Disclosure · Form 10-K · fiscal 2025
Carriage Services Inc 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 26, 2026· period ended December 31, 2025· CSV· CIK 1016281· Updated · filing on sec.gov ↗
Carriage Services Inc's Form 10-K for fiscal 2025, filed February 26, 2026, names the Chief Information Officer as its top security role, with oversight by the full board.
What Carriage Services' Item 1C says
Carriage Services' Form 10-K for fiscal 2025 places oversight of cybersecurity risk with the Board. The company's Chief Information Officer oversees the implementation and compliance of the cybersecurity program and the mitigation of information security related risks.
Board and management oversight
The company describes multiple levels of oversight as part of its approach to cybersecurity risk management. The reviews include updates from the management team and periodic executive sessions with the Chief Information Officer covering cybersecurity matters such as program developments and identified incidents.
Who leads security
The CIO has more than 25 years of industry experience and over 15 years of experience in designing and implementing cyber threat detection and mitigation strategies. This oversight includes reviewing the enterprise risk register, maintaining processes to manage identified risks and regularly analyzing logs of cybersecurity threats and vulnerabilities. An information technology team at the employee level supports the CIO in implementing the cybersecurity program and internal reporting, security and mitigation functions.
How the company manages cyber risk
The company aligns its cybersecurity approach with the standards of the National Institute of Standards and Technology Cybersecurity Framework. The company maintains continuous cyber threat-detection systems and has an incident response plan with playbooks for addressing and recovering from potential material cyberattacks and breaches of data security. The company's team maintains processes for identifying, assessing and managing material risks, and these processes are integrated into its overall risk management approach. The company requires periodic training covering cybersecurity and information management and conducts regular cybersecurity awareness campaigns.
Third parties and incidents
The company has engaged an external third-party service provider to support its cybersecurity team by continuously monitoring and identifying potential threats. The company conducts periodic network penetration tests performed by an independent third-party. The company has controls to ensure that third-party access to its internal systems adheres to internal cybersecurity safeguards. The company determined that its January 2021 ransomware attack did not have, and is not expected to have, a material impact on its business, operations or financial results.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a board committee as responsible for cybersecurity oversight.
Read from the Form 10-K filed February 26, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Information Officer
Reports to
not identified
Board oversight
Full board
“Our Board oversees and regularly reviews risks to our Company, including cybersecurity, along with related policies and procedures.”
CISO or other person named
not identified
Frameworks and standards named
NIST Cybersecurity Framework, ISO/IEC 27001
Where the filing names them
- NIST Cybersecurity Framework: “We undertake to align our cybersecurity approach, which encompasses both enterprise security and operational security, along with the standards of the National Institute of Standards and Technology Cybersecurity Framework.”
- ISO/IEC 27001: “In addition, our CIO, who has more than 25 years of industry experience and over 15 years of experience in designing and implementing cyber threat detection and mitigation strategies that adhere to NIST and ISO 27001 standards, along with the development, training and controls of effective enterprise cybersecurity programs.”
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“In addition, our CIO, who has more than 25 years of industry experience and over 15 years of experience in designing and implementing cyber threat detection and mitigation strategies that adhere to NIST and ISO 27001 standards, along with the development, training and controls of effective enterprise cybersecurity programs.”
Material incident
The filing states none
“Except with respect to our previously disclosed ransomware attack to our information technology system in January 2021, which we determined, based on our assessment of the information known to us, did not have, nor do we expect it will have, a material impact on our business, operations or financial results, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business operations.”
