2.02 Item 1C names the Chief Information Officer as jointly responsible for cybersecurity but describes the expertise of only the Vice President, Information Security
Company D · a US-listed cloud communications software company · SEC-style question
In brief
Item 1C says the Chief Information Officer (CIO) and the Vice President, Information Security lead the information security organization and oversee the program, and that the CIO gives the board quarterly cybersecurity updates. It describes the Vice President's 25 years of experience but says nothing of the CIO's cybersecurity expertise, or of the Executive Security Committee members'. The rule asks for the relevant expertise of the persons responsible. The prior-year 10-K used the same text.
The evidence, as filed
1 further page extract: screenshot withheld to protect the company’s identity. The rows below say what each shows.
What the filing shows, and what the rule requires
| What the filing shows | What the rule requires |
|---|---|
Two management positions named as responsible; expertise given for one (Vice President, Information Security: over 25 years of industry experience); none for the CIO or the Executive Security Committee | The relevant cybersecurity expertise of each position named as responsible (prior experience, degrees or certifications, other background), or a statement that the CIO's role is oversight only with the Vice President responsible for assessing and managing the risks |
The rule
Regulation S-K Item 106(c)(2)(i)
Whether and which management positions or committees are responsible for assessing and managing such risks, and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of the expertise;
Version: Text in force at the date of this review · Source: Regulation S-K, 17 CFR 229.106(c)(2)(i), as adopted by Release 33-11216
Regulation S-K Item 106, Instruction 2 to paragraph (c)
Relevant expertise of management in Item 106(c)(2)(i) may include, for example: Prior work experience in cybersecurity; any relevant degrees or certifications; any knowledge, skills, or other background in cybersecurity.
Version: Text in force at the date of this review · Source: Regulation S-K, 17 CFR 229.106, Instruction 2 to paragraph (c), as adopted by Release 33-11216
Why it applies here. once the 10-K names the CIO as one of the two persons responsible, the item reads as asking for that person's expertise too; the staff's Item 1C comments since 2024 have asked registrants to describe the expertise of each person named.
Why it matters
Item 1C does not fully describe the expertise of the persons it names as responsible; Item 1C was a staff comment theme in the first two years of the rule.
Exposure
A question for management; if the staff reviews the filing, a comment and a future-filings undertaking are the realistic outcome
Our workings
the governance paragraph names both positions as leading the organization and responsible for overseeing the program, names the CIO as the source of the board's quarterly updates, and gives experience for the Vice President only; the whole 10-K mentions the CIO elsewhere only in the Item 9B trading-plan table, by name and title. The rule asks whether and which management positions or committees are responsible for assessing and managing cybersecurity risks, and the relevant expertise of such persons or members in such detail as necessary to fully describe it; the instruction lists prior cybersecurity experience, degrees or certifications and other background as examples.
Management’s best defense, and our reply
Management would say the Vice President, Information Security runs the program day to day and that position's expertise is given; the CIO is a senior executive in an oversight role, and the instruction lists examples, not a checklist for every executive. It could add that Item 106 is principles-based and the staff has not commented on its filings. However, the 10-K itself names the CIO as one of the two persons responsible and as the board's quarterly source, so the reading that the item asks for the CIO's expertise is the natural one; whether the CIO's role is oversight only is something only management can say.
The fix
- Add one sentence: 'Our CIO has [n] years of experience leading technology and security operations, including [roles / certifications].' Or state that the Vice President, Information Security is the position responsible for assessing and managing cybersecurity risk, with the CIO in an oversight role.
Question for the company
What is the CIO's relevant cybersecurity expertise (and that of the Executive Security Committee), and does the company read Item 106(c)(2)(i) as requiring it for each position it names as responsible, or is the CIO's role oversight only?
Evidence relied on
| # | What it shows | Type | Where |
|---|---|---|---|
| 1 | the CIO reports to the board each quarter | Document | Form 10-K 2025, page 57 |
| 2 | both positions named as responsible | Document | Form 10-K 2025, page 57 |
| 3 | expertise given for the Vice President only | Document | Form 10-K 2025, page 57 |
| 4 | management committee named; members' expertise not given | Document | Form 10-K 2025, page 57 |
Absence check
- Document
- Form 10-K 2025
- Where it would appear
- Our CIO and our Vice President, Information Security lead
- What is missing
- the relevant cybersecurity expertise of the Chief Information Officer and of the Executive Security Committee members
- Pages looked at
- p.56-58 (Item 1C) and p.126 (Item 9B)
- Result
- 'Chief Information Officer' hits p.57 (this section, role only) and p.126 (Item 9B trading-plan table, name and title only); 'CIO' hits p.57 and, inside another word, p.30; 'expertise' hits p.10 (an emergency-services product needing no telephony expertise), p.12 (senior leadership in general) and p.26 (business support systems); 'years of industry experience' hits only p.57, the Vice President's experience. None describes the CIO's or the committee's cybersecurity expertise.
Prepared by Pramanex from the company’s public SEC filings, without the company’s involvement, to show how a 10-K Pre-filing Check reads. The company is not named, and nothing on this page is a statement about any identifiable company. Observations are not an audit, review or other attestation or assurance engagement, and not legal advice. An SEC-style question is a question, not a conclusion.
Want this on your own 10-K, before you file?
Start with three free findings on your latest 10-K, or book a fixed-price 10-K Pre-filing Check.
Your next 10-K will be in draft before the audit is done.
Have it read before you file.
Start with three free findings on your latest 10-K, or book a fixed-price 10-K check. Drafts only under NDA, inside your insider trading policy.