Kids Foot Locker — Kids Foot Locker offers the largesta large selection of premium brand-name athletic footwear, apparel, and accessories for children. Kids Foot Locker enables youth of all ages to participate in sneaker culture and helps their parents shop in a curated environment with only the best assortment in stores and online. We drive a sense of community in local markets through our “House of Play” community store concept, which connects with kids, parents, and caregivers through the power of play, offering experiences and products that celebrate the wonder and fun of childhood. Of our 422390 North America stores, 373375 are located in the United States, and Puerto Rico, 31and 15 in Europe, 16Canada. There are an additional 13 stores in Canada, 1 in Australia, and 1 in New Zealand.Europe. These stores have an average of 1,7002,000 selling square feet.

Lady Foot Locker — Lady Foot Locker is a U.S. retailer of athletic footwear, apparel, and accessories dedicated to sneaker-obsessed young women. Our stores provide premium sneakers and apparel, carefully selected to reflect the latest styles. Lady Foot Locker operates 35 stores that are located in the United States and Puerto Rico. These stores have an average of 1,500 selling square feet.

Champs Sports — Champs Sports is one of the largesta primarily mall-based specialty athletic footwear and apparel retailersretailer in North America. With a focusAmerica focused on serving the active athlete segment that is highly connected to sport and inspired by what is worn in the game and on the lifestyle expression of sport, Champs Sports’ product categories include athletic footwear and apparel, and sport-lifestyle inspired accessories. This assortment allowsfield. Champs Sports to offeris our lead banner for apparel, driving more head-to-toe offerings for the best head-to-toe fashion stories representing the most powerful athletic brands,consumer shopping for their performance and sports teams, and athletes in North America.style. Of our 539404 stores, 506375 are located in the United States, Puerto Rico, and the U.S. Virgin Islands and 3329 in Canada. The Champs Sports stores have an average of 3,6003,800 selling square feet.

FootactionWSS — Footaction Acquired in 2021, WSS is an athletic-inspired retailer focused on the large and rapidly growing Hispanic consumer demographic, operating a North American athletic footwearfleet of 141 off-mall stores in key markets across California, Texas, Arizona, Florida, and apparel retailer that offers the freshest, best edited selection of athletic lifestyle brands and looks. This banner is uniquely positioned at the intersection of sport and style,Nevada. WSS’s community-driven business benefits from deep relationships with a focus on authentic, premium product. Of our 240 stores, 235 are located in the United States and Puerto Rico and 5 are in Canada. The Footactioncustomers. WSS stores have an average of 3,20010,300 selling square feet.

Runners Pointatmos — We closed our Runners Point banner during 2020.

Sidestep — Sidestep Acquired in 2021, atmos is a predominantly athletic fashion footwear banner. Our 76digitally-led, culturally-connected global brand featuring premium sneakers and apparel, an exclusive in-house label, collaborative relationships with leading vendors in the sneaker ecosystem, experiential stores, are locatedand a robust omni-channel platform. atmos operates 31 stores in Germany, Netherlands, and Switzerland. Sidestep caters to a more discerning, fashion forward consumer. Sidestep stores haveJapan, with an average of 1,200900 selling square feet. The brand is also licensed to various entities in Asia.

Eastbay

Our People Strategy includes actions around “Uniting our Communities of Talent” around the world to achieve focus and drive results as a more agile and dynamic organization.By creating a Diversity, Inclusion, and Belonging Strategy (DIBs)DIBs strategy as part of our people processes, we are able to attract, select, hire, grow, develop, promote, and retain valued team members with diverse backgrounds, perspectives, and experiences. We are relentless in creating a work environment that celebrates the differences that make us even stronger. In addition, our "Live Well. Work Well." framework enables us to provide support and resources for a variety of needs to help our team members reach their full potential. We provide career growth and professional development through formal learning and on-the-job experiences to advance our team members capability,members’ capabilities, confidence, and contribution.contributions.

We offer competitive compensation (including salary, incentive bonus, and equity) and benefits packages in each of our locations around the globe.

Our compensation program is designed to attract, retain, and reward talented individuals who possess the skills necessary to lead and support our business objectives, ensure the achievement ofachieve our strategic goals, and create long-term value for our shareholders. ToWe offer competitive compensation (including salary, incentive bonus, and equity) and benefits packages to eligible team members in each of our locations around the globe. Our compensation and benefits programs are designed to support the financial, mental, and physical well-being of our team members and their families. We believe in paying team members equitably, regardless of gender, race, or ethnicity, and we provide competitive compensation and benefits, including:

​

Through our listening session communication strategy,regularly review pay data to confirm we are committed to listening to and learning from our team members. For many years, we have tracked engagement and leadership effectiveness through our engagement surveys. We have improved our overall engagement, with 80 percent overall favorable rating and 85 percent response rate in 2020. We use insights from these surveys to assess our culture, evaluate our leaders, adjust our plans, and evolve our culture.doing so.

We had 15,791 full-time and 35,461 part-time employees as of January 30, 2021 and we consider employee relations to be satisfactory.

We are committed to engaging in corporate social responsibility and sustainability initiatives that support our communities and help us develop trusted relationships with our stakeholders. Our Corporate Social Responsibility disclosure is available to investors on the investor relations tab of our corporate website under the heading “Responsibility.”

Available Information

We maintain a corporate website at www.footlocker-inc.comwww.footlocker.com/corp. Our filings with the U.S. Securities and Exchange Commission (the “SEC”"SEC"), including our annual report on Form 10-K, quarterly reports on Form 10-Q, current reports on Form 8-K, and all amendments to those reports are available free of charge through this website as soon as reasonably practicable after they are filed with or furnished to the SEC. The Corporate Governance section of our corporate website contains our Corporate Governance Guidelines, Committee Charters, and the Code of Business Conduct for directors, officers, and employees, including the Chief Executive Officer, Chief Financial Officer, and Chief Accounting Officer. Copies of these documents may also be obtained free of charge upon written request to our Corporate Secretary at 330 West 34^th34th Street, New York, N.Y.NY 10001.

Item1A. Risk Factors

Risks Related to Our Business and Industry

Our inability to implement our long-range strategic plan may adversely affect our future results.

Our ability to successfully implement and execute our long-range strategic plan is dependent on many factors. Our strategies may require significant capital investment and management attention. Additionally, any new initiative is subject to certain risks, including customer acceptance of our products and renovated store designs or locations, our loyalty program, our digital e-commerce, competition, product differentiation, the ability to attract and retain qualified personnel, and our ability to successfully integrate our acquisitions and implement technological initiatives. If we cannot successfully execute our strategic growth initiatives or if the long-range plan does not adequately address the challenges or opportunities we face, our financial condition and results of operations may be adversely affected. Additionally, failure to meet shareholder expectations, particularly with respect to sales, supplier diversification, cost-cutting programs, operating margins, and earnings per share, would likely result in volatility in the market value of our stock.

We may experience operational problems with our information systems as a result of system failures, system implementation issues, viruses, malicious hackers, sabotage, or other causes. We invest in security technology to protect the data stored by us, including our data and business processes, against the risk of data security breaches and cyber-attacks. Our data security management program includes enforcement of standard data protection policies such as Payment Card Industry compliance.compliance and other regulatory requirements. Additionally, we evaluate our major technology suppliers and any outsourced services through accepted security assessment measures. We maintain and routinely test backup systems and disaster recovery, along with external network security penetration testing by an independent third party as part of our business continuity preparedness.

While we believe that our security technology and processes follow appropriate practices in the prevention of security breaches and the mitigation of cybersecurity risks, given the ever-increasing abilities of those intent on breaching cybersecurity measures and given the necessity of our reliance on the security procedures of third-party vendors, the total security effort at any point in time may not be completely effective.

