Disclosure · Form 10-K · fiscal 2026
Eplus Inc 10-K cybersecurity disclosure (Item 1C), fiscal 2026
Filed May 28, 2026· period ended March 31, 2026· PLUS· CIK 1022408· Updated · filing on sec.gov ↗
Eplus Inc's Form 10-K for fiscal 2026, filed May 28, 2026, names the Senior Director of Information Security as its top security role, reporting to the Chief Information Officer, with oversight by the full board.
What Eplus' Item 1C says
Eplus's Form 10-K for fiscal 2026 places ultimate oversight of cybersecurity risk with the Board, which oversees it as part of the enterprise risk management program. In management, the Senior Director of Information Security oversees the team and reports to the Chief Information Officer.
Board and management oversight
The CIO and SDIS regularly provide reporting on cybersecurity to both the executive management and the Board. The reporting includes updates on information security strategy and organizational structure, key cyber risks and threats, assessments of the cybersecurity program and emerging trends, including the use of AI. Depending on the criticality of a cybersecurity incident and in accordance with the incident response plan, certain matters are required to be reported promptly to the Board, as appropriate.
Who leads security
The SDIS has over 25 years of experience in the field of cybersecurity. The SDIS is responsible for the overall information security and systems resilience strategy, security engineering and operations, cyber threat detection and response, and related policy recommendations.
How the company manages cyber risk
The processes overseen by the information security team are integrated with the enterprise risk management program, including routine reporting to the executive team on cyber risk. The company undergoes routine testing of both the design and operational effectiveness of its security controls, and its internal audit team also audits the program. The cybersecurity program consists of policies, practices and procedures to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection, threat containment and risk assessments. All employees of the company maintain a role in its cybersecurity posture, including required participation in periodic training and risk management exercises throughout the year. The company maintains an incident response plan designed to contain, analyze, remediate, and communicate cybersecurity matters.
Third parties and incidents
The company engages third-party firms to conduct routine external and internal penetration testing of its information systems. The company has policies and procedures to oversee and identify the cybersecurity risks associated with its use of certain third-party service providers. The company maintains cybersecurity insurance coverage to cover certain costs related to the remediation of cybersecurity incidents. As of the date of the report, the company is not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect it.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a board committee as responsible for cybersecurity oversight. The section does not name a specific security framework or standard.
Read from the Form 10-K filed May 28, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Senior Director of Information Security
Reports to
Chief Information Officer
“This team is overseen by our Senior Director of Information Security ("SDIS") who reports to our Chief Information Officer ("CIO").”
Board oversight
Full board
“Our Board has ultimate oversight of our cybersecurity risk, which it oversees as part of our ERM program.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
Described
“Additionally, we engage third-party firms to conduct routine external and internal penetration testing of our information systems to emulate the common tactics and techniques of cyber threat actors, and we have developed processes to remediate identified vulnerabilities across a wide range of severities.”
Experience of the security leadership, as stated
Stated
“The SDIS has over 25 years of experience in the field of cybersecurity and is responsible for our overall information security and systems resilience strategy, security engineering and operations, cyber threat detection and response, and related policy recommendations.”
Material incident
The filing states none
“As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, financial condition, or our brand.”
The section
821 words, Form 10-K filed May 28, 2026 for the period ended March 31, 2026
Read by claude-sonnet-5-5 on October 26, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Eplus Inc standard industrial classification 5045, Wholesale-computers & peripheral equipment & software (SEC SIC list). One other filer in our library has the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Trade & Services).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| TD SYNNEXFY 2025, filed January 27, 2026 | Chief Information Security Officer | Chief Information Officer | Technology Committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| VIP Play, Inc.FY 2026, filed September 29, 2026 | Chief Technology Officer | not identified | full board |
| GenFlat Holdings, Inc.FY 2026, filed September 25, 2026 | Chief Executive Officer and Chief Financial Officer | not identified | full board |
| Stitch Fix, Inc.FY 2026, filed September 24, 2026 | Chief Information Security Officer | Chief Product and Technology Officer | Audit Committee |
| CreditRiskMonitor Com IncFY 2025, filed August 19, 2026 | Chief Technology Officer | not identified | Audit Committee |
| H&R BlockFY 2026, filed August 14, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Caro Holdings Inc.FY 2026, filed July 15, 2026 | not identified | not identified | not identified |
| Barnes & Noble Education, Inc.FY 2026, filed July 9, 2026 | Chief Information Security Officer | Chief Information Officer | Audit Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Eplus Inc's Form 10-K as filed with the SEC on May 28, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C.
