GENGen Digital

You attribute the increase in revenue to a $406 million increase in sales of your consumer security products and a $117 million increase in sales of your identity and protection products, which was offset by $113 million of foreign exchange headwinds. Please revise here to provide a quantified discussion of the impact of the Avast acquisition on your net revenues.

Rest of the question

In this regard, avoid using vague terms such as "primarily," as you have done on page 28, in favor specific quantification to more clearly describe the organic versus inorganic revenue growth. Similarly, revise to include a discussion of Avast's impact on your performance metrics such as direct customer count, ARPU and annual retention rate. For example, the decrease in your annual retention rate from 84% in fiscal 2022 to 76% in fiscal 2023 appears to be impacted by the Avast acquisition. Refer to Item 303(b) of Regulation S-K.

No reply letter found.

We note that annual retention rate is defined as the number of direct customers who have more than one-year tenure as of the end of the most recently completed fiscal period divided by the total number of direct customers as of the end of the period one year ago. Please revise to clarify whether you compare the customer base as of a year ago to the same customers in the current period.

Rest of the question

If not, explain further how this measure represents retention of existing customers.

No reply letter found.

We note your disclosure that revenue from e-commerce partners is recognized on a gross basis before the deduction of partner incentive and fees. Please revise to disclose the nature of these arrangements, clarify whether you have direct billing arrangements with the end consumer, and describe the basis for your accounting treatment conclusion, if material.

Rest of the question

In your response, tell us the amount of e-commerce revenue for each period presented, including subsequent interim periods, and clarify whether ecommerce revenue is included in direct or partner revenue as disclosed in MD&A. Refer to ASC 606-10-50-12.

No reply letter found.

Please provide us with your customer retention rates for each quarter of the last two fiscal years and the current interim periods. Also, tell us your consideration to include this information in your Form 10-Q filings. In this regard, we note you present quarterly retention information in your investor presentations along with a discussion of changes in such metric since the Avast acquisition.

No reply letter found.

We note that you highlight the non-GAAP year-over-year information in a different style (i.e. bullet points) than you do the GAAP information, which appears to place undue prominence on your non-GAAP measures. In addition, you discuss non-GAAP operating income in your highlights without discussing GAAP operating income with equal or greater prominence. Please revise.

Rest of the question

Refer to Question 102.10(a) of the Non-GAAP Compliance and Disclosure Interpretations.

No reply letter found.

We note your reference to various metrics such as average direct customer count and direct ARPU in your earnings calls. To the extent that these metrics are used by management to assess the performance of your business, please revise to include disclosure of each of these metrics in future filings or explain.

Rest of the question

In addition, we note from your risk factor disclosures that your business depends on your customers renewing their arrangements for maintenance, subscriptions, managed security services and cloud-based offerings. Please tell us what metrics are used to monitor customer renewal and retention, and include a quantified discussion of such metrics for each period presented. Refer to Item 303(a)(3) of Regulation S-K and Section III.B.1 of SEC Release 33-8350.

We respectfully advise the Staff that we regularly evaluate our disclosure of metrics that may be meaningful to our investors in understanding our business. Such an evaluation is challenging due to the number of financial and non-financial metrics we regularly monitor and the complexity of our evolving business, which has undergone several transformative acquisitions and divestitures since January 2016, and the diverse composition of our customers and contractual arrangements in each of our segments.

Rest of the answer

We believe that the key metrics disclosed in our Form 10-K were the key metrics regularly used by management to evaluate our business, measure our performance, identify trends affecting our business, formulate financial projections and make strategic decisions for the period covered in our Form 10-K.

We periodically monitor various metrics, such as direct customer count and direct ARPU for significant changes, but did not consider these key metrics used to evaluate our results of operations as we worked through transitions in our business with the integration of two major acquisitions, the completion of several smaller acquisitions, and two divestitures during the three-year period ending March 30, 2018, which made comparisons to prior periods difficult and less meaningful. We acknowledge that, beginning in fiscal year 2018, we reported in our supplemental earnings materials average direct customer count and direct ARPU for our Consumer Digital Safety segment. We provided this information primarily as a convenience to analysts because direct customer counts and ARPU were previously publicly reported by LifeLock, Inc.

prior to our acquisition of that company in February 2017.

Beginning in fiscal year 2019, for the first time, management had comparable year-over-year data for average direct customer count and direct ARPU to assess the performance of our Consumer Digital Safety segment direct sales, which represent approximately 90% of our Consumer Digital Safety segment revenues. This enabled us to discuss these metrics in the Management’s Discussion and Analysis of Financial Condition and Results of Operations (“MD&A”) section of each of our quarterly reports on Form 10-Q for fiscal year 2019. For example, in the Form 10-Q for the period ended December 28, 2018, we state, “Revenue per customer increased slightly, whereas customer count decreased slightly.” While we believe such qualitative information in our MD&A provided required material information to our investors, we believe our investors would benefit from additional quantitative information in our periodic reports. As such, in our MD&A section in future filings, we will separately disclose average direct customer count and direct ARPU for our Consumer Digital Safety segment and their impact to our results of operations for that segment if material to understanding those results.

