2.01 Item 1C names teams, not the management positions responsible for cybersecurity, and gives their expertise only as an average
Company B · a US-listed transportation and logistics company · SEC-style question
In brief
Item 106 of Regulation S-K asks which management positions or committees assess and manage cybersecurity risk and the relevant expertise of those persons. The Form 10-K says the processes are overseen by "leaders from our Information Technology, Compliance, and Legal teams" with "an average of over 15 years" of experience, without naming a position or the expertise of any one person. The Audit Committee update frequency also changed from "quarterly" in the prior year to "periodic" without comment.
The evidence, as filed
Screenshot withheld to protect the company’s identity. Even with names, figures and dates boxed out, the wording on these pages could be searched back to the filer. Pages relied on: Form 10-K 2024 (prior year), page 25; Form 10-K 2025, page 25.
What the filing shows, and what the rule requires
| What the filing shows | What the rule requires |
|---|---|
Responsible management described as leaders of three teams; expertise given as a group average of over 15 years; Audit Committee updates "on a periodic basis" | The positions responsible (for example the head of Information Technology or information security, the compliance head, the General Counsel), each with the relevant expertise Instruction 2 to Item 106(c) describes, and the frequency of Audit Committee reporting |
The rule
Regulation S-K Item 106(c)(2)(i)
Whether and which management positions or committees are responsible for assessing and managing such risks, and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of the expertise
Version: Text in force at the date of this review · Source: 17 CFR 229.106, Regulation S-K Item 106 (Release 33-11216), as in force for fiscal 2025
Regulation S-K Item 106(c)(1)
identify any board committee or subcommittee responsible for the oversight of risks from cybersecurity threats and describe the processes by which the board or such committee is informed about such risks
Version: Text in force at the date of this review · Source: 17 CFR 229.106, Regulation S-K Item 106 (Release 33-11216), as in force for fiscal 2025
Why it applies here. identifying functions rather than positions, and pooling experience into an average, may not tell an investor who is accountable or what any one person's cybersecurity expertise is; SEC staff comments in this area have asked registrants to describe the relevant expertise of each member of management responsible. Whether the disclosure is sufficient depends on the Company's actual structure, which only management can confirm.
Why it matters
A staff comment asking for the positions and the expertise of each responsible manager, with a future-filings undertaking.
Exposure
A question for management; if the staff took the same view the realistic outcome is a comment letter and an undertaking to expand Item 1C in future filings, with no fine.
Our workings
p.25 describes the governance of cybersecurity at team level and states an average of over 15 years of experience across unnamed leaders; the whole Form 10-K has no reference to a Chief Information Officer, Chief Information Security Officer or Chief Technology Officer. The prior-year Form 10-K used the same wording, except that the Audit Committee then received updates on a quarterly basis. Law: Item 106(c)(2)(i) asks whether and which management positions are responsible and their expertise in such detail as necessary to fully describe the nature of the expertise; Instruction 2 gives prior cybersecurity work experience, degrees or certifications as examples.
Management’s best defense, and our reply
Item 106 is principles-based: it asks whether and which positions as applicable, does not require names, and the adopting release declined to mandate specific expertise; naming the Information Technology, Compliance and Legal leadership and their pooled experience arguably answers it, and the staff did not comment on Item 1C when it reviewed the fiscal 2024 Form 10-K in 2025. That defense is tenable, which is why this is a question. However, the answer still needs to show who is accountable and what expertise each person brings, since an average across unnamed people does not let an investor assess either.
The fix
- Add, for example: "Our Vice President of Information Technology, who has [x] years of experience in information security and holds [certification], leads our cybersecurity program and reports to the Audit Committee quarterly ..." and name each other responsible position.
Question for the company
Which management positions are responsible for assessing and managing cybersecurity risk, what is the relevant cybersecurity expertise of each, and how often does the Audit Committee now receive cybersecurity updates (the prior year said quarterly)?
Evidence relied on
| # | What it shows | Type | Where |
|---|---|---|---|
| 1 | responsible management described by team, not by position | Document | Form 10-K 2025, page 25 |
| 2 | expertise given only as a group average | Document | Form 10-K 2025, page 25 |
| 3 | Audit Committee reporting frequency now stated as periodic | Document | Form 10-K 2025, page 25 |
| 4 | prior year stated quarterly updates | Document | Form 10-K 2024 (prior year), page 25 |
Absence check
- Document
- Form 10-K 2025
- Where it would appear
- Cybersecurity is an important part of our risk management processes
- What is missing
- the management positions responsible for cybersecurity risk and each one's relevant expertise
- Pages looked at
- p.47-25 (Item 1C) and the whole Form 10-K text
- Result
- no term hits anywhere in the Form 10-K
Prepared by Pramanex from the company’s public SEC filings, without the company’s involvement, to show how a 10-K Pre-filing Check reads. The company is not named, and nothing on this page is a statement about any identifiable company. Observations are not an audit, review or other attestation or assurance engagement, and not legal advice. An SEC-style question is a question, not a conclusion.
Want this on your own 10-K, before you file?
Start with three free findings on your latest 10-K, or book a fixed-price 10-K Pre-filing Check.
Your next 10-K will be in draft before the audit is done.
Have it read before you file.
Start with three free findings on your latest 10-K, or book a fixed-price 10-K check. Drafts only under NDA, inside your insider trading policy.