Which board committee oversees the CISO?

May 12, 2026 · DEF 14A

NVIDIA Corporation: the Audit Committee (AC)

“The AC reviews the adequacy and effectiveness of the Company's information security policies, practices, and internal controls. The AC receives regular updates on information security from management, including the Chief Security Officer and security team, while the Board receives annual reports on these matters.”

April 29, 2026 · DEF 14A

MetLife, Inc.: the Audit Committee

“MetLife's Chief Information Security Officer (CISO) manages the program, collaborating with the lines of business and corporate functions. The CISO and the Head of GTO present updates to the Audit Committee quarterly and, as necessary, to the full Board.”

April 23, 2026 · DEF 14A

Walmart Inc.: the Audit Committee

“Walmart's Chief Information Security Officer periodically meets in private session with the Audit Committee. The Audit Committee receives periodic updates from senior management, including the Chief Information Security Officer, the Chief Technology Officer, and other members of senior management, as applicable, regarding these risks and other matters as deemed appropriate.”

April 21, 2026 · DEF 14A

UnitedHealth Group Incorporated: the Audit and Finance Committee

“In addition to oversight provided by the Audit and Finance Committee, management addresses the Company's security team's work through its Enterprise Security Council, co-chaired by the Company's Chief Security Officer and Chief Digital & Technology Officer and including the Chief Compliance Officer, the Chief Legal Officer, the Chief Audit Executive, the Chief Privacy Officer and senior business executives.”

April 20, 2026 · DEF 14A

General Motors Company: the Risk and Cybersecurity Committee

“The Company's cybersecurity organization is led by the Company's Chief Information Security Officer ("CISO"), who is responsible for assessing and managing material risks from cybersecurity threats and regularly reports to the Risk and Cybersecurity Committee on these matters.”

April 7, 2026 · DEF 14A

Home Depot, Inc.: the Audit Committee

“Since the beginning of Fiscal 2025, the Board and/or the Audit Committee has also received reports on privacy, data protection and/or cybersecurity matters from senior Information Technology leaders, including our Chief Information Officer, Chief Information Security Officer, Chief Privacy Officer, and the Chair of our DSPG Committee (discussed below).”

March 20, 2026 · DEF 14A

Goldman Sachs Group, Inc.: the Technology Risk Subcommittee (TRiS)

“Oversight of these critical matters is a regular focus of our Board and its Committees and is a key focus of our Technology Risk Subcommittee (known as TRiS). This includes oversight of management's processes, monitoring and controls related to cyber and information security-related risks, such as regular presentations on our approach to cybersecurity threats and cyber and information security risk management from our Chief Information Security Officer (CISO).”

March 18, 2026 · DEF 14A

Wells Fargo & Company: the Risk Committee

“The Risk Committee has primary oversight responsibility for information security risk and approves the Company's information security program, which includes information protection and cyber resiliency. The Risk Committee receives regular reports from the Company's Head of Technology and the Company's Chief Information Security Officer on information security risk and significant information security developments, including incidents involving third parties.”

March 11, 2026 · DEF 14A

Johnson & Johnson: the Regulatory Compliance & Sustainability Committee

“The Regulatory Compliance & Sustainability Committee of the Board is primarily responsible for oversight of risk from cybersecurity threats and oversees compliance with applicable laws, regulations and Company policies. Our information security and risk management (ISRM) organization, led by our Chief Information Security Officer, is responsible for our information security program...”

March 11, 2026 · DEF 14A

PNC Financial Services Group, Inc.: the Technology Committee

“The Chief Information Security Officer presents quarterly to the Technology Committee on such topics as threat intelligence and assessment reports, incident and event reporting from other institutions, governance and regulatory exam status and the status of other key program deliverables, among other content.”

December 8, 2025 · DEF 14A

Visa Inc.: the Audit and Risk Committee

“Visa's Board exercises oversight and control of Visa's overall enterprise risk management framework and delegates oversight and control of Visa's cybersecurity program to the Audit and Risk Committee, which is responsible for reviewing management's risk-based processes in place designed to assess, identify, and manage cybersecurity risks to which Visa is exposed. Our Chief Information Security Officer provides an update on Visa's cybersecurity program to the Audit and Risk Committee twice per year and to the full Board annually.”