Item 1C. CYBERSECURITY

Our ability to attract and retain customers, efficiently operate our businesses, execute our DRIVE transformation, including Network 2.0, and compete effectively increasingly depend in part upon the sophistication, security, and reliability of our technology network, including our ability to provide features of service that are important to our customers, to protect our confidential business information and the information provided by our customers, and to maintain customer confidence in our ability to protect our systems and to provide services consistent with their expectations.

Cybersecurity Risk Management and Strategy

FedEx has an information technology (“IT”) risk management process designed to identify and manage risk within its IT environment, including cybersecurity. The IT risk management process is based on an established framework for identification, measurement, and monitoring of cybersecurity and other risk areas and supplements our Enterprise Risk Management (“ERM”) process and framework. Our IT risk management, ERM, and compliance teams collaborate to regularly evaluate and manage cybersecurity-related risks using various tools and services. Leveraging components from multiple industry frameworks and best practices such as the International Organization for Standardization 27001 and National Institute of Standards and Technology (“NIST”) standards, including the NIST Cybersecurity Framework, our cybersecurity program prioritizes governance, identification, protection, detection, response, and remediation measures.

We regularly assess our cybersecurity program’s capabilities and tools to help us enhance reliability and scan our environment for vulnerabilities. Our IT risk management team, including our Corporate Vice President – Chief Information Security Officer (“CISO”), communicates with senior management on the cybersecurity risk posture of our IT assets, strives to ensure consistent risk remediation activities, and monitors the effectiveness of our IT-related controls. In addition, our internal audit team performs reviews of our information security organization to help ensure controls are operating effectively and as designed.

Enterprise-wide information security training (including with respect to cybersecurity), supplemented by awareness programs, is crucial for risk reduction and safeguarding customer, employee, and company information. We provide training to employees and certain third-party contractors based on access to our network, risk, roles, policies, standards, and behaviors, which is updated to address emerging technology and security issues.

We periodically engage with assessors, consultants, auditors, and other third parties to review and improve our cybersecurity program. Compliance with regulatory requirements involves regular third-party assessments. Our processes are also designed to address cybersecurity risks associated with third-party service providers, including risk assessment and due diligence during selection and oversight. Key third parties undergo regular assessments to gauge cybersecurity control effectiveness, with heightened review of those with access to non-public data.

- 37 -

We conduct table-top simulation exercises to regularly test our cybersecurity incident response processes with the aim of enhancing effectiveness against evolving threats. Our incident response procedures guide our preparedness, detection, response, and recovery actions. Additionally, we maintain cyber insurance designed to address certain aspects of cyber risks.

In the last three fiscal years to date, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. While we have significant security processes and initiatives in place, we may be unable to detect or prevent a breach or disruption in the future. For more information about cybersecurity-related risks, please see Item 1A. “Risk Factors” of this Form 10-K. See “Item 1A. Risk Factors” of our Annual Report on Form 10-K for the year ended May 31, 2021, for information regarding the 2017 NotPetya cyberattack at TNT Express.

Cybersecurity Governance

The FedEx Board of Directors has delegated to the Cyber and Technology Oversight Committee of the Board of Directors (“CyTOC”) responsibility for overseeing the company’s cyber and technology-related risks, including network security, information and digital security, data privacy and protection, and risks related to emerging technologies such as artificial intelligence and machine learning; the technologies, policies, processes, and practices for managing and mitigating such risks; and the company’s cyber incident response and recovery plan. The CyTOC also oversees the cybersecurity, cyber-resiliency, and technology aspects of the company’s business continuity and disaster recovery capabilities and contingency plans. Several of our Board members, including certain members of our CyTOC, have technological, digital, and/or cybersecurity experience.