The section
705 words, Form 10-K filed February 26, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Carriage Services Inc standard industrial classification 7200, Services-personal services (SEC SIC list). One other filer in our library has the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Trade & Services).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| H&R BlockFY 2026, filed August 14, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| VIP Play, Inc.FY 2026, filed September 29, 2026 | Chief Technology Officer | not identified | full board |
| GenFlat Holdings, Inc.FY 2026, filed September 25, 2026 | Chief Executive Officer and Chief Financial Officer | not identified | full board |
| Stitch Fix, Inc.FY 2026, filed September 24, 2026 | Chief Information Security Officer | Chief Product and Technology Officer | Audit Committee |
| CreditRiskMonitor Com IncFY 2025, filed August 19, 2026 | Chief Technology Officer | not identified | Audit Committee |
| Caro Holdings Inc.FY 2026, filed July 15, 2026 | not identified | not identified | not identified |
| Barnes & Noble Education, Inc.FY 2026, filed July 9, 2026 | Chief Information Security Officer | Chief Information Officer | Audit Committee |
| Addentax Group Corp.FY 2026, filed June 29, 2026 | Chief Financial Officer | not identified | audit committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Carriage Services Inc's Form 10-K as filed with the SEC on February 26, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. CYBERSECURITY
RISK MANAGEMENT AND STRATEGY
The Company's cybersecurity program is designed to secure the continuity of operations and protect the privacy of company, employee and customer data. Our approach to managing cybersecurity risk and safeguarding information across our organization embeds data protection and cybersecurity risk management throughout our enterprise and daily operations. Our team maintains processes for identifying, assessing and managing material risks, including such risks from cybersecurity threats, and such processes are integrated into our overall risk management approach. Our team regularly reviews significant risks to our Company, including significant cybersecurity risks and the potential for future cybersecurity incidences. Through these reviews, we discuss the identified risks, describe the likelihood of occurrence and assess its potential impact, including the materiality thereof. As part of this exercise, mitigating measures are planned and implemented into action as necessary. As an additional feature of our cybersecurity risk management process, we have engaged an external third-party service provider to support our cybersecurity team, continuously monitoring and identifying potential threats with the ability to take immediate mitigation actions when required. In addition to these services, we conduct periodic network penetration tests conducted by an independent third-party.
We undertake to align our cybersecurity approach, which encompasses both enterprise security and operational security, along with the standards of the National Institute of Standards and Technology Cybersecurity Framework. We maintain continuous cyber threat-detection systems and have established an incident response plan, which contains playbooks for addressing and recovering from potential material cyberattacks and breaches of data security. We also have controls in place to ensure any third-party access to our internal systems adhere to internal cybersecurity safeguards, as well as firewalling any
access from such third-parties, including service providers, through a secure virtualization layer. In addition to security measures for third-party service providers, we require periodic training covering cybersecurity and information management and conduct regular cybersecurity awareness campaigns.
Except with respect to our previously disclosed ransomware attack to our information technology system in January 2021, which we determined, based on our assessment of the information known to us, did not have, nor do we expect it will have, a material impact on our business, operations or financial results, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business operations. Given the rapid evolution of cyber-related attack techniques, cybersecurity risks associated with our information technology systems and the systems of our vendors continue to grow. Notwithstanding our cybersecurity management processes, a future cybersecurity incident could have a material adverse effect on our business or on our financial position, results of operations or cash flows. See "Item 1A. Risk Factors - General Risks – Information Technology and Internal Controls - We rely significantly on information technology and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents could harm our ability to operate our business effectively."
GOVERNANCE
We involve multiple levels of oversight as a part of our approach to cybersecurity risk management. Our Board oversees and regularly reviews risks to our Company, including cybersecurity, along with related policies and procedures. These reviews include updates from our management team and periodic executive sessions with our Chief Information Officer ("CIO") covering cybersecurity matters, such as developments to our program, key risk indicators, emerging risks, and identified incidents.
In addition, our CIO, who has more than 25 years of industry experience and over 15 years of experience in designing and implementing cyber threat detection and mitigation strategies that adhere to NIST and ISO 27001 standards, along with the development, training and controls of effective enterprise cybersecurity programs. Additionally, our CIO oversees the implementation and compliance of our cybersecurity program and mitigation of information security related risks. Such oversight includes: (i) reviewing our enterprise risk register; (ii) maintaining adequate processes to manage the identified risks under our cybersecurity program; (iii) regularly analyzing logs of cybersecurity threats and vulnerabilities; and (iv) overseeing prevention, detection, mitigation and remediation efforts in general, including the development and maintenance of the above-mentioned incident response plan. We also maintain an experienced information technology team at the employee level that supports our CIO in implementing our cybersecurity program and internal reporting, security and mitigation functions.
Earlier filings on record
Fiscal 2024 Form 10-K, filed February 28, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Information Officer
Reports to, as the filing names it
not identified
Board oversight
Full board
“Our Board oversees and regularly reviews risks to our Company, including cybersecurity, along with related policies and procedures.”
Person named in the filing
not identified
Experience, as stated
Stated
“In addition, our CIO, who has more than 25 years of industry experience and over 15 years of experience in designing and implementing cyber threat detection and mitigation strategies that adhere to NIST and ISO 27001 standards, along with the development, training and controls of effective enterprise cybersecurity programs.”
Material incident
The filing states none
“Except with respect to our previously disclosed ransomware attack to our information technology system in January 2021, which we determined, based on our assessment of the information known to us, did not have, nor do we expect it will have, a material impact on our business, operations or financial results, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business operations.”
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
RISK MANAGEMENT AND STRATEGY
The Company's cybersecurity program is designed to secure the continuity of operations and protect the privacy of company, employee and customer data. Our approach to managing cybersecurity risk and safeguarding information across our organization embeds data protection and cybersecurity risk management throughout our enterprise and daily operations. Our team maintains processes for identifying, assessing and managing material risks, including such risks from cybersecurity threats, and such processes are integrated into our overall risk management approach. Our team regularly reviews significant risks to our Company, including significant cybersecurity risks and the potential for future cybersecurity incidences. Through these reviews, we discuss the identified risks, describe the likelihood of occurrence and assess its potential impact, including the materiality thereof. As part of this exercise, mitigating measures are planned and implemented into action as necessary. As an additional feature of our cybersecurity risk management process, we have engaged an external third-party service provider to support our cybersecurity team, continuously monitoring and identifying potential threats with the ability to take immediate mitigation actions when required. In addition to these services, we conduct periodic network penetration tests conducted by an independent third-party.
We undertake to align our cybersecurity approach, which encompasses both enterprise security and operational security, along with the standards of the National Institute of Standards and Technology Cybersecurity Framework. We maintain continuous cyber threat-detection systems and have established an incident response plan, which contains playbooks for addressing and recovering from potential material cyberattacks and breaches of data security. We also have controls in place to ensure any third-party access to our internal systems adhere to internal cybersecurity safeguards, as well as firewalling any access from such third-parties, including service providers, through a secure virtualization layer. In addition to security measures for third-party service providers, we require periodic training covering cybersecurity and information management and conduct regular cybersecurity awareness campaigns.
Except with respect to our previously disclosed ransomware attack to our information technology system in January 2021, which we determined, based on our assessment of the information known to us, did not have, nor do we expect it will have, a material impact on our business, operations or financial results, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business operations. Given the rapid evolution of cyber-related attack techniques, cybersecurity risks associated with our information technology systems and the systems of our vendors continue to grow. Notwithstanding our cybersecurity management processes, a future cybersecurity incident could have a material adverse effect on our business or on our financial position, results of operations or cash flows. See "Item 1A. Risk Factors - General Risks – Information Technology and Internal Controls - We rely significantly on information technology and any failure,
inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents could harm our ability to operate our business effectively."
GOVERNANCE
We involve multiple levels of oversight as a part of our approach to cybersecurity risk management. Our Board oversees and regularly reviews risks to our Company, including cybersecurity, along with related policies and procedures. These reviews include updates from our management team and periodic executive sessions with our Chief Information Officer ("CIO") covering cybersecurity matters, such as developments to our program, key risk indicators, emerging risks, and identified incidents.
In addition, our CIO, who has more than 25 years of industry experience and over 15 years of experience in designing and implementing cyber threat detection and mitigation strategies that adhere to NIST and ISO 27001 standards, along with the development, training and controls of effective enterprise cybersecurity programs. Additionally, our CIO oversees the implementation and compliance of our cybersecurity program and mitigation of information security related risks. Such oversight includes: (i) reviewing our enterprise risk register; (ii) maintaining adequate processes to manage the identified risks under our cybersecurity program; (iii) regularly analyzing logs of cybersecurity threats and vulnerabilities; and (iv) overseeing prevention, detection, mitigation and remediation efforts in general, including the development and maintenance of the above-mentioned incident response plan. We also maintain an experienced information technology team at the employee level that supports our CIO in implementing our cybersecurity program and internal reporting, security and mitigation functions.
Fiscal 2023 Form 10-K, filed March 1, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Information Officer
Reports to, as the filing names it
not identified
Board oversight
Full board
“Our Board oversees and regularly reviews risks to our Company, including cybersecurity, along with related policies and procedures.”
Person named in the filing
not identified
Experience, as stated
Stated
“In addition, our CIO, who has more than 25 years of industry experience and over 10 years of experience with the development, training and controls of effective enterprise cybersecurity programs, oversees the implementation and compliance of our cybersecurity program and mitigation of information security related risks.”
Material incident
The filing states none
“Except with respect to our previously disclosed ransomware attack to our information technology system in January 2021, which we determined, based on our assessment of the information known to us, did not have, nor do we expect it will have, a material impact on our business, operations or financial results, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business operations.”
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
RISK MANAGEMENT AND STRATEGY
The Company's cybersecurity program is designed to secure the continuity of operations and protect the privacy of company, employee and customer data. Our approach to managing cybersecurity risk and safeguarding information across our organization embeds data protection and cybersecurity risk management throughout our enterprise and daily operations. Our team maintains processes for identifying, assessing and managing material risks, including such risks from cybersecurity threats, and such processes are integrated into our overall risk management approach. Our team regularly reviews significant risks to our Company, including significant cybersecurity risks and the potential for future cybersecurity incidences. Through these reviews, we discuss the identified risks, describe the likelihood of occurrence and assess its potential impact, including the materiality thereof. As part of this exercise, mitigating measures are planned and implemented into action as necessary. As an additional feature of our cybersecurity risk management process, we have engaged an external third-party service provider to support our cybersecurity team, continuously monitoring and identifying potential threats with the ability to take immediate mitigation actions when required. In addition to these services we conduct periodic network penetration tests conducted by an independent third party.
We undertake to align our cybersecurity approach, which encompasses both enterprise security and operational security, along with the standards of the National Institute of Standards and Technology Cybersecurity Framework. We maintain continuous cyber threat-detection systems and have established an incident response plan, which contains playbooks for addressing and recovering from potential material cyberattacks and breaches of data security. We also have controls in place to ensure any third-party access to our internal systems adhere to internal cybersecurity safeguards, as well as firewalling any access from such third-parties, including service providers, through a secure virtualization layer. In addition to security measures for third-party service providers, we require periodic training covering cybersecurity and information management and conduct regular cybersecurity awareness campaigns.
Except with respect to our previously disclosed ransomware attack to our information technology system in January 2021, which we determined, based on our assessment of the information known to us, did not have, nor do we expect it will have, a material impact on our business, operations or financial results, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business operations. Given the rapid evolution of cyber-related attack techniques, cybersecurity risks associated with our information technology systems and the systems of our vendors continue to grow. Notwithstanding our cybersecurity management processes, a future cybersecurity incident could have a material adverse effect on our business or on our financial position, results of operations or cash flows. See "Item 1A. Risk Factors - General Risks – Information Technology and Internal Controls - We rely significantly on information technology and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents could harm our ability to operate our business effectively."
GOVERNANCE
We involve multiple levels of oversight as a part of our approach to cybersecurity risk management. Our Board oversees and regularly reviews risks to our Company, including cybersecurity, along with related policies and procedures. These reviews include updates from our management team and periodic executive sessions with our Chief Information Officer ("CIO") covering cybersecurity matters, such as developments to our program, key risk indicators, emerging risks, and identified incidents.
In addition, our CIO, who has more than 25 years of industry experience and over 10 years of experience with the development, training and controls of effective enterprise cybersecurity programs, oversees the implementation and compliance of our cybersecurity program and mitigation of information security related risks. Such oversight includes: (i) reviewing our enterprise risk register; (ii) maintaining adequate processes to manage the identified risks under our cybersecurity program; (iii) regularly analyzing logs of cybersecurity threats and vulnerabilities; and (iv) overseeing prevention, detection, mitigation and remediation efforts in general, including the development and maintenance of the above-mentioned incident response plan. Additionally, we maintain an experienced information technology team at the employee level that supports our CIO in implementing our cybersecurity program and internal reporting, security and mitigation functions.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.