XML 44 R23.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Feb. 01, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We have a cybersecurity program that is intended to assess, identify, and manage material risks from cybersecurity threats to our business. Our program includes policies and procedures for detection, assessment, response, mitigation, remediation, and reporting of cybersecurity incidents and threats. Overall, our cybersecurity program is a strategic component of our company-wide risk management framework and activities.

Our cybersecurity program is led by our Information Technology (IT) team. The IT team is principally responsible for developing, managing, and implementing our cybersecurity risk assessment processes, maintaining and implementing our incident response plans, selecting and implementing security controls, providing cybersecurity training, performing ongoing threat analysis, and responding to cybersecurity threats and incidents. The cybersecurity program also draws upon a combination of industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework, that are designed to help companies measure their security posture, reduce cybersecurity risks, and provide guidance for implementing effective security controls.

Our risk management approach and processes for cybersecurity extend to assessing and managing risks from cybersecurity threats associated with our use of third-party service providers, by employing vetting processes, including the conducting of security assessments and monitoring activities, to verify that third-party service providers adhere to our policies and contractual requirements.
In addition, we engage and work with a range of third-party advisors, including cybersecurity consultants, legal counsel, and auditors, to help us assess, test, and otherwise assist in the development and review of our cybersecurity processes. These relationships enable us to benefit from specialized knowledge and insights to help inform our cybersecurity strategies.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Overall, our cybersecurity program is a strategic component of our company-wide risk management framework and activities.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Our Board of Directors exercises general oversight of our risk management activities, including our cybersecurity program. With respect to risks related to cybersecurity, our Board of Directors has delegated the primary oversight responsibility to the Audit Committee. The Audit Committee, along with management, reports to the full Board of Directors on these matters throughout the year.

The Audit Committee receives quarterly cybersecurity reports and engages directly with our management team, including our Chief Information Officer (CIO) and Chief Information Security Officer (CISO), on cybersecurity risk management and related risk topics, including incident response and recovery protocols, associate trainings and awareness, recent Company and industry developments, and our related compliance programs and practices. Our cybersecurity program and practices are also evaluated through various internal and third-party audits and assessments, with the results reported to the Audit Committee.
Our CIO and CISO are principally responsible for assessing and managing our material risks from cybersecurity threats. They lead efforts to prevent, identify, detect, mitigate, and remediate material cybersecurity risks and incidents through various means, including by receiving alerts and reports produced by security tools deployed in our IT systems. Together, our CIO and CISO have decades of experience in cybersecurity and in retail, including leadership experience in cybersecurity risk management, incident response and recovery, compliance, governance, IT systems and technology, and overall cyber defense methodologies.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee receives quarterly cybersecurity reports and engages directly with our management team, including our Chief Information Officer (CIO) and Chief Information Security Officer (CISO), on cybersecurity risk management and related risk topics, including incident response and recovery protocols, associate trainings and awareness, recent Company and industry developments, and our related compliance programs and practices. Our cybersecurity program and practices are also evaluated through various internal and third-party audits and assessments, with the results reported to the Audit Committee.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee, along with management, reports to the full Board of Directors on these matters throughout the year.The Audit Committee receives quarterly cybersecurity reports and engages directly with our management team, including our Chief Information Officer (CIO) and Chief Information Security Officer (CISO), on cybersecurity risk management and related risk topics, including incident response and recovery protocols, associate trainings and awareness, recent Company and industry developments, and our related compliance programs and practices. Our cybersecurity program and practices are also evaluated through various internal and third-party audits and assessments, with the results reported to the Audit Committee.
Cybersecurity Risk Role of Management [Text Block] Our cybersecurity program is led by our Information Technology (IT) team. The IT team is principally responsible for developing, managing, and implementing our cybersecurity risk assessment processes, maintaining and implementing our incident response plans, selecting and implementing security controls, providing cybersecurity training, performing ongoing threat analysis, and responding to cybersecurity threats and incidents. The cybersecurity program also draws upon a combination of industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework, that are designed to help companies measure their security posture, reduce cybersecurity risks, and provide guidance for implementing effective security controls.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our CIO and CISO are principally responsible for assessing and managing our material risks from cybersecurity threats. They lead efforts to prevent, identify, detect, mitigate, and remediate material cybersecurity risks and incidents through various means, including by receiving alerts and reports produced by security tools deployed in our IT systems.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Together, our CIO and CISO have decades of experience in cybersecurity and in retail, including leadership experience in cybersecurity risk management, incident response and recovery, compliance, governance, IT systems and technology, and overall cyber defense methodologies.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Audit Committee, along with management, reports to the full Board of Directors on these matters throughout the year.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true