The CyTOC receives regular updates from our CISO, Executive Vice President – Chief Digital and Information Officer and Chief Transformation Officer, and other members of management on risks related to these matters. Specific topics may include updates to FedEx’s cyber risks and threats, the status of existing or new strategies and associated projects intended to strengthen FedEx’s information security systems, assessments of FedEx’s cybersecurity program, and the emerging threat landscape. The CyTOC also receives regular updates on key metrics related to our cybersecurity-related risks. The results of the IT risk management process are also presented annually to the CyTOC. Additionally, members of the CyTOC participate in certain of the simulation exercises conducted by management. The Chair of the CyTOC briefs the full Board on certain of these matters. In addition, the Board periodically receives cybersecurity updates directly from management. Separately, through our ERM program, risks appropriate for Board-level awareness, including with respect to cybersecurity, are communicated to the Board and its Audit and Finance Committee at least annually, while significant risks are reported on a quarterly basis.

Our CISO, who reports to the Executive Vice President – Chief Digital and Information Officer and Chief Transformation Officer, leads our information security team and has responsibility for overseeing FedEx’s cybersecurity program. The CISO, who has over 25 years of experience at FedEx and has received industry-recognized information security certifications, oversees an information security organization of more than 400 security, risk, and compliance professionals based in the U.S. and internationally across the FedEx enterprise. The leadership team of our information security organization has extensive experience in IT and cybersecurity and possess certifications in cybersecurity and related fields.

The FedEx Information Technology Risk Council (“ITRC”), which is sponsored by the CISO, oversees the execution of FedEx’s comprehensive IT risk management program. The ITRC, which receives quarterly reports on FedEx’s IT risk management, is responsible for assessing the overall risk framework on an annual basis, setting acceptable risk tolerance levels, approving risk prioritization and associated risk mitigation activities, and monitoring the changing risk landscape and posture.

Both our CISO and other members of our cybersecurity leadership team participate in threat intelligence briefings provided by various government and industry entities. Moreover, our Executive Vice President – Chief Digital and Information Officer and Chief Transformation Officer is a member of the FedEx Executive Committee, which oversees our business risk, with cybersecurity threat risks being a regular topic of discussion. Our cybersecurity incident response plan includes processes for communicating cybersecurity incidents to relevant levels of management, including the ITRC, Executive Committee, the CyTOC, and the full Board of Directors, as appropriate.

I****TEM 2. PROPERTIES

Federal Express Segment

Federal Express’s principal owned and leased properties include its aircraft, vehicles, major sorting and handling facilities, administration buildings, FedEx Drop Boxes, and data processing and telecommunications equipment. In connection with our one FedEx consolidation, on June 1, 2024 FedEx Ground and FedEx Services were merged into Federal Express.

- 38 -

Aircraft and Vehicles

As of June 7, 2024, Federal Express’s aircraft fleet consisted of the following:

Description		Owned						Leased						Total						Maximum Gross Structural Payload (Pounds per Aircraft)
Boeing B777F				54						3						57						233,300
Boeing MD11				36						1						37						192,600
Boeing 767F				138						—					138(1)							127,100
Airbus A300-600				63						2						65						106,600
Boeing 757-200				92						—						92						63,000
ATR-72 600F				20						—						20						19,290
ATR-72				19						—						19						17,970
ATR-42				18						—						18						12,070
Cessna 408				19						—					19(2)							6,000
Cessna 208B				233						—						233						2,830
Total				692						6						698

(1)

Includes one aircraft not currently in operation and undergoing pre-service modifications.

(2)

Includes two aircraft not currently in operation and undergoing pre-service modifications.

In 2024, we made the decision to permanently retire from service 22 Boeing 757-200 aircraft and seven related engines to align with the plans of Federal Express to modernize its aircraft fleet, improve its global network, and better align air network capacity to match current and anticipated shipment volumes. See the “Results of Operations and Outlook — Consolidated Results — Goodwill and Other Asset Impairment Charges” section of “Item 7. Management’s Discussion and Analysis of Results of Operations and Financial Condition” of this Annual Report for more information regarding the retirements, and the “Federal Express Segment — Operations” section of “Item 1. Business” for information regarding the ongoing redesign of the Federal Express international air network to improve efficiency and asset utilization.

As of June 7, 2024, Federal Express operated more than 87,000 motorized vehicles in its global network and also conducts certain linehaul and pickup-and-delivery operations primarily with more than 95,000 motorized vehicles owned or leased by independent service providers.