Management periodically monitors customer retention and renewal rates for significant changes in each of our segments. However, in our Enterprise Security segment, the usefulness and comparability of customer renewal and retention rates for the periods presented in our Form 10-K is limited because of the impact of the Veritas divestiture in January 2016 and the Blue Coat acquisition in August 2016, and changes to and variability in the way we sell our arrangements. Finally, we do not believe disclosure of customer retention rates in our Consumer

Digital Safety segment from period to period provides meaningful information to our investors because our retention rates have been relatively consistent from month to month over the past three fiscal years. For the foregoing reasons, we respectfully submit to the Staff that we do not believe disclosure of renewal or retention rates in our periodic reports would be meaningful to our investors in understanding our business at this time. We will continue to evaluate which metrics we believe are meaningful to investors and include those that we consider to be material to understanding our business in our MD&A disclosures.

Read in the reply ↗

We note that as part of the Audit Committee Investigation, you identified a transaction that was initially incorrectly recorded as revenue rather than deferred revenue. We also note that the Audit Committee noted relatively weak and informal processes and proposed certain recommendations to the Board.

Rest of the question

Please address the following with regard to your internal control over financial reporting and disclosure controls and procedures: • To the extent that you determined there were control deficiencies that lead to the incorrect accounting for the noted transaction, describe in reasonable detail the control(s) that failed and how you evaluated the severity of each identified. Refer to the guidance for evaluation of control deficiencies beginning on page 34 of SEC Release No. 33-8810 “Commission Guidance Regarding Management’s Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934.” Include in your analysis a description of the maximum potential amount or total number of transactions exposed to the deficiency and explain how you made that determination. • Tell us whether you evaluated if there were any deficiencies in your monitoring or risk assessment controls and processes as a result of the identified transaction or any other matters, and if so, how you evaluated the severity of those deficiencies. • Tell us of any changes or improvements in your internal controls over financial reporting you made or plan to make as a result of your detecting the incorrect accounting for this transaction.

The entirety of the Company’s response to the Staff’s comment 2 is set forth in Attachment A, which has been provided to the Staff under separate cover. Confidential treatment has been requested for Attachment A pursuant to Regulation 200.83 of the Commission (17 C.F.R. §200.83).

Notes to Consolidated Financial Statements

Note 3. Read in the reply ↗

Please tell us how you considered the guidance in ASC 205-20-45-1B in determining that the divestiture of the WSS and PKI solutions should not be classified as discontinued operations. In this regard, you stated in your June 30, 2017 Form 10-Q that you expected the financial results of your website security business will be presented as discontinued operations.

In evaluating whether the divestiture of the WSS and PKI solutions (the “Divestiture”) met the criteria of “a strategic shift that has (or will have) a major effect on an entity’s operations and financial results” in accordance with ASC 205-20-45-1B, as of the date of the Divestiture, we considered how management organized, analyzed and managed operations internally, how we identified our operating and reportable segments, and how we disclosed the nature of our business and operations in our financial statements, press releases, analyst presentations and other supplemental information

Rest of the answer

provided to investors.

As of the date of the Divestiture, the related revenues and expenses were included in our Enterprise Security segment. Our integrated cyber defense strategy for the Enterprise Security segment did not change in anticipation of or as a result of the Divestiture. Additionally, prior to the Divestiture, we did not discuss operating results for WSS or PKI solutions in our financial statements, press releases, analyst presentations, or other supplemental information provided to investors. As a result of this evaluation, we determined that the Divestiture did not constitute a strategic shift that had or will have a major effect on our operations and financial results from a qualitative perspective.

From a quantitative perspective, we considered the threshold examples provided in

ASC 205-20-55 with respect to strategic shifts that have or will have a major effect on a business. In our evaluation of whether the Divestiture should be reported as discontinued operations, we noted that the WSS and PKI solutions represented less than 15% of total consolidated net revenues for the year ended March 31, 2017, less than 20% of our total assets as of October 31, 2017 (the date of the

Divestiture), and did not represent a major change in geographical area (e.g. Americas, EMEA, and APJ). For the year ended March 31, 2017, WSS and PKI solutions revenues were 11% of total consolidated net revenues and were forecasted to be 8% of total consolidated net revenues for the year ended March 30, 2018. At the time of Divestiture, WSS and PKI solutions represented approximately 5% of total assets. As a result of this evaluation, we determined that the Divestiture did not constitute a strategic shift that had or will have a major effect on our operations and financial results from a quantitative perspective.

Based on the factors identified above, we concluded the Divestiture should not be classified as discontinued operations in accordance with ASC 205-20.

Read in the reply ↗

We note that product and services transferred at a point in time comprised approximately 11% of total revenue. Please provide us with a breakdown of your point in time revenue between product and services and clarify for us what services are transferred at a point in time.