Any security breaches and cyber incidents could adversely affect our business.

Failure of our systems, either internally or at our third-party providers, including failures due to cyber-attacks that would prevent the ability of systems to function as intended, could cause transaction errors, loss of customers and sales, and negative consequences to us, our employees, and those with whom we do business. A cyberattack on a communications network or power grid could cause operational disruption resulting in loss of revenues. Any security breach involving the misappropriation, loss, or other unauthorized disclosure of confidential information by us could also severely damage our reputation, expose us to the risks of litigation and liability, increase operating costs associated with remediation, and harm our business. While we carry insurance that would mitigate the losses in connection with security breaches and cyber incidents, insurance may be insufficient to compensate us fully for potentially significant losses.

On July 26, 2023, the SEC adopted a final rule on cybersecurity risk management, strategy, governance, and incident disclosure (the "SEC Cyber Rule"). The SEC Cyber Rule requires public companies to make current disclosures about material cybersecurity incidents, as well as annual disclosures of material information about their cybersecurity risk management, strategy, and governance. The SEC Cyber Rule became effective on September 5, 2023. New data security laws add additional complexity, requirements, restrictions and potential legal risk, and compliance programs may require additional investment in resources, and could affect strategies and availability of previously useful data.

Risks associated with digital operations.

Our digital operations are subject to numerous risks, including risks related to the failure of the computer systems that operate our websites, mobile sites, and apps and their related support systems, computer viruses, cybersecurity risks, telecommunications or power failures, denial of service attacks, bot attacks, and similar disruptions. Also, to sustain, keep current, or grow our digital commerce business we will need to make additional investments. Risks related to digital commerce include those associated with credit card fraud, the need to keep pace with rapid technological change, governmental regulation, and legal uncertainties with respect to internet regulatory compliance. If any of these risks materialize, it could have a material adverse effect on our business.

Privacy

Our inability to successfully manage the implementation of a new Enterprise Resource Planning ("ERP") system may adversely affect our business and data security concernsresults of operations or the effectiveness of our internal controls over financial reporting.

We are currently in the preliminary states of implementing a new ERP system, as part of a plan to integrate and regulationupgrade our systems and processes. This initiative includes a fully-integrated global accounting, operations, and finance enterprise resource planning system. It will also include warehouse management, order management, as well as various interfaces between these systems, and supporting back-office systems. Additional implementation activities are expected to continue in phases over the next few years. ERP implementations are complex, labor intensive, and time-consuming projects, which also involve substantial expenditures on system software and implementation activities. The ERP system is critical to our ability to provide important information to our management, obtain, and deliver products, provide services and customer support, accurately maintain books and records, provide accurate, timely and reliable reports on our financial and operating results, and otherwise operate our business. ERP implementations also require transformation of business and financial processes in order to reap the benefits of the ERP system. Any such implementation involves risks inherent in the conversion to a new computer system, including loss of information and potential disruption to our normal operations. The implementation and maintenance of the new ERP system has required, and will continue to require, the investment of significant financial and human resources, the re-engineering of processes of our business, and the attention of many employees who would otherwise be focused on other aspects of our business. Our results of operations could be adversely affected if we experience time delays or cost overruns during the ERP implementation process, or if we are unable to reap the benefits we expect from the ERP system. Any material deficiencies in the design and implementation of the new ERP system could also result in additionalpotentially materially higher costs and liabilities.

The protectioncould adversely affect our ability to operate our business and otherwise negatively affect our financial reporting and the effectiveness of customer, employee, and Company data is critical. The regulatory environment surrounding information security and privacy is demanding, with the frequent impositionour internal control over financial reporting. Any of new and changing requirements. In addition, customers appear increasingly to have a high expectation that we will adequately protect their personal information. Any actual or perceived misappropriation or breach involving this data could attract negative media attention, cause harm to our reputation or result in liability (including but not limited to fines, penalties or lawsuits), any of whichthese consequences could have a material adverse effect on our business, operational results of operations and financial position, and cash flows.condition.

