Disclosure · Form 10-K · fiscal 2026
Nvidia 10-K cybersecurity disclosure (Item 1C), fiscal 2026
Filed February 25, 2026· period ended January 25, 2026· NVDA· CIK 1045810· Updated · filing on sec.gov ↗· company page
Nvidia's Form 10-K for fiscal 2026, filed February 25, 2026, names the Chief Security Officer as its top security role, reporting to the Senior Vice President of Software Engineering, with oversight by the Audit Committee. On CISO Tribune's record, the Chief Security Officer of Nvidia is David Reber Jr. (verified October 11, 2026; record).
What the filing says, in plain English
Who leads security (the top role, as the filing names it)
Chief Security Officer
Reports to
Senior Vice President of Software Engineering
“We have designated a Chief Security Officer, reporting to our Senior Vice President of Software Engineering, to oversee the identification, assessment, and management of material cybersecurity risks .”
Board oversight
Audit Committee
“The Audit Committee of the Board, or the Audit Committee, also reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks.”
CISO or other person named
not identified
Frameworks and standards named
ISO/IEC 27001
Where the filing names it
- ISO/IEC 27001: “Our information security management programs generally follow certain processes outlined in frameworks such as the ISO 27001 international standard for information security management and we evaluate and evolve our security measures as appropriate.”
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“Our Chief Security Officer's cybersecurity expertise includes over 18 years of combined government and private sector assignments.”
Material incident
not identified
The section
552 words, Form 10-K filed February 25, 2026 for the period ended January 25, 2026
Read by claude-sonnet-5-5 on October 17, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Nvidia standard industrial classification 3674, Semiconductors & related devices (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Penguin Solutions, Inc.FY 2026, filed October 20, 2026 | Chief Information Officer | not identified | not identified |
| Nextpower Inc.FY 2026, filed May 19, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Netlist IncFY 2025, filed March 19, 2026 | Chief Financial Officer | President and Chief Executive Officer | full board |
| Astera LabsFY 2025, filed February 20, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Enphase Energy, Inc.FY 2025, filed February 17, 2026 | Senior Vice President of Security | not identified | Audit Committee |
| On Semiconductor CorpFY 2025, filed February 9, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Texas Instruments IncFY 2025, filed February 6, 2026 | chief information security officer | chief information officer | not identified |
| Maxlinear, IncFY 2025, filed January 29, 2026 | senior IT executive | not identified | Cybersecurity Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Nvidia's Form 10-K as filed with the SEC on February 25, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity
Risk management and strategy
We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively prevent or reduce the impact of, and reactively address circumstances that arise when, events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. Our information security management programs generally follow certain processes outlined in frameworks such as the ISO 27001 international standard for information security management and we evaluate and evolve our security measures as appropriate. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy.
Identifying, assessing, and managing cybersecurity risk is integrated into our overall risk management systems and processes, and we have in place cybersecurity and data privacy training and policies designed to (a) respond to new requirements in global privacy and cybersecurity laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats.
We also have a vendor risk assessment process consisting of, depending on the nature and sensitivity of the supplier and data they process on our behalf, the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We take steps to review that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors, depending on the nature and sensitivity of the supplier and data they process on our behalf. We routinely assess our high-risk suppliers' conformance to industry standards (e.g., ISO 27001, ISO 28001, and C-TPAT), and we evaluate them for additional information, product, and physical security requirements.
Refer to "Item 1A. Risk factors" in this annual report on Form 10-K for additional information about cybersecurity-related risks.
Governance
Information security matters, including managing and assessing risks from cybersecurity threats, remain under the oversight of the Company's Board of Directors, or the Board. The Audit Committee of the Board, or the Audit Committee, also reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks. The Audit Committee receives regular information security updates from management, including our Chief Security Officer and members of our security team. The Board also receives annual reports on information security matters from our Chief Security Officer and members of our security team.
Our security efforts are managed by a team of executive cybersecurity, IT, engineering, operations, and legal professionals. We have established a cross-functional leadership team, consisting of executive-level leaders, that meets regularly to review cybersecurity matters and evaluate emerging threats. With oversight and guidance provided by the cross-functional leadership team, our information security teams refine our practices to address emerging security risks and changes in regulations. Our executive-level leadership team also participates in cybersecurity incident response efforts by engaging with the incident response team and helping direct the company's response to and assessment of certain cybersecurity incidents.
We have designated a Chief Security Officer, reporting to our Senior Vice President of Software Engineering, to oversee the identification, assessment, and management of material cybersecurity risks . Our Chief Security Officer's cybersecurity expertise includes over 18 years of combined government and private sector assignments.
Earlier filings on record
Fiscal 2025 Form 10-K, filed February 26, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Security Officer
Reports to, as the filing names it
Senior Vice President of Software Engineering
“We have designated a Chief Security Officer that reports to our Senior Vice President of Software Engineering to manage our assessment and management of material risks from cybersecurity threats .”