Rest of the question

Also, please revise to separately present revenue and the related costs of revenue from product and services revenue on the face of your income statement, as necessary. Refer to Rule 5-03(b)(1) and (2) of Regulation S-X.

Our products and services transferred at a point in time include hardware and both perpetual software licenses and a portion of term-based software license subscriptions that are both capable of being distinct and distinct within the context of the contract in accordance with ASC 606-10-25-19.

We consider hardware and perpetual software license revenues to be revenues from tangible products, and consider term-based software license subscriptions, support and maintenance, cloud-based offerings, identity and information protection services, and professional services revenues to be revenues

Rest of the answer

from services. In the nine months ended December 28, 2018, the Company recognized 11% of revenue from products and services transferred at a point in time. Of the 11% of revenue recognized, 8 percentage points were recognized from tangible products and 3 percentage points were recognized from services.

Our tangible product revenue did not meet the 10% threshold under Rule 5-03(b)(1) and (2) for any period presented in our Form 10-Q for the period ended December 28, 2018 or historically for any of the three years ended March 30, 2018 and thus, we believe that it was appropriate to present revenue as a single line item on the face of our income statement in our prior periodic reports. We regularly evaluate compliance with this disclosure requirement and will in future filings disaggregate net revenue on the face of our income statement as required should revenues from tangible products (or any other category) exceed 10% of total consolidated net revenues.

Read in the reply ↗

Please tell us and revise to disclose the typical contract terms or performance periods, as well as the typical payment terms, for each of your material revenue streams. Performance Obligations, page 10

Our Enterprise Security arrangements can include various combinations of licenses, cloud services, hardware, support and maintenances, and professional services, which are sold directly to end-users or through a multi-tiered distribution channel. Performance periods generally range from one to three years, and payment terms are generally between thirty and sixty days.

Rest of the answer

Contracts generally do not contain significant financing components or variable consideration.

Additionally, the significant majority of our Consumer Digital Safety arrangements consist of products and services sold directly to end-users, with performance periods of generally one year or less, and payments that are generally collected up front. Contracts generally do not contain significant financing components or variable consideration.

In light of the Staff’s comment, we plan to include in future filings descriptions of the typical contract terms and payment terms for our Enterprise Security and Consumer Digital Safety revenue arrangements.

Read in the reply ↗

Please tell us which products and services are included in your "license with interrelated deliverables" that are transferred over time, and whether these are perpetual or term licenses. Also, tell us the promises and performance obligations in these arrangements such as license, support, updates, etc., including any material rights, and clarify when and over what period of time revenue is recognized for each

Rest of the question

performance obligation. To the extent there are no material rights in these arrangements, please explain how you made such determination. Lastly, tell us the amount of revenue recognized from this revenue stream for each period presented and expand your disclosures if material. Contract Liabilities, page 12

We include Norton security and certain Enterprise Security solutions, primarily endpoint security, within “license with interrelated deliverables” that are transferred over time. These arrangements are typically sold as term-based license subscriptions. However, certain of these products are sold infrequently as perpetual licenses (approximately 0.5% of total consolidated net revenues for both the three and nine months ended December 28, 2018 related to perpetual licenses of these products).

Additionally, the promises included in “license with interrelated deliverables” arrangements

Rest of the answer

typically consist of the license as well as related support and maintenance. Support and maintenance includes unspecified, when-and-if available software updates and upgrades.

In order to determine the performance obligations included in these arrangements, we considered the guidance in ASC 606-10-25-19.b and

606-10-25-21 as well as

606-10-55-140D through F (Example 10 Case C) and determined that our promises to transfer the software license and the related support and maintenance are not separately identifiable because:

the licensed software and the software updates and upgrades included in the support and maintenance are highly interdependent and highly interrelated, working together to deliver continuously updated protection to customers;

by identifying and addressing new threats, the software updates and upgrades significantly modify the licensed software and are integral to maintaining its utility; and given the rapid pace with which new threats are identified, the value of the licensed software diminishes rapidly without the software updates and upgrades.

Based on the determination above, we considered the software license and related support and maintenance for these software arrangements, in effect, inputs to a single, combined performance obligation with revenue recognized over time.

Although perpetual license sales for these products are infrequent and quantitatively immaterial as noted above, these arrangements typically include maintenance renewal options that result in a material right related to the licensed software as the customer does not provide us any consideration for the perpetual license in the maintenance renewal periods (i.e. consideration for the perpetual license is only included in the initial contract). Therefore, we considered the material right in these perpetual license arrangements to be a separate performance obligation.

Because the additional goods and services included in the renewal options are similar to those provided in the initial contract and the renewal options’ terms and conditions for the related goods and services are the same as those in the initial contract, we chose to apply the practical alternative from ASC 606-10-55-45 to allocate consideration to the optional goods and services in these perpetual license arrangements. This alternative required us to estimate a hypothetical transaction price based on the goods or services expected to be provided, which necessitated establishing an estimate of the period over which a customer will renew one of these perpetual license arrangements. We determined that our best estimate of the period over which a customer will renew one of these perpetual license arrangements is three years from the start of the initial contract. We allocate the transaction price between (1) the combined license and support and maintenance performance obligation and

(2) the material right related to the expected contract renewals based on the hypothetical transaction price, and recognize revenue for the performance obligations over the estimated three year renewal period. For term-based license subscriptions, we recognize revenue over the contractual term, which generally ranges between one and three years.