The European Union (“E.U.”) adopted a comprehensive General Data Privacy Regulation (the “GDPR”), which requires companies to satisfy new requirements regarding the handling of personal and sensitive data, including its use, protection, and the ability of persons whose data is stored to correct or delete data about themselves. Failure to comply with GDPR requirements could result in penalties of up to 4 percent of worldwide revenue. In addition, the State of California adopted the California Consumer Protection Act of 2018 ("CCPA"). The CCPA requires companies that process information on California residents to make new disclosures to consumers about their data collection, use and sharing practices, allows consumers to opt out of certain data sharing with third parties, and provides a new cause of action for data breaches. It remains unclear how the CCPA will be interpreted and the extent of its effect on our business. Some observers have noted that the CCPA could mark the beginning of a trend toward more stringent privacy legislation in the United States, which could increase our potential liability and adversely affect our business.

GDPR, CCPA and other similar laws and regulations, as well as any associated inquiries or investigations or any other government actions, may be costly to comply with, result in negative publicity, increase our operating costs, require significant management time and attention, and subject us to remedies that may harm our business, including fines or demands or orders that we modify or cease existing business practices. The laws and regulations relating to privacy and data security are evolving, can be subject to significant change and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions.

TheThe technology enablement of omni-channel initiatives in our business is complex.

We continue to invest in initiatives designed to deliver a high-quality, coordinated shopping experience online, in stores, and on mobile devices, which requires substantial investment in technology, information systems, and employee training, as well as significant management time and resources. Our omni-channel retailing efforts include the integration and implementation of new technology, including technology and software associated with our ERP implementation, and processes to be able to fulfill orders from any point within our system of stores and distribution centers, which is extremely complex and may not meet customer expectations for timely and accurate deliveries. These efforts involve substantial risk, including risk of implementation delays, cost overruns, technology interruptions, supply and distribution delays, and other issues that can affect the successful implementation and operation of our omni-channel initiatives. If our omni-channel initiatives are not successful we may not be able to provide a relevant shopping experience, or we domay not realize the return on our omni-channel investments that we anticipate, our financial performance and future growth could be materially adversely affected.

Privacy and data security concerns and regulation could result in additional costs and liabilities.

The protection of customer, employee, and Company data is critical. The regulatory environment surrounding privacy is demanding, with the frequent imposition of new and changing requirements. In addition, customers have a high expectation that we will adequately protect their personal information. Any actual or perceived misappropriation, breach or misuse involving this data could cause our customers to lose confidence in our ability to protect their data, which may cause them to potentially stop shopping with us or joining our loyalty program, attract negative media attention, cause harm to our reputation or result in liability (including but not limited to fines, penalties or lawsuits), any of which could have a material adverse effect on our business, operational results, financial position, and cash flows.

Regulatory scrutiny of privacy, user data protection, use of data and data collection is increasing on a global basis and regulations will likely continue to evolve over time. We are subject to numerous laws and regulations in the U.S. and internationally designed to protect the information of clients, customers, employees, and other third parties that we collect and maintain, including the European Union General Data Protection Regulation (the "EUGDPR") and the United Kingdom General Data Protection Regulation (the "UKGDPR"). Both the EUGDPR and UKGDPR, among other things, mandate requirements regarding the handling of personal data of employees and customers, including its use, protection, and the ability of persons whose data is stored to correct or delete such data about themselves. The state of California has a similar law called the California Consumer Privacy Act, recently amended and effective January 1, 2023, by the California Privacy Rights Act (as so amended, the "CCPA"). In addition to enforcement authority granted to the California Attorney General, the CCPA established the "California Privacy Protection Agency," a dedicated state agency charged with the authority to audit and enforce privacy rules, among other responsibilities, and the CCPA permits a private right of action for certain violations of law. Other U.S. states have also enacted comprehensive consumer privacy laws, and additional states may follow. We have from time to time received inquiries from governmental authorities regarding our practices. Additionally, the Federal Trade Commission and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination, and security of data.

