Code of Conduct & Ethics and reinforced through our security awareness training program, cybersecurity awareness is not just a task; it's a shared responsibility, woven into the fabric of our corporate culture.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.