Revenue recognized from “license with interrelated deliverables” that are transferred over time, which includes both term-based license subscriptions and perpetual licenses described above, was approximately 56% and 57%, respectively, of total consolidated net revenues for both the three and nine months ended December 28, 2018.

Although the amount of revenue recognized from these “license with interrelated deliverables” that are transferred over time is material on a quantitative basis, we respectfully advise the Staff that we believe that it is unnecessary to expand our disclosures further, as we disclose in Notes 3 and 15 the timing of when our performance obligations are satisfied, as well as revenue by category disaggregated based on the timing of the transfer of goods or services, the type of good or service, and the geographical region. In our view, additional disclosure would not meaningfully improve an investor’s understanding of our financial statements or the nature, amount, timing and uncertainty of revenue and cash flows arising from our customer contracts in accordance with the disclosure objective in ASC 606-10-50-1 through 606-10-50-3.

Read in the reply ↗

Please clarify whether customer deposit liabilities are included in your remaining performance obligation table and if so, explain how you determined that such consideration received or due from customers should be considered unsatisfied performance obligations.

Rest of the question

Also, tell us and separately disclose the amount of deferred revenue and customer liabilities included in your long-term contract liabilities for all periods presented.

We include customer deposit liabilities in the remaining performance obligation table. Customer deposit liabilities are related to arrangements in our

Consumer Digital Safety segment for which we have been paid in advance, but that include terms that allow the end user to terminate the contract and receive a pro-rata refund for a period of time.

Rest of the answer

Although the end user may terminate the contract in these arrangements, we believe we are obligated to continue to provide services until such cancellation occurs and therefore we include customer deposit liabilities in our remaining performance obligation table.

There are no customer deposit liabilities included in long-term contract liabilities, as the entire balance of customer deposit liabilities is short-term in nature.

Read in the reply ↗

We note from your response to prior comment 1 that management periodically monitors customer retention and renewal rates for significant changes in each of your segments. Please clarify for us what you mean by "periodically monitors." Also, you state the comparability of your renewal and retention rates for your Enterprise Security segment are limited due to a divestiture in fiscal 2016 and an acquisition in early

Rest of the question

fiscal 2017. Please explain further why transactions from two years ago continue to impact the usefulness of these metrics. Also, describe further the changes made to the way you sell your Enterprise Security arrangements and how such changes impacted the usefulness of such measures. In addition, please provide us with the renewal and retention rates for each of the Enterprise Security and Consumer Digital Security segments for each quarter during the last three fiscal years. To the extent there have been significant fluctuations in such measures, particularly for the Consumer Digital Security segment, please explain further why a quantified discussion would not be useful to investors. Refer to Section III.B.1 of SEC Release 33-8350.

We respectfully advise the Staff that, like all businesses of our size and scale, we have access to large volumes of data. While we believe this information can provide insight into trends and thus can be directionally meaningful, it is often too imprecise or incomplete to report on a regular basis in our public filings.

Rest of the answer

It was along these lines that we made the statement in response to prior comment 1 regarding our periodic monitoring of customer retention and renewal rates.

In our Enterprise Security segment, our management may look at imprecise or incomplete data from time to time to provide limited insights, but in the past, we did not review the same data on a consistent basis. We do not have a formal definition or method of computing renewal and retention rates for the Enterprise Security segment due to a number of factors including significant changes in our enterprise resource planning (“ERP”) systems as a result of our Blue Coat acquisition and our Veritas divestiture, as well as legacy systems from prior acquisitions and systems upgrades, and a lack of consistent customer data that has been sufficiently analyzed to rely on as the basis for metrics that are suitable for reporting to the executive management team or investors. Additionally, we believe that generalized retention and renewal rates would not be meaningful to investors due to the composition and trends in the nature of our contractual arrangements. Our Enterprise offerings are sold under a wide variety of multiple-element arrangements that may include sales of appliances, perpetual software licenses, support contracts, term-based license subscriptions and cloud-based SaaS products. In addition, over the past few years, our business model in the Enterprise Security segment has been evolving such that fewer arrangements are taking the form of appliance and perpetual license sales, and our arrangements are shifting more towards term-based license subscriptions and cloud-based products. As a result of the factors described above, we are unable to provide customer retention and renewal information for our Enterprise Security segment for the past three years ended fiscal year 2018 that would be meaningful to investors and is measurable with sufficient precision to report in our public filings.

As requested, the table below sets forth our historical customer retention rates, which we define as the percentage of customers that are retained at the end of 12 months for each period, for our Consumer Digital Safety segment by quarter for fiscal years 2016, 2017, 2018 and 2019.

