XML 47 R29.htm IDEA: XBRL DOCUMENT
v3.25.1

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Feb. 01, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Macy's, Inc. is committed to protecting information that is valuable to our customers and critical to business operations from unauthorized access and disclosure. Risk Management and Strategy Macy's, Inc. operates a security operations program that employs a defense-in-depth strategy to provide layers of safeguards against cybersecurity threats. We apply a hybrid security framework model using the National Institute of Standards and Technologies (NIST), International Organization for Standardization (ISO) 27001, Control Objectives for Information and Related Technologies (COBIT) and Payment Card Industry Data Security Standard (PCI DSS) frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We conduct ongoing risk assessments, as well as internal and external vulnerability scanning and penetration testing of select systems and platforms. We work with our cloud platform providers to implement a consistent security and control environment through a combination of internal, front-end and additional controls, such as access, firewall and authentication controls. We undertake other activities to manage risks from cybersecurity threats, including: managing access to Company data; use of encryption; procedures to manage information security incidents, both actual and suspected; establishing security standards and procedures for day-to-day operations to promote optimal system performance and maintain the integrity of operational systems; implementing detection, prevention and recovery controls to protect information technology assets; backup procedures to prevent the loss of critical data; and restrictions on software installations, among other practices. We have an enterprise risk management program that identifies and prioritizes enterprise risks. At committee and Board meetings periodically throughout the year, management discusses the risk exposures identified as being most significant to the Company and the related actions that management may take to monitor such exposures. The program utilizes a network of functional experts with managerial responsibility for various aspects of enterprise risk management. Our oversight of risks from cybersecurity threats have been implemented into our enterprise risk management program. We have established data security breach preparedness and response plans that are tested and practiced regularly and address a range of scenarios that include data breaches and ransomware attacks. We are subject to regular information technology and security audits by internal and external audit staff. Our policy is to vet and train colleagues and relevant contractors and to protect Company data. A pre-employment screening process is conducted for candidates, including contractors and third parties, with background verification checks on some candidates for employment. Colleagues, including relevant contractors, must receive appropriate security training and be made aware of organizational policies and procedures relevant for their job function. We engage independent third-party security partners to evaluate, measure, and assist in the development and continuous enhancement of our security program. This includes, but is not limited to, program reviews, compromise assessments, breach response planning, and tabletop exercises. In the event we experience an actual or threatened cybersecurity incident or attack, our Security team will consult with a third-party security firm when appropriate, perform a root cause analysis and determine both how to address the threat and whether we could take additional steps to improve our security posture. In this regard prior cybersecurity incidents have informed changes to our processes to minimize vulnerabilities. As of the filing of this Annual Report on Form 10-K, we have not experienced a cybersecurity incident or attack, or any risk from cybersecurity threats, that has materially affected, or is reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, if as a result of any future attacks our information technology systems are significantly damaged, cease to function properly or are subject to a significant cybersecurity breach, we may suffer an interruption in our ability to manage and operate the business, and our business strategy, results of operations or financial condition could be adversely affected. For additional information about risks related to actual or threatened cybersecurity incidents, see “Information Security, Cybersecurity, Privacy and Data Management Risks” in the “Risk Factors” section of this Annual Report on Form 10-K.
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | We conduct ongoing risk assessments, as well as internal and external vulnerability scanning and penetration testing of select systems and platforms. We work with our cloud platform providers to implement a consistent security and control environment through a combination of internal, front-end and additional controls, such as access, firewall and authentication controls. We undertake other activities to manage risks from cybersecurity threats, including: managing access to Company data; use of encryption; procedures to manage information security incidents, both actual and suspected; establishing security standards and procedures for day-to-day operations to promote optimal system performance and maintain the integrity of operational systems; implementing detection, prevention and recovery controls to protect information technology assets; backup procedures to prevent the loss of critical data; and restrictions on software installations, among other practices. We have an enterprise risk management program that identifies and prioritizes enterprise risks. At committee and Board meetings periodically throughout the year, management discusses the risk exposures identified as being most significant to the Company and the related actions that management may take to monitor such exposures. The program utilizes a network of functional experts with managerial responsibility for various aspects of enterprise risk management. Our oversight of risks from cybersecurity threats have been implemented into our enterprise risk management program. We have established data security breach preparedness and response plans that are tested and practiced regularly and address a range of scenarios that include data breaches and ransomware attacks. We are subject to regular information technology and security audits by internal and external audit staff. Our policy is to vet and train colleagues and relevant contractors and to protect Company data. A pre-employment screening process is conducted for candidates, including contractors and third parties, with background verification checks on some candidates for employment. Colleagues, including relevant contractors, must receive appropriate security training and be made aware of organizational policies and procedures relevant for their job function. We engage independent third-party security partners to evaluate, measure, and assist in the development and continuous enhancement of our security program. This includes, but is not limited to, program reviews, compromise assessments, breach response planning, and tabletop exercises.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | Governance The Audit Committee of our Board of Directors is responsible for addressing policies with respect to the Company's risk assessment and risk management, including risks related to data privacy, computerized information controls and cybersecurity, and to consider any recommendations for improvement of such controls. The chairperson of the Audit Committee updates the full Board of Directors on these discussions. The Audit Committee, and the full Board of Directors when appropriate, receive regular updates from management on IT security, internal and external security reviews, data protection, risk assessments, breach preparedness, systems disruption risk, threat assessments, response plans and consumer privacy compliance. Senior management, including the Chief Operating Officer/Chief Financial Officer, Chief Legal Officer, and Chief Information Officer are closely involved with our breach response plans and are a critical part of our decision-making process. These executives attend annual tabletop exercises on response processes and our playbook. The Macy's, Inc. Security team is responsible for assessing and managing material risks from cybersecurity threats, including the prevention, mitigation, detection and remediation of cybersecurity incidents. The Macy's, Inc. Security team is comprised of security professionals with a variety of backgrounds, including former law enforcement, government and military. Users with access to Company data and information technology assets are required to promptly report known or suspected security incidents. Our incident response process escalates reporting of cybersecurity incidents to senior management and disclosure controls and procedures are in place to review impact on the Company. Our Chief Information Security Officer (CISO) leads our data protection programs. Our CISO is head of information security, privacy, IT risk, identity and access management and has 33 years with the Company in various roles of increasing responsibilities including Audit Assurance, Computer Operations, Networking and System platforms, including 14 years developing and managing the cybersecurity program. He holds a bachelor’s degree in computer science. The CISO provides cybersecurity updates at least three times per year to the Audit Committee and an annual review with the full Board of Directors.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration