Urban Outfitters: the CISO reports to the Audit Committee

Urban Outfitters, Inc. names a Chief Information Security Officer and states a reporting line for that role in the Item 1C Cybersecurity disclosure of its Form 10-K for the fiscal year ended January 31, 2026, filed April 1, 2026. The filing describes a Data Privacy & Security working group made up of the Chief Information Security Officer, the Global Data Privacy Officer, the Chief Administrative Officer and the General Counsel, which reports to the Audit Committee at least annually.

The CISO's own line is stated separately: the filing says the company's Chief Information Security Officer provides quarterly updates to management and reports to the Audit Committee at least annually regarding the company's data security environment.

This record states the reporting line exactly as the filing describes it. It carries no view on whether this structure is effective or typical; see the network's reporting-line record for how other companies describe theirs.