CYBERSECURITY
We believe that cybersecurity and business resilience are critical to advancing our corporate vision and enabling our digital transformation efforts. As a technology services provider, we are faced with a multitude of diverse cybersecurity threats that range from common attacks such as ransomware, denial of service, and social engineering to more advanced attacks leveraging sophisticated AI-enabled tools from nation-state actors that might target our ecosystem through our specific company industry verticals. Any such cybersecurity threats could affect our customers, vendors, service providers, subcontractors and/or employees, and a cybersecurity threat to us or any of these entities could materially and adversely affect our business strategy, financial condition, performance, our brand and our results of operations.
We have a dedicated team of information security professionals (our "information security team") who lead our enterprise-wide cybersecurity strategy, which includes risk management, cyber defense, systems security, security monitoring and other related functions. This team is overseen by our Senior Director of Information Security ("SDIS") who reports to our Chief Information Officer ("CIO"). The SDIS has over 25 years of experience in the field of cybersecurity and is responsible for our overall information security and systems resilience strategy, security engineering and operations, cyber threat detection and response, and related policy recommendations. In addition, our SDIS has a significant background in general information technology and program management. Our information security team manages our robust enterprise security structure, which is designed to prevent cybersecurity incidents, while simultaneously increasing our technology resilience to minimize the associated business impact of cybersecurity threats. Core to our information security team's structure is our security incident response team, which is responsible for the protection, detection, global threat level monitoring, and overall response/countermeasure capabilities in defense of our corporate resources and assets. Furthermore, we believe strongly in a supportive and collaborative culture of security, whereby all of our employees maintain a role in our corporate cybersecurity posture, including but not limited to their required participation in periodic training and risk management exercises throughout the year.
The processes overseen by our information security team are integrated with our enterprise risk management ("ERM") program , including routine reporting to our executive team on cyber risk through the different levels of our ERM governance structure including our risk management frameworks and processes. We undergo routine testing of both the design and operational effectiveness of our security controls, consult with industry leaders on best practices, and ensure alignment with relevant industry frameworks and laws, as well as auditing by our internal audit team. Our cybersecurity program consists of policies, practices and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection, threat containment and risk assessments. In addition to our policies and procedures designed to manage and identify cybersecurity risks, we maintain an incident response plan designed to contain, analyze, remediate, and communicate cybersecurity matters to help ensure a timely and appropriate response to cybersecurity incidents.
Additionally, we engage third-party firms to conduct routine external and internal penetration testing of our information systems to emulate the common tactics and techniques of cyber threat actors, and we have developed processes to remediate identified vulnerabilities across a wide range of severities. We have policies and procedures to oversee and identify the cybersecurity risks associated with our use of certain third-party service providers. These policies and procedures include onboarding risk assessments prior to commencing a customer engagement and, as appropriate based on identified risk, may include either cybersecurity-related contractual terms and/or periodic risk assessments throughout the life cycle of the third-party relationship. We maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to the remediation of cybersecurity incidents.
Our Board has ultimate oversight of our cybersecurity risk, which it oversees as part of our ERM program. The CIO and SDIS regularly provide reporting on cybersecurity to both our executive management and our Board. This reporting includes updates on our information security strategy and organizational structure, key cyber risks and threats, progress related to various initiatives designed to protect us from such risks and threats, assessments of our cybersecurity program and emerging trends, including those related to the use of AI as both a threat and a defense mechanism. Depending on the criticality of a cybersecurity incident and in accordance with our incident response plan, certain matters are required to be reported promptly to the Board, as appropriate.
As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, financial condition, or our brand. However, we cannot provide assurance that such threats will not be discovered, occur, or result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, please refer to I tem 1A . "Risk Factors."
Earlier filings on record
Fiscal 2025 Form 10-K, filed May 22, 2025 sec.gov ↗
Top security role, as the filing names it
Senior Director of Information Security
Reports to, as the filing names it
Chief Information Officer
“This team is overseen by our Senior Director of Information Security ("SDIS") who reports to our Chief Information Officer ("CIO").”