FY 2019

FY 2018

Q4

Q3

Q2

Q1

Retention rate

84.3

%

84.2

83.9

83.6

83.1

81.9

81.4

80.4

FY 2017

FY 2016

79.8

79.2

78.5

77.9

77.3

76.4

76.3

76.2

In light of the Staff’s comment, we will include customer retention rates for our Consumer Digital Safety segment in our fiscal year 2019 Form 10-K.

Read in the reply ↗

We note your response to prior comment 2. In order for us to better understand the control deficiency identified and how you considered the potential magnitude of the control deficiency, please address the following as it relates to the transaction that was initially recorded as revenue rather than the majority of the transaction being recorded as deferred revenue: • Explain further how the revenue misstatement was

Rest of the question

discovered during the Audit Committee investigation. • Describe the transaction that resulted in this misstatement, clarify why the accounting changed and cite the specific accounting guidance applied. • Describe the standard sales process and the individuals involved in the process, from negotiating to reviewing, closing, and recording a transaction, and how segregation of duties is considered. If the standard process differed for this particular transaction, please explain why. Please also explain if there were other circumstances in which the standard process was not followed and whether the Audit Committee reviewed and considered those transactions as a part of its investigation. • Explain in more detail how the control identified in your response works, including the level of precision related to this control. For example, explain the nature of the revenue training and representations, and tell us why you believe if the sales personnel had been involved this control would have detected the misstatement on a timely basis. • Explain in more detail the nature of the control deficiency. For example, clarify whether it is a design or operating effectiveness control deficiency. Also, explain in detail how the change in controls as described in your response would have prevented or detected a misstatement on a timely basis. • With regards to the maximum amount or total number of transactions exposed to the deficiency, please explain in more detail how you determined the criteria for this additional population. Explain the characteristics that were unique to these additional transactions and the transaction resulting in the misstatement, and describe any differences related to the nature of these transactions. Tell us what percentage of your new 2018 sales contracts these additional contracts represented. Additionally, tell us why you did not consider any new sales contracts prior to fiscal 2018 in your analysis. Lastly, to the extent such population was limited to a certain product line or class of revenue, please explain why. • Clarify whether the number of potential transactions exposed to the control deficiency in fiscal 2018 is indicative of what you might identify in a typical year. • Provide an analysis of the potential magnitude of additional transactions, which includes the identified misstatement. In this regard, your response indicates you excluded the misstatement in the analysis provided. In addition, your analysis should consider the potential impact to income from continuing operations before taxes, income from continuing operations, and net income, and how that impacts your consideration of whether the identified adjustment rose to the level of a material weakness. As part of this analysis, please explain whether the additional potential magnitude determined was based on the full amount of revenue from those transactions being deferred, or part of the amount being deferred. If the latter, please explain the rationale.

The entirety of the Company’s response to the Staff’s comment 2 is set forth in Section 1 of Attachment A, which has been provided to the Staff under separate cover. Confidential treatment has been requested for Attachment A pursuant to Regulation 200.83 of the Commission (17

C.F.R. §200.83). Read in the reply ↗

You state on page 69 that the Audit Committee noted relatively weak and informal processes with respect to some aspects of review, approval and tracking of transition and transformation expenses. Also, in the Form 8-K furnished on November 1, 2018 you refer to adjustments to stock-based compensation, certain other operating expenses and income taxes.

Rest of the question

Tell us whether any adjustments related to each of these matters relate to the revenue misstatement or to the related control deficiency. To the extent these adjustments were separate from the revenue misstatement, please describe any control deficiencies related to these adjustments, and tell us how you considered these control deficiencies in aggregation with the other control deficiencies identified, including the control deficiency related to the revenue misstatement. Lastly, tell us whether these adjustments arose from control deficiencies impacting any of the COSO components outside of control activities, including consideration related to aggregation of the control deficiencies.

The entirety of the Company’s response to the Staff’s comment 3 is set forth in Section 2 of Attachment A, which has been provided to the Staff under separate cover. Confidential treatment has been requested for Attachment A pursuant to Regulation 200.83 of the Commission (17 C.F.R. §200.83). Read in the reply ↗

Your disclosures on page 69 also indicate that the Audit Committee identified certain behavior inconsistent with the company’s Code of Conduct and related policies. Please address the following related to that disclosure: • Further describe the behaviors identified and the roles of the individuals involved. • Tell us whether any of those involved had financial reporting responsibilities.

Rest of the question

If so, explain whether you identified any control deficiencies, including with regards to the COSO components outside of control activities. • Tell us whether the recent resignations of the Chief Operating Officer and Chief Financial Officer were related to the Code of Conduct issues and/or any other issues identified in the Audit Committee Investigation. If so, tell us how that impacted your assessment of whether you identified any control deficiencies, including with regards to the COSO components outside of control activities. • Describe further the clarifications and enhancements made to the Code of Conduct and related policies. As part of your response, clarify whether other control deficiencies were identified as part of the process of making these enhancements. If so, please explain how these control deficiencies were considered in aggregation with the other existing control deficiencies.