These laws pose increasingly complex and rigorous compliance challenges, which may increase our compliance costs and related risk. If we fail to comply with these laws or other similar regulations applicable to our business, we could be subject to reputational harm and significant litigation, monetary damages, regulatory enforcement actions, or fines in one or more jurisdictions. The laws and regulations relating to privacy and data security are evolving, can be subject to significant change and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement, sanctions, and private litigation.

Risks Related to our OperationsSupply Chain and Supply ChainOperations

Complications in our distribution centers and other factors affecting the distribution of merchandise may affect our business.

We operate multiple distribution centers worldwide, to support our businesses. In addition to the distribution centers that we operate, we haveas well as third-party arrangements, to support our operations in the United States, Canada, England, Australia, New Zealand, and New Zealand. Asia.

If complications arise with any facility or third-party arrangements, or if any facility is severely damaged or destroyed, our other distribution centers may be unable to support the resulting additional distribution demands. Our distribution center capabilities may also be affected by disruptions caused by upgrades or changes to our warehouse management systems. We also may be affected by disruptions in the global transportation network caused by events including delays caused by the COVID-19 pandemic,acts of war or hostility and related military actions, port disruption, port strikes, weather conditions, work stoppages, or other labor unrest. These factors may adversely affect our ability to deliver inventory on a timely basis. We depend upon third-party carriers for shipment of merchandise. Any interruption in service by these carriers for any reason could cause disruptions in our business, a loss of sales and profits, and other material adverse effects.

Manufacturer compliance with our social compliance program requirements.

We require our independent manufacturers to comply with our policies and procedures, which cover many areas including human rights policy, labor, health and safety, and environmental standards. We monitor compliance with our policies and procedures using internal resources, as well as third-party monitoring firms. Although we monitor their compliance with these policies and procedures, we do not control the manufacturers or their practices. Any failure of our independent manufacturers to comply with our policies and procedures or local laws in the country of manufacture could disrupt the shipment of merchandise to us, force us to locate alternate manufacturing sources, reduce demand for our merchandise, or damage our reputation.

Our reliance on key management.

Future performance will depend upon our ability to attract, retain, and motivate our executive and senior management teams. Our executive and senior management teams have substantial experience and expertise in our business and have made significant contributions to our success. Our future performance depends, to a significant extent, both upon the continued services of our current executive and senior management teams, as well as our ability to attract, hire, motivate, and retain additional qualified management in the future. While we believe that weWe have adequate succession planning and executive development programs, competition for key executivesplans in the retail industry is intense,place and our operationsBoard of Directors reviews these succession plans. If our succession plans do not adequately cover significant and unanticipated turnover, the loss of the services of any of these individuals, or any resulting negative perceptions or reactions, could be adversely affected if we cannot retaindamage our reputation and attractour business.

Additionally, our success depends on the talents and abilities of our workforce in all areas of our business, especially personnel that can adapt to complexities and grow their skillset across the changing environment. Our ability to successfully execute our strategy depends on attracting, developing, and retaining qualified executives.talent with diverse sets of skills, especially functional and technology specialists that directly support our strategies.

Risks associated with attracting and retaining store and field team members.

Our success depends, in part, upon our ability to attract, develop, and retain a sufficient number of qualified store and field team members. The turnover rate in the retail industry is generally high. If we are unable to attract and retain quality team members, our ability to meet our growth goals or to sustain expected levels of profitability may be compromised.

Our ability to meet our labor needs while controlling costs is subject to external factors such as unemployment levels, prevailing wage rates, minimum wage legislation, and overtime regulations.

Risks Related to our Investments

If our long-lived tangible assets and operating lease right-of-use assets, or goodwill become impaired, we may need to record significant non-cash impairment charges.