Aircraft Purchase Commitments

The following table is a summary of the number and type of aircraft we were committed to purchase as of June 7, 2024, with the year of expected delivery:

		Cessna SkyCourier 408				ATR 72-600F				B767F				B777F				Total
2025			17				7				11				2				37
2026			14				3				3				—				20
2027			—				—				—				—				—
2028			—				—				—				—				—
2029
Thereafter			—				—				—				—				—
Total			31				10				14				2				57

As of June 7, 2024, we had $611 million in deposits and progress payments on aircraft purchases and other planned aircraft-related transactions. See Note 18 of the accompanying consolidated financial statements for more information about our purchase commitments and options.

- 39 -

Sorting and Handling Facilities

At June 7, 2024, Federal Express operated the following major air sorting and handling facilities:

Location		Acres				Square Feet				Sorting Capacity (per hour)****(1)				Lessor		Lease Expiration Calendar Year
Primary
Memphis, Tennessee			916				3,671,859				484,000			Memphis-Shelby County Airport Authority		2036
National
Indianapolis, Indiana(2)			450				3,002,925				140,000			Indianapolis Airport Authority		2053
Miami, Florida(3)			35				284,809				7,000			Aero Miami FX, LLC		2041
Regional
Fort Worth, Texas			168				987,388				76,000			Fort Worth Alliance Airport Authority		2041
Newark, New Jersey			70				634,193				156,000			Port Authority of New York and New Jersey		2030
Oakland, California			75				587,700				63,000			Port of Oakland		2036
Greensboro, N. Carolina			165				595,000				23,000			Piedmont Triad Airport Authority		2031
Metropolitan
Chicago, Illinois			54				481,350				24,000			City of Chicago		2028
Los Angeles, California			34				305,300				23,000			City of Los Angeles		2025(4)
Atlanta, Georgia			35				291,525				22,600			City of Atlanta		2030
International
Anchorage, Alaska(5)			64				375,300				25,000			State of Alaska, Department of Transportation and Public Facilities		2078
Paris, France(6)			123				1,798,368				59,000			Aeroports de Paris		2048
Cologne, Germany(6)			14				731,267				17,900			Cologne Bonn Airport		2040
Guangzhou, China(7)			155				873,006				36,000			Guangdong Airport Management Corp.		2029
Osaka, Japan(7)			17				425,206				9,000			Kansai Airports		2029
Liege, Belgium(8)			23				1,027,952				33,700			Liege Airport		2036

(1)

Documents and packages.

(2)

In addition to U.S. domestic express package and freight shipments, handles certain international express package and freight shipments to and from Europe.

(3)

Handles international express package and freight shipments to and from Latin America and the Caribbean.

(4)

Property is held under two separate leases — we continue to renew the lease for the sorting and handling facility on a month-to-month basis while a new lease is being negotiated, and the lease for the ramp expansion expires in calendar 2025.

(5)

Handles international express package and freight shipments to and from Asia, Europe, and North America.

(6)

Handles intra-Europe express package and freight shipments, as well as international express package and freight shipments to and from Europe.

(7)

Handles intra-Asia express package and freight shipments, as well as international express package and freight shipments to and from Asia.

(8)

Handles intra-Europe express package and freight shipments.

Federal Express’s primary sorting facility, which serves as the center of its multiple hub-and-spoke system and worldwide air network, is located at the Memphis International Airport. Federal Express’s facilities at the Memphis International Airport also include aircraft hangars, aircraft ramp areas, vehicle parking areas, flight training and fuel facilities, the FedEx Cold Chain Center, administrative offices, and warehouse space.

- 40 -

Federal Express leases these facilities from the Memphis-Shelby County Airport Authority (the “Authority”). The lease obligates Federal Express to maintain and insure the leased property and to pay all related taxes, assessments, and other charges. The lease is subordinate to, and Federal Express’s rights thereunder could be affected by, any future lease or agreement between the Authority and the U.S. government.

Federal Express has additional major international sorting and freight handling facilities located at Narita Airport in Tokyo and Stansted Airport outside London. Federal Express also has a substantial presence at airports in Hong Kong, Taiwan, and Dubai. A central air hub near Liege, Belgium connects specific large European markets. Additionally, central European road hubs are located in Duiven, The Netherlands and Novara, Italy, respectively.