The entirety of the Company’s response to the Staff’s comment 4 is set forth in Section 3 of Attachment A, which has been provided to the Staff under separate cover. Confidential treatment has been requested for Attachment A pursuant to Read in the reply ↗

We note your response to prior comment 6. Considering the majority of the arrangements that include a license and interrelated deliverables are term-based licenses that are recognized over the contract term, please revise the table on page 11 to indicate as such.

We acknowledge the Staff’s comment and will revise the table as requested in future filings. Read in the reply ↗

We note your definition and description of the control deficiency in your response to

The entirety of the

Company’s response to the Staff’s comment 1 is set forth in Section 1 of Attachment A, which has been provided to the Staff under separate cover. Confidential treatment has been requested for Attachment A pursuant to

Regulation 200.83 of the Commission (17 C.F.R. §200.83). Read in the reply ↗

In determining the total amount of transactions exposed to this control deficiency, please respond to the following: • Explain further how the criteria used to determine the magnitude of transactions exposed to the control deficiency captures all the conditions discussed in the control deficiency that could, with reasonable possibility, lead to a misstatement of the financial statements.

Rest of the question

• To the extent you used distinct criteria to limit the population of transactions exposed to the control deficiency, please clarify how you determined those criteria were appropriate and would not exclude transactions where there was a reasonable possibility that a misstatement would not have been prevented or detected. Such explanation would exclude management hindsight in considering limiting the magnitude based on the actual results of management’s analysis when those transactions were exposed to the control deficiency based upon the criteria established for the magnitude analysis. 2. To the extent that you only included a portion of the contract value (e.g., only the amount of revenue recognized up-front) in the total magnitude analysis, please tell us how you determined this was appropriate. As part of your response, please describe the controls that were in place to mitigate the risk of a potential misstatement for any remaining portions of the contract value (e.g. amounts deferred).

The entirety of the Company’s response to the Staff’s comment 2 is set forth in Section 2 of Attachment A, which has been provided to the Staff under separate cover. Confidential treatment has been requested for Attachment A pursuant to Regulation 200.83 of the Commission (17 C.F.R. §200.83). Read in the reply ↗

You make several references to “the ongoing impact of changes to [y]our renewal practices” when discussing the decrease in revenue. However, you do not explain what these changes are nor do you quantify the impact.

Rest of the question

Please tell us what these renewal practices relate to; what changes you have made or are making to them; the quantified impact of the changes in the periods presented; as well as whether these changes have impacted your revenue recognition policies for such arrangements. Further, consider expanding your disclosures in future filings to incorporate this information. Refer to Section III.B of SEC Release No. 338350.

We supplementally advise the

Staff that the phrase “ongoing changes to our renewal practices” refers to a change in fiscal 2014 to our renewal practices within our consumer security business as part of our then-previously disclosed decision to redesign our go-to-market strategy, and the ongoing impact of that change in renewal practices on our consumer security revenue.

Rest of the answer

Beginning in fiscal 2014, we built a renewals group to focus on extending the customer relationship and make it easier to renew and do business with us and in connection with that effort, we eliminated the auto-renewal option with respect to our consumer subscription model for our

Norton-branded services. As a result of this change to the consumer subscription model, subscribers were thereafter required to affirmatively renew their subscriptions with us. We believe this change in our renewal practices contributed to the previously-reported declines to our consumer security revenue in each of the last eight fiscal quarters and three fiscal years. While we believe our renewals data to be sufficiently reliable to provide the qualitative discussion we have provided in the reports we file with the Commission, we do not believe that such data lends itself to being prepared with sufficient precision to be quantified in such reports or in our response to the Staff’s comment. As disclosed on page 9, our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their level of satisfaction with our solutions or our customer support, customer budgets and the pricing of our solutions compared with the solutions offered by our competitors. As such, we are unable to precisely isolate the impact of the change in our renewals practices from the other factors that may have contributed to the decline in our consumer security revenue from period to period.

We also supplementally advise the Staff that the change in our renewals practices has not impacted our revenue recognition policies.

In light of the Staff’s comment, to the extent the same factor is contributing to a decrease in our consumer security revenue, in future filings we will revise the phrase noted in the Staff’s comment to make it clear that we are referring to the ongoing impact of changes previously implemented and will expand our disclosure of this factor as appropriate to enhance a reader’s understanding of the changes in our results of operations.

Read in the reply ↗

You reference multiple factors underlying a variance in cost of revenues: however, you do not quantify the relative contribution of each factor to the extent material. For example, in your discussion of cost of revenues, you state that the decrease is “due to favorable currency effects, a decrease in OEM royalty fees, and a decrease in service related and content delivery expenses,” without providing quantification.

Rest of the question

Please tell us what consideration was given to Section III.D of SEC Release No. 33-6835.