We review our long-lived tangible assets, and operating lease right-of-use assets, and goodwill when events indicate that the carrying value of such assets may be impaired. Goodwill is reviewed for impairment if impairment indicators arise and, at a minimum, annually.

Goodwill is not amortized but is subject to an impairment test, which consists of either a qualitative assessment on a reporting unit level, or a quantitative impairment test, if necessary. The determination of impairment charges is significantly affected by estimates of future operating cash flows and estimates of fair value. Our estimates of future operating cash flows are identified from our long-range strategic plans, which are based upon our experience, knowledge, and expectations; however, these estimates can be affected by factors such as our future operating results, future store profitability, and future economic conditions, all of which are difficult to predict accurately. Any significant deterioration in macroeconomic conditions could affect the fair value of our long-lived assets, including our operating lease right-of-use assets, and goodwill and could result in future impairment charges, which would adversely affect our results of operations.

We do not have the ability to exert control over our minority investments, and therefore, we are dependent on others in order to realize their potential benefits.

We currently

At February 3, 2024, we hold $337$152 million of non-controlling minority investments in various entities and we may make additional strategic minority investments in the future. Such minority investments inherently involve a lesser degree of control over business operations, thereby potentially increasing the financial, legal, operational, and compliance risks associated with the investments. Other investors in these entities may have business goals and interests that are not aligned with ours or may exercise their rights in a manner in which we do not approve. These circumstances could lead to delayed decisions or disputes and litigation with those other investors, all of which could have a material adverse impact on our reputation, business, financial condition, and results of operations.

If our investees seek additional financing to fund their growth strategies, these financing transactions may result in further dilution of our ownership stakes and these transactions may occur at lower valuations than the investment transactions through which we acquired such interests, which could significantly decrease the fair values of our investments in those entities. Additionally, if our investees are unable to obtain additional financing, those entities could need to significantly reduce their spending in order to fund their operations or result in their insolvency. These actions likely would result in reduced growth forecasts, which also could significantly decrease the fair values of our investments in those entities.

Risks Related to Shareholder Activism, Geopolitics, Regulations, Internal Controls, and Other External Risks

We may face risks associated with shareholder activism.

Publicly traded

Publicly-traded companies are subject to campaigns by shareholders advocating corporate actions related to matters, such as corporate governance, operational practices, and strategic direction. We may become subject in the future to such shareholder activity and demands. Such activities could interfere with our ability to execute our business plans, affect our allocation of capital, disrupt relationships with our vendor partners, be costly and time-consuming, disrupt our operations, and divert the attention of management, any of which could have an adverse effect on our business or stock price.

Our shareholder rights plan could impede or discourage a takeover or change of control.

In December 2020, our Board of Directors adopted a short-term rights plan. The rights plan is intended to protect the interests of all the Company’s shareholders by reducing the likelihood that any person would gain control of the Company through open market accumulation or other tactics without appropriately compensating the Company's shareholders for such control. The rights plan is not intended to prevent or deter any action or offer that the Board of Directors determines to be in the best interests of shareholders. However, the overall effect of the rights plan may render it more difficult or discourage a merger, tender offer or other business combination involving the Company that may be considered beneficial by some shareholders but is not supported by our Board of Directors.

​

Macroeconomic developments may adversely affect our business.

Our performance is subject to global economic conditions and the related effects on consumer spending levels. Continued uncertainty about global economic conditions, including the COVID-19 pandemic, poses a risk as consumers and businesses may postpone spending in response to tighter credit, unemployment, negative financial news, and/or declines in income or asset values, which could have a material negative effect on demand for our products.

Changes in employment laws or regulation could harm our performance.

Various foreign and domestic labor laws govern our relationship with our employees and affect our operating costs. These laws include, but are not limited to, minimum wage requirements, overtime, sick, and sickpremium pay, paid time off, work scheduling, healthcare reform and the Patient Protection and Affordable Care Act, and the Protecting the Right to Organize Act, unemployment tax rates, workers’ compensation rates, European works council requirements, and union organization.