As of June 7, 2024, Federal Express owned or leased approximately 650 facilities for city station operations in the U.S. In addition, over 1,000 city stations are owned or leased throughout Federal Express’s international network. The majority of these leases are for terms of five to ten years. City stations serve as a sorting and distribution center for a particular city or region. We believe that suitable alternative facilities are available in each locale on satisfactory terms, if necessary.

Federal Express also operates a highly flexible surface network of over 700 legacy FedEx Ground sortation and distribution facilities, including 165 fully automated stations, as of June 7, 2024. See the “Federal Express Segment — Operations” section of “Item 1. Business” for information regarding the consolidation of these operations into the U.S. surface operations of Federal Express. Of the 610 facilities that supported FedEx Home Delivery as of June 7, 2024, 593 were co-located with existing Federal Express surface operations. These leased facilities generally have terms of five years or less. Strategically located to cover the geographic area served by the U.S. surface operations of Federal Express, the facilities range in size from approximately 1,000 to 1,060,000 square feet, with an average size of approximately 179,000 square feet.

Administrative and Other Properties and Facilities

The World Headquarters of Federal Express is located in southeastern Shelby County, Tennessee. Federal Express international headquarters are located in Hoofddorp, The Netherlands. Federal Express leases state-of-the-art technology centers in Collierville, Tennessee and Colorado Springs, Colorado. These facilities house personnel responsible for strategic software development and other functions that support FedEx’s technology and e-commerce solutions.

As of June 7, 2024, Federal Express had approximately 27,000 Drop Boxes. Federal Express customers can also ship from approximately 28,000 staffed drop-off locations, including FedEx Office stores and FedEx Authorized ShipCenters. Internationally, Federal Express had approximately 13,000 drop-off locations.

The FedEx Authorized ShipCenter program offers U.S. domestic and international Federal Express shipping and drop-off services through a network of over 4,000 franchised and independent “pack and ship” retail locations. The FedEx OnSite network includes nearly 17,000 drop-off locations at Walgreens, Dollar General, and Albertsons stores. Additionally, Federal Express has an agreement with Office Depot, Inc. to offer U.S. domestic and international Federal Express shipping and drop-off services at nearly 1,000 Office Depot and OfficeMax retail locations.

FedEx Freight Segment

FedEx Freight’s corporate headquarters are located in Memphis, Tennessee, with some administrative offices in Harrison, Arkansas. As of June 7, 2024, FedEx Freight operated nearly 30,000 motorized vehicles and approximately 360 service centers, which are strategically located to provide service throughout North America. These facilities range in size from approximately 1,000 to 280,000 square feet of office and dock space.

FedEx Dataworks Operating Segment

FedEx Dataworks’ corporate headquarters are located in Memphis, Tennessee.

FedEx Office Operating Segment

FedEx Office’s corporate headquarters are located in Plano, Texas. As of June 7, 2024, FedEx Office operated approximately 2,000 customer-facing stores and 17 manufacturing plants with expanded print capabilities (traditional electrophotography, digital and traditional offset, large and grand format, and dye sublimation printing), with 14 of the manufacturing plants also housing co-located signs and graphics production operations. Substantially all FedEx Office stores are leased, generally for terms of five to ten years with varying renewal options. FedEx Office operates approximately 200 stores at hotels, convention centers, hospitals, universities, and

- 41 -

corporate campuses, with the remainder generally located in strip malls, office buildings, Walmart stores, and stand-alone structures. FedEx Office’s customer-facing stores average approximately 3,200 square feet in size.

FedEx Logistics Operating Segment

FedEx Logistics’s corporate headquarters are located in Memphis, Tennessee and FedEx Supply Chain’s corporate headquarters are located in the Pittsburgh, Pennsylvania metropolitan area. As of June 7, 2024, FedEx Logistics operated approximately 115 offices and facilities in 34 countries and territories throughout North America and in Africa, Asia-Pacific, Europe, India, Latin America, the Middle East, and Australia/New Zealand. In addition, as of June 7, 2024, FedEx Supply Chain had nearly 80 facilities through which it operates its supply chain logistics services.