We respectfully advise the Staff that we considered Section III.D of SEC Release No. 33-6835 in our discussion of the variance in cost of revenue, including the quantification of the underlying factors of individual subaccounts. Because our cost of revenues for the periods presented include unallocated corporate charges which, due to cost and system limitations, have not been historically allocated to individual subaccounts, it was not practical nor could we, with a high level precision, determine the specific dollar value or percentage variance for each subaccount of cost of revenue

Rest of the answer

including the unallocated charges.

Accordingly, for the periods presented we identified the most significant subaccount categories impacting the variance in the cost of revenues, which included favorable foreign currency effects, a decrease in OEM royalty fees and a decrease in service related and content delivery expenses. In future periods, we expect unallocated corporate charges to diminish with the completion of the sale of the assets of our information management business enabling us to more precisely quantify cost of revenues and expand our narrative to include material dollar amounts or percentages in future filings.

Read in the reply ↗

We note several news articles discussing patent infringement proceedings initiated against you by Finjan Holdings, Inc. In light of the other specific legal matters you disclose, please tell us what consideration was given to disclosing the nature of this matter as well as an estimate of the possible loss or range of loss or a statement that such an estimate cannot be made (or, if true, a statement that the estimate

Rest of the question

is immaterial in lieu of providing quantified amounts). Refer to ASC 450-20-50-4.

We respectfully advise the Staff that we determine the accounting and disclosures for commitments and contingencies with respect to legal proceedings in accordance with the applicable accounting guidance, including ASC 450-20. We note that ASC 450-20-50-3 indicates that “disclosure of the contingency shall be made if there is at least a reasonable possibility that a loss or an additional loss may have been incurred and either of the following conditions exists (a) an accrual is not made… or (b) an exposure to loss exists in excess of the amount accrued….” ASC 450 defines a “reasonable

Rest of the answer

possibility” as more than remote but less than likely. In addition, ASC 450-20-50-4 requires a disclosure of an estimate of possible loss or range of loss or a statement that such an estimate cannot be made. In all of our outstanding legal matters in which we have not made an accrual, management is unable to estimate a range of reasonably possible loss due to various reasons, including, among others: (1) that the proceedings are in early stages, (2) that there is uncertainty as to the outcome of pending appeals, motions, or settlements, (3) that there are significant factual issues to be resolved, and/or (4) that there are novel legal issues presented. Consequently, pursuant to ASC 450, only a statement that an estimate of the loss cannot be made is required. In connection with the preparation of the audited financial statements that were included in our Annual Report on Form 10-K for the fiscal year ended April 1, 2016, we evaluated the matter to which the Staff refers in its comment and determined that the matter was not material but there was a reasonable possibility that a loss may have been incurred. As such, the Company believed that the following statement on page 63 (Note 7) met the requirements of ASC 450-20-50-4:

“We are involved in a number of other judicial and administrative proceedings that are incidental to our business. Although adverse decisions (or settlements) may occur in one or more of the cases, it is not possible to estimate the possible loss or losses from each of these cases. The final resolution of these lawsuits, individually or in the aggregate, is not expected to have a material adverse effect on our business, results of operations, financial condition or cash flows.”

In future filings, however, we expect to expand disclosure with respect to our legal matters involving Finjan Holdings, Inc. (“Finjan”). In this regard, we note that as a result of our acquisition of Blue Coat, Inc. on August 1, 2016, we inherited legal matters involving Finjan. See pages F-45 and F-46 of Amendment No. 1 to Blue Coat, Inc.’s Registration Statement on Form S-1 (333-211786), filed with the Commission on June 7, 2016.

Read in the reply ↗

We note from disclosure on page 33 that income tax expense in fiscal 2016 was primarily driven by “$1.1 billion of tax expense for providing U.S. taxes on certain undistributed foreign earnings, primarily those attributable to the sale of Veritas.” Please clarify whether the undistributed foreign earnings of Veritas have been excluded from the $3.8 billion of cumulative unremitted earnings of certain foreign

Rest of the question

subsidiaries that you plan to reinvest indefinitely as of April 1, 2016.

We supplementally advise the Staff that the undistributed foreign earnings of Veritas have been excluded from the $3.8 billion of cumulative unremitted earnings of certain foreign subsidiaries that we plan to reinvest indefinitely as of April 1, 2016. In future filings we will revise the disclosure referenced in the Staff’s comment to more clearly express this fact. Read in the reply ↗

You disclose there were no significant changes to your contractual obligations as compared to those as of April 1, 2016. This does not appear to be consistent with the $1 billion in additional debt borrowed during the quarter.

Rest of the question

Please confirm that in future filings your contractual obligations disclosures will contemplate any relevant transactions that occurred in the respective period, consistent with Item 303(b) of Regulation S-K, Instruction 7, as applicable.

We confirm that in future filings we will update our contractual obligations disclosures to disclose the $1 billion borrowed in May 2016 and any relevant transactions that occurred in the respective period, consistent with Item 303(b) of Regulation S-K, Instruction 7, as applicable, including the items described under the caption “Debt” in Note 13 of the Notes to Condensed

Consolidated Financial Statements in our Quarterly Report on Form 10-Q for the quarter ended July 1, 2016.

*****

As requested, the Company acknowledges that (i) it is responsible for the adequacy and accuracy of the

Rest of the answer

disclosure in the filing; (ii) Staff comments or changes to disclosure in respect to Staff comments do not foreclose the Commission from taking any action with respect to the filing; and (iii) it may not assert Staff comments as a defense in any proceeding initiated by the Commission or any person under the federal securities laws of the United States.

Read in the reply ↗

We note your disclose that the initial analysis of actual damages exposure from the government’s investigation of your compliance with certain provision of your GSA contract is approximately $145 million. You also disclose that the government has indicated that they will pursue claims for certain sales in specific states and through reseller GSA Schedule contracts as well as the possibility that the investigation

Rest of the question

could lead to claims or findings of violations of the False Claims Act, which could be material. Your disclosures indicate that your current estimate of the low end of the range of estimated loss from this matter is $25 million. Please tell us and clarify in future filings whether the $25 million recorded contemplates estimated losses from both the investigation of compliance with the contract provisions and possible violations of the False Claims Act. Also tell us whether you believe there is at least a reasonable possibility that a loss may have been incurred in excess of the amount recorded. If there is at least a reasonable possibility that a loss may have been incurred, please disclose in future filings an estimate (or, if true, state that the estimate is immaterial in lieu of providing quantified amounts) of the loss or range of loss or state such an estimate cannot be made. We refer you to ASC 450-20-50. Please note that while we understand that there are uncertainties associated with estimating the amount of reasonably possible losses in excess of accrual, ASC 450-20-50 does not require that the estimate be precise. Similar concerns apply to your Form 10-Q for the quarterly period ended July 4, 2014. Please provide us with your proposed disclosure in your response.

The $25 million accrual referenced in Note 8 contemplates estimated losses from both the investigation of compliance with the terms of the GSA

Schedule contract as well as possible violations of the False Claims Act. In addition, while we believe that there is at least a reasonable possibility that a loss may have been incurred in excess of the accrual recorded, we are unable to provide an estimate of the range of loss.

Rest of the answer

We acknowledge that the estimate need not be precise.

We have set forth below proposed changes to Note 8 from the disclosure contained in our Form 10-Q for the quarterly period ended July 4, 2014 (additions and deletions noted in bold, italicized type).

Proposed Disclosure:

Note

. Commitments and Contingencies

Litigation Contingencies

During the first quarter of fiscal 2013, we were advised by the Commercial Litigation Branch of the Department of Justice’s Civil Division and the Civil Division of the U.S. Attorney’s Office for the District of Columbia that the government is investigating our compliance with certain provisions of our U.S. General Services Administration (“GSA”) Multiple Award Schedule

Contract No. GS-35F-0240T effective January 24, 2007, including provisions relating to pricing, country of origin, accessibility, and the disclosure of commercial sales practices.

As reported on the GSA’s publicly-available database, our total sales under the GSA Schedule contract were approximately $222 million from the period beginning January 2007 and ending September 2012. We have fully cooperated with the government throughout its investigation and in January 2014, representatives of the government indicated that their initial analysis of our actual damages exposure from direct government sales under the GSA schedule is approximately $145 million; since the initial meeting, the government’s analysis of our potential damages exposure relating to direct sales has increased. The government has also indicated they are going to pursue claims for certain sales to New York, California, and Florida as well as sales to the federal government through reseller GSA Schedule contracts, which could significantly increase our potential damages exposure.

In 2012, a sealed civil lawsuit was filed against Symantec related to compliance with the GSA Schedule contract and contracts with California, Florida, and New York. On July 18, 2014, the Court-imposed seal expired, and the government intervened in the lawsuit. Symantec and the government continue to discuss potential resolutions through confidential settlement discussions.

It is possible that the litigation could lead to claims or findings of violations of the False Claims Act, and could be material to our results of operations and cash flows for any period. Resolution of False Claims Act investigations can ultimately result in the payment of somewhere between one and three times the actual damages proven by the government, plus civil penalties in some cases, depending upon a number of factors. Our current estimate of the low end of the range of the probable estimated loss from this matter is $25 million, which we have accrued. This amount contemplates estimated losses from both the investigation of compliance with the terms of the GSA Schedule contract as well as possible violations of the False Claims Act. There is at least a reasonable possibility that a loss may have been incurred in excess of our accrual for this matter, however we are currently unable to determine a [deleted: precise] range of estimated losses resulting from this matter.

*****

As requested, the Company acknowledges that (i) it is responsible for the adequacy and accuracy of the disclosure in the filing; (ii) Staff comments or changes to disclosure in respect to Staff comments do not foreclose the Commission from taking any action with respect to the filing; and (iii) it may not assert Staff comments as a defense in any proceeding initiated by the Commission or any person under the federal securities laws of the United States.

Read in the reply ↗