We may be adversely affected by regulatory and litigation developments.

We are exposed to the risk that federal or state legislation may negatively affect our operations. Changes in federal or state wage requirements, employee rights, health care, social welfare, or entitlement programs, including health insurance, paid leave programs, or other changes in workplace regulation could increase our cost of doing business or otherwise adversely affect our operations. Additionally, we are regularly involved in litigation and demands, including commercial, tort, intellectual property, customer, employment, wage and hour, data privacy, anti-corruption, and other claims, including purported class action lawsuits. The cost of defending against these types of claims against us or the ultimate resolution of such claims, whether by settlement, mediation, arbitration, or adverse court or agency decision, may harm our business.

We operate in many different jurisdictions and we could be adversely affected by violations of the U.S. Foreign Corrupt Practices Act and similar worldwide anti-corruption laws.

The U.S. Foreign Corrupt Practices Act (“FCPA”("FCPA") and similar worldwide anti-corruption laws, including the U.K. Bribery Act of 2010, which is broader in scope than the FCPA, generally prohibit companies and their intermediaries from making improper payments to government officials for the purpose of obtaining or retaining business. Our internal policies mandate compliance with these anti-corruption laws. Despite our training and compliance programs, we cannot be assured that our internal control policies and procedures will always protect us from reckless or criminal acts committed by our employees or agents. Our continued expansion outside the United States, including in developing countries, could increase the risk of FCPA violations in the future. Violations of these laws, or allegations of such violations, could have a material adverse effect on our results of operations or financial condition.

Failure to fully comply with Section 404 of the Sarbanes-Oxley Act of 2002 could negatively affect our business, market confidence in our reported financial information, and the price of our common stock.

We continue to document, test, and monitor our internal control over financial reporting in order to satisfy the requirements of Section 404 of the Sarbanes-Oxley Act of 2002. However, we cannot be assured that our disclosure controls and procedures and our internal control over financial reporting will prove to be completely adequate in the future. Failure to fully comply with Section 404 of the Sarbanes-Oxley Act of 2002 could negatively affect our business, the price of our common stock and market confidence in our reported financial information, and the price of our common stock.information.

International intellectual property protection can be uncertain and costly.

Uncertainty in intellectual property protection can result from conducting business outside the United States, particularly in jurisdictions that do not have comparable levels of protection for our assets such as intellectual property, copyrights, and trademarks. Continuing to operate in such foreign jurisdictions where the ability to enforce intellectual property rights is limited increases our exposure to risk.

Risks Related to our Indebtedness and our Credit Facility

Our debt may cause an adverse effect on our business.

We have $400 million of 4% Senior Notes due 2029. Our inability to generate sufficient cash flow to satisfy our debt obligations or to refinance our debt obligations could adversely affect our business, financial condition, results of operations, and other corporate requirements. This could require us to direct a substantial portion of our future cash flow toward payments on our indebtedness, which would reduce the amount of cash flow available to fund working capital, capital expenditures, and other corporate requirements, thereby limiting our ability to respond to business opportunities.

We may be unable to draw on our credit facility in the future or we may be unable to secure a new credit facility with similar terms. 

We have a $600 million asset-based revolving credit facility that is scheduled to expire in July 2025. Borrowings and letters of credit under our credit facility are not permitted to exceed a borrowing base, which is tied to our level of inventory. Therefore, reductions in the value of our inventory would result in a reduction in our borrowing base, which would reduce the amount of financial resources available to meet our operating requirements. Also, if we do not comply with our financial covenants and we do not obtain a waiver or amendment from our lenders, the lenders may elect to cause any amounts then owed to become immediately due and payable, not fund any new borrowing, or they may decline to renew our credit facility. In that event, we would seek to establish a replacement credit facility with one or more other lenders, including lenders with which we have an existing relationship, potentially on less desirable terms. There can be no guarantee that replacement financing would be available at commercially reasonable terms, if at all. Additionally, our rates on our revolving credit facility may be affected by our credit ratings which could result in higher interest expense in the future.

Item1B. Unresolved Staff Comments

None

Item 1C. Cybersecurity

Cybersecurity risk management and strategy

Information security is an important part of the Company’s culture and foundational to its management. This philosophy is emphasized throughout the organization by the Board of Directors, senior leadership, and team members to help promote a Company-wide culture of cybersecurity risk management. 

We use information technology and third-party service providers to support our global business processes and activities, which exposes us to cybersecurity risks. We have from time-to-time experienced cybersecurity incidents. In the event of a cybersecurity incident, we respond in accordance with our policies, processes, applicable laws, and regulations. When necessary, we also engage third parties, such as cybersecurity advisors, to assist in investigating and remediating incidents. To date, the cybersecurity incidents have not had a material effect on our business strategy, results of operations, or financial condition.

Key Program Components

We take cybersecurity seriously, and our cybersecurity program is aligned to well-known and established cybersecurity frameworks. We use, and continue to improve, our cyber defense-in-depth strategy, which uses multiple layers of security for holistic protection.

Our cybersecurity governance program is strategically integrated into our enterprise risk management and is periodically presented to the audit committee, which is responsible for oversight of the enterprise risk management framework associated with technology, security, data, and privacy, and the Board of Directors. These procedures include regular risk monitoring by management to update current risks and identify potential new and emerging risks. The Technology Committee receives regular briefings from our Chief Operations Officer, Chief Technology Officer, Chief Information Security Officer, and outside experts on cybersecurity risks and cyber risk oversight. During these meetings, the Technology Committee and management discuss these risks, risk management activities and efforts, best practices, lessons learned from incidents at other companies, the effectiveness of our security measures, and other related matters. The Technology Committee Chair reports on the committee’s meetings, considerations, and actions to the Board at the next Board meeting following each Technology Committee meeting. The Audit Committee also discusses and receives updates on cybersecurity matters in connection with its oversight of enterprise risk management.

We also maintain a variety of incident response plans that are utilized when incidents are detected. We conduct periodic tabletop exercises, in which different internal and external stakeholders, including from time to time our CEO, Non-Executive Chair, or Board of Directors, participate in a simulated cyber scenario. The purpose of these exercises is to test our cyber incident response plan, identify weaknesses or gaps, and ensure that all participants are aware of, and familiar with, their roles and responsibilities.

We require employees with access to information systems to undertake data protection and cybersecurity training. In addition, certain individuals with privileged access, such as system administrators and developers, are subject to additional controls and monitoring activities. We also conduct periodic phishing campaigns to train users to better identify, report, and avoid malicious content.

We recognize that third-party service providers may introduce cybersecurity risks to our organization. In an effort to mitigate these risks, we have implemented a process before engaging with third-party service providers which are designed to assess their cybersecurity practices. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers, requiring them to adhere to certain cybersecurity standards and protocols.

Our Chief Information Security Officer, with oversight from the Chief Technology Officer and Chief Operations Officer, is primarily responsible for assessing and managing cybersecurity risks. Our Chief Information Security Officer has extensive cybersecurity knowledge and skills gained from over 25 years’ experience in the field. Our Chief Information Security Officer is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents.

Several experienced information security professionals report to our Chief Information Security Officer and he is supported by a team of trained cybersecurity team members. In addition to our extensive in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

Notwithstanding the breadth of the Company’s information security program, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse impact. For a discussion of whether and how any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, see Item 1A. "Risk Factors," which is incorporated by reference into this Item 1C.

Item2. Properties

Our properties consist of land, leased stores, administrative facilities, and distribution centers. Gross square footage and total selling area for our store locations at the end of 20202023 were approximately 12.98 and 7.507.97 million square feet, respectively. These properties, which are primarily leased, are located in the United States and its territories, Canada, various European countries, Asia, Australia, and New Zealand.