Board oversight
Audit Committee
“The Audit Committee of the Board, or the Audit Committee, also reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our Chief Security Officer's cybersecurity expertise includes over 17 years of combined government and private sector assignments.”
Material incident
not identified
Read by claude-sonnet-5-5 on October 17, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
Risk management and strategy
We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. Our information security management program generally follows processes outlined in frameworks such as the ISO 27001 international standard for Information Security and we evaluate and evolve our security measures as appropriate. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy.
Identifying, assessing, and managing cybersecurity risk is integrated into our overall risk management systems and processes, and we have in place cybersecurity and data privacy training and policies designed to (a) respond to new requirements in global privacy and cybersecurity laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats.
We also have a vendor risk assessment process consisting of, depending on the nature and sensitivity of the supplier and data they process on our behalf, the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors, depending on the nature and sensitivity of the supplier and data they process on our behalf. We routinely assess our high-risk suppliers' conformance to industry standards (e.g., ISO 27001, ISO 28001, and C-TPAT), and we evaluate them for additional information, product, and physical security requirements.
Refer to "Item 1A. Risk factors" in this annual report on Form 10-K for additional information about cybersecurity-related risks.
Governance
Information security matters, including managing and assessing risks from cybersecurity threats, remain under the oversight of the Company's Board of Directors, or the Board. The Audit Committee of the Board, or the Audit Committee, also reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks. The Audit Committee receives regular information security updates from management, including our Chief Security Officer and members of our security team. The Board also receives annual reports on information security matters from our Chief Security Officer and members of our security team.
Our security efforts are managed by a team of executive cybersecurity, IT, engineering, operations, and legal professionals. We have established a cross-functional leadership team, consisting of executive-level leaders, that meets regularly to review cybersecurity matters and evaluate emerging threats. With oversight and guidance provided by the cross-functional leadership team, our information security teams refine our practices to address emerging security risks and changes in regulations. Our executive-level leadership team also participates in cybersecurity incident response efforts by engaging with the incident response team and helping direct the company's response to and assessment of certain cybersecurity incidents.
We have designated a Chief Security Officer that reports to our Senior Vice President of Software Engineering to manage our assessment and management of material risks from cybersecurity threats . Our Chief Security Officer's cybersecurity expertise includes over 17 years of combined government and private sector assignments.
Fiscal 2024 Form 10-K, filed February 21, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Security Officer
Reports to, as the filing names it
Senior Vice President of Software Engineering
“We have designated a Chief Security Officer that reports to our Senior Vice President of Software Engineering to manage our assessment and management of material risks from cybersecurity threats.”
Board oversight
Audit Committee
“The Audit Committee of the Board, or the Audit Committee, also reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our Chief Security Officer's cybersecurity expertise includes over 17 years of combined government and private sector assignments.”
Material incident
not identified
Read by claude-sonnet-5-5 on October 17, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
Risk management and strategy
We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. Our information security management program generally follows processes outlined in frameworks such as the ISO 27001 international standard for Information Security and we evaluate and evolve our security measures as appropriate. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy.
Identifying, assessing, and managing cybersecurity risk is integrated into our overall risk management systems and processes, and we have in place cybersecurity and data privacy training and policies designed to (a) respond to new requirements in global privacy laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats.
We also have a vendor risk assessment process consisting of the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors. We routinely assess our high-risk suppliers' conformance to industry standards (e.g., ISO 27001, ISO 28001, and C-TPAT), and we evaluate them for additional information, product, and physical security requirements.
Refer to "Item 1A. Risk factors" in this annual report on Form 10-K for additional information about cybersecurity-related risks.
Governance
Information security matters, including managing and assessing risks from cybersecurity threats, remain under the oversight of the Company's Board of Directors, or the Board. The Audit Committee of the Board, or the Audit Committee, also reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks. The Audit Committee receives regular information security updates from management, including our Chief Security Officer and members of our security team. The Board also receives annual reports on information security matters from our Chief Security Officer and members of our security team.
Our security efforts are managed by a team of executive cybersecurity, IT, engineering, operations, and legal professionals. We have established a cross-functional leadership team, consisting of executive-level leaders, that meets regularly to review cybersecurity matters and evaluate emerging threats. With oversight and guidance provided by the cross-functional leadership team, our information security teams refine our practices to address emerging security risks and changes in regulations. Our executive-level leadership team also participates in cybersecurity incident response efforts by engaging with the incident response team and helping direct the company's response to and assessment of certain cybersecurity incidents.
We have designated a Chief Security Officer that reports to our Senior Vice President of Software Engineering to manage our assessment and management of material risks from cybersecurity threats. Our Chief Security Officer's cybersecurity expertise includes over 17 years of combined government and private sector assignments.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.