Board oversight
Full board
“Our Board has ultimate oversight of our cybersecurity risk, which it oversees as part of our ERM program.”
Person named in the filing
not identified
Experience, as stated
Stated
“The SDIS has over 25 years of experience in the field of cybersecurity and is responsible for our overall business resilience and information security strategy, security engineering and operations, cyber threat detection and response, and policy recommendations.”
Material incident
The filing states none
“As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, financial condition, or our brand.”
Read by claude-sonnet-5-5 on October 26, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
We believe that cybersecurity and business resilience are critical to advancing our corporate vision and enabling our digital transformation efforts. As a technology services provider, we are faced with a multitude of diverse cybersecurity threats that range from common attacks such as ransomware, denial of service, and social engineering to more advanced attacks leveraging sophisticated AI-enabled tools from nation-state actors that might target our ecosystem through specific industry verticals. Any such cybersecurity threats could affect our customers, vendors, service providers, subcontractors and/or employees, and a cybersecurity threat to us or any of these entities could materially adversely affect our business strategy, financial condition, performance, our brand and results of operations.
We have a dedicated team of information security professionals (our "information security team") who lead our enterprise-wide cybersecurity strategy, which includes risk management, cyber defense, systems security, security monitoring and other related functions. This team is overseen by our Senior Director of Information Security ("SDIS") who reports to our Chief Information Officer ("CIO"). The SDIS has over 25 years of experience in the field of cybersecurity and is responsible for our overall business resilience and information security strategy, security engineering and operations, cyber threat detection and response, and policy recommendations. In addition, our SDIS has a significant background in general information technology and program management. Our information security team manages our robust enterprise security structure, which is designed to prevent cybersecurity incidents, while simultaneously increasing our technology resilience to minimize the associated business impact of cybersecurity threats. Core to our information security team's structure is our security incident response team, which is responsible for the protection, detection and overall response capabilities in defense of our corporate resources and assets. Furthermore, we believe strongly in a supportive and collaborative culture of security, whereby all our employees maintain a role in our corporate cybersecurity posture, including but not limited to their participation in periodic training and risk management exercises throughout the year.
The processes overseen by our information security team are integrated with our enterprise risk management ("ERM") program , including routine reporting to our executive team on cyber risk through the different levels of our ERM governance structure including our risk management frameworks and processes. We undergo routine testing of both the design and operational effectiveness of our security controls, consult with industry leaders on best practices, and ensure alignment with relevant industry frameworks and laws, as well as auditing by our internal audit team. Our cybersecurity program consists of policies, practices and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection, threat containment and risk assessments. In addition to our policies and procedures designed to manage and identify cybersecurity risks, we maintain an incident response plan designed to contain, analyze, remediate, and communicate cybersecurity matters to help ensure a timely and appropriate response to cybersecurity incidents.
Additionally, we engage third-party firms to conduct routine external and internal penetration testing of our information systems to emulate the common tactics and techniques of cyber threat actors, and we have developed processes to remediate identified vulnerabilities across a wide range of severities. We have policies and procedures to oversee and identify the cybersecurity risks associated with our use of certain third-party service providers. These policies and procedures include onboarding risk assessments prior to engagement and, as appropriate based on identified risk, may include either cybersecurity-related contractual terms and/or periodic risk assessments throughout the life cycle of the third-party relationship. We maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to the remediation of cybersecurity incidents.
Our Board has ultimate oversight of our cybersecurity risk, which it oversees as part of our ERM program. The CIO and SDIS regularly provide reporting on cybersecurity to both our executive management and our Board. This reporting includes updates on our information security strategy and organizational structure, key cyber risks and threats, progress related to various initiatives designed to protect us from such risks and threats, assessments of our cybersecurity program and emerging trends, including those related to the use of AI as both a threat and a defense mechanism. Depending on the criticality of a cybersecurity incident and in accordance with our incident response plan, certain matters are required to be reported promptly to the Board, as appropriate.
As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, financial condition, or our brand. However, we cannot provide assurance that such threats will not be discovered, occur, or result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, please refer to Item 1A . "Risk Factors."
Fiscal 2024 Form 10-K, filed May 23, 2024 sec.gov ↗
Top security role, as the filing names it
Senior Director of Information Security
Reports to, as the filing names it
Chief Information Officer
“This team is overseen by our Senior Director of Information Security ("SDIS") who reports to our Chief Information Officer ("CIO").”
Board oversight
Full board
“Our Board of Directors has ultimate oversight of our cybersecurity risk, which it oversees as part of our ERM program.”
Person named in the filing
not identified
Experience, as stated
Stated
“The SDIS has over 25 years of experience in the field of cybersecurity and is responsible for our overall business resilience and information security strategy, security engineering and operations, cyber threat detection and response, and policy recommendations.”
Material incident
The filing states none
“As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, financial condition, or our brand.”
Read by claude-sonnet-5-5 on October 26, 2026; every quote verified in the stored text by code.
ITEM 1C.
CYBERSECURITY
We believe that cybersecurity and business resilience are critical to advancing our corporate vision and enabling our digital transformation efforts. As a technology services provider, we are faced with a multitude of
diverse cybersecurity threats that range from common attacks such as ransomware, denial of service, and social engineering to more advanced attacks from nation state actors that might target our ecosystem through specific industry verticals. Any
such cybersecurity threats could affect our customers, vendors, service providers, subcontractors and/or employees, and a cybersecurity threat to us or any of these entities could materially adversely affect our business strategy, financial
condition, performance, our brand and results of operations.
We have a dedicated team of information security professionals (our "information security team") who lead our enterprise-wide cybersecurity strategy, which includes risk management, cyber defense, software security,
security monitoring and other related functions. This team is overseen by our Senior Director of Information Security ("SDIS") who reports to our Chief Information Officer ("CIO"). The SDIS has over 25 years of experience in the field of
cybersecurity and is responsible for our overall business resilience and information security strategy, security engineering and operations, cyber threat detection and response, and policy recommendations. In addition, our SDIS has a significant
background in general information technology and program management. Our information security team manages our robust enterprise security structure, which is designed to prevent cybersecurity incidents, while simultaneously increasing our
technology resilience to minimize the associated business impact of cybersecurity threats. Core to our information security team's structure is our security incident response team, which is responsible for the protection, detection and overall
response capabilities in defense of our corporate resources and assets. Furthermore, we believe strongly in a supportive culture of security, whereby all e Plus employees maintain a role in our corporate
cybersecurity posture, including but not limited to their participation in periodic training and risk management exercises throughout the year.
The processes overseen by our information security team are integrated with our enterprise risk management ("ERM") program, including routine reporting to our executive team on cyber risk through the different levels of
our ERM governance structure including our risk management frameworks and processes. We undergo routine testing of both the design and operational effectiveness of our security controls, consult with industry leaders on best practices, and ensure
alignment with relevant industry frameworks and laws, as well as auditing by our internal audit team. Our cybersecurity program consists of policies, practices and procedures designed to manage material risks from cybersecurity threats, including
training requirements, threat monitoring and detection, threat containment and risk assessments. In addition to our policies and procedures designed to manage and identify cybersecurity risks, we maintain an incident response plan designed to
contain, analyze, remediate, and communicate cybersecurity matters to help ensure a timely and appropriate response to cybersecurity incidents.
Additionally, we engage third-party firms to conduct routine external and internal penetration testing of our information systems to emulate the common tactics and techniques of cyber threat actors and we have developed
processes to remediate identified vulnerabilities across a wide range of severities. We have policies and procedures to oversee and identify the cybersecurity risks associated with our use of certain third-party service providers. These policies
and procedures include onboarding risk assessments prior to engagement and, as appropriate based on identified risk, may include either cybersecurity-related contractual terms and/or periodic risk assessments throughout the life cycle of the
third-party relationship. We maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to the remediation of cybersecurity incidents.
Our Board of Directors has ultimate oversight of our cybersecurity risk, which it oversees as part of our ERM program. The CIO and SDIS regularly provide reporting on cybersecurity to both our executive management and
our Board of Directors. This reporting includes updates on our information security strategy and organizational structure, key cyber risks and threats, progress related to various initiatives designed to protect us from such risks and threats,
assessments of our cybersecurity program and emerging trends. Depending on the criticality of a cybersecurity incident and in accordance with our incident response plan, certain matters are required to be reported promptly to the Board of
Directors, as appropriate.
As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of
operations, financial condition, or our brand. However, we cannot provide assurance that such threats will not result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity,
please refer to Item 1A . "Risk Factors."
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.