Disclosure · Form 10-K · fiscal 2025
Cognizant Technology Solutions Corp 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 12, 2026· period ended December 31, 2025· CTSH· CIK 1058290· Updated · filing on sec.gov ↗
Cognizant Technology Solutions Corp's Form 10-K for fiscal 2025, filed February 12, 2026, names the CSO as its top security role, reporting to the Cognizant's CLO, with oversight by the Audit Committee.
What the filing says, in plain English
Who leads security (the top role, as the filing names it)
CSO
Reports to
Cognizant's CLO
“The CSO reports to Cognizant's CLO.”
Board oversight
Audit Committee
“Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee, which is responsible for reviewing that management has processes in place designed to identify and evaluate cybersecurity risks and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.”
How often the board or committee hears about it
Quarterly
“On a quarterly basis, the CSO and CIO provide updates to the Audit Committee on, among other things, key cybersecurity metrics, status of projects to strengthen the Company's information security systems and assessments of the Company's security program.”
CISO or other person named
not identified
Frameworks and standards named
NIST Cybersecurity Framework, NIST SP 800-53, ISO/IEC 27001
Where the filing names them
- NIST Cybersecurity Framework: “Cognizant considers the NIST Cybersecurity Framework (CSF 2.0) in designing our cybersecurity program and engages an independent third party to assess program maturity.”
- NIST SP 800-53: “Cognizant's cybersecurity risk management program is guided by industry-recognized security frameworks, including NIST SP 800-37 (Risk Management Framework), NIST SP 800-30 (Risk Assessment Guide), and NIST SP 800-53 (Security and Privacy Controls).”
- ISO/IEC 27001: “In addition, Cognizant maintains global and regional information security certifications such as ISO 27001, UK Cyber Essentials Plus, and ENS, which collectively help demonstrate Cognizant's commitment to a robust, independently validated security program.”
Outside assessors, consultants or testers
Described
“Additionally, we also engage third-party cybersecurity experts to conduct penetration testing among other items.”
Experience of the security leadership, as stated
Stated
“Our cyber risk assessment program is managed by our Corporate Security team, which is led by our CSO, who has over 25 years of experience in the cybersecurity and technology industry.”
Material incident
The filing states none
“In 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.”
The section
704 words, Form 10-K filed February 12, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 20, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Cognizant Technology Solutions Corp standard industrial classification 7371, Services-computer programming services (SEC SIC list). 2 other filers in our library have the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Technology).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| ZscalerFY 2026, filed September 3, 2026 | chief security officer | not identified | audit committee of the board of directors |
| EPAM Systems, Inc.FY 2025, filed February 26, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| ReposiTrak, Inc.FY 2026, filed September 28, 2026 | not identified | not identified | Audit Committee |
| DONALDSON Co IncFY 2026, filed September 25, 2026 | Chief Information Officer | not identified | audit committee |
| EGAIN CorpFY 2026, filed September 10, 2026 | Chief Information Security Officer | Chief Financial Officer | Audit Committee |
| Palo Alto NetworksFY 2026, filed September 10, 2026 | chief information security officer | not identified | Security Committee |
| Twin Disc IncFY 2026, filed September 4, 2026 | not identified | not identified | Audit Committee of the Board of Directors |
| CiscoFY 2026, filed September 2, 2026 | Chief Security and Trust Officer | Executive Vice President, Operations | Audit Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Cognizant Technology Solutions Corp's Form 10-K as filed with the SEC on February 12, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C . Cybersecurity
Risk Management and Strategy
Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program, which is managed by Cognizant's Corporate Security team, is designed to identify, assess and manage risks from cybersecurity threats and provides a framework for handling cybersecurity threats and incidents. The program is also aligned with the risk assessment framework established by the enterprise risk management team.
Our cybersecurity risk management framework includes steps for assessing the severity of a cybersecurity threat (including an escalation process for potentially material cybersecurity threats and incidents to an internal committee comprised of members of senior management), identifying the source of a cybersecurity threat (including whether the cybersecurity threat is associated with a third-party service provider), implementing cybersecurity countermeasures and mitigation strategies. The internal committee is responsible for assessing the materiality of cybersecurity threats and incidents and informs designated members of executive leadership and of the Board of Directors of material cybersecurity threats and incidents.
Cognizant's cybersecurity risk management program is guided by industry-recognized security frameworks, including NIST SP 800-37 (Risk Management Framework), NIST SP 800-30 (Risk Assessment Guide), and NIST SP 800-53 (Security and Privacy Controls). In addition, Cognizant maintains global and regional information security certifications such as ISO 27001, UK Cyber Essentials Plus, and ENS, which collectively help demonstrate Cognizant's commitment to a robust, independently validated security program. Cognizant considers the NIST Cybersecurity Framework (CSF 2.0) in designing our cybersecurity program and engages an independent third party to assess program maturity. Additionally, we also engage third-party cybersecurity experts to conduct penetration testing among other items. Key findings from the third-party assessments are
Cognizant
December 31, 2025 Form 10-K
summarized and communicated to the Company's senior leadership and the Audit Committee, and remediation actions are implemented to enhance our overall cybersecurity program.
We require our vendors to comply with privacy and cybersecurity requirements, and we perform risk assessments of vendors, including their ability to protect data from unauthorized access. We include data protection and security content as part of annual training required of employees.
In 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For further discussion of the cybersecurity risks and threats we face, please see Item 1A. "Risk Factors" .
Governance
As part of our overall enterprise risk management program, we prioritize the identification and management of cybersecurity risk at several levels. Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee, which is responsible for reviewing that management has processes in place designed to identify and evaluate cybersecurity risks and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.
Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.
Our cyber risk assessment program is managed by our Corporate Security team, which is led by our CSO, who has over 25 years of experience in the cybersecurity and technology industry. The CSO reports to Cognizant's CLO. The CSO manages multiple teams within Corporate Security that are operationally responsible for the security of the Company, including Global Cyber Operations, Business Information Security, Global Business Resilience, Integrated Risk Management and Security Architecture (including AI Security), each of which provides regular updates to the CSO regarding cyber threat intelligence, cyber incidents and cyber risk metrics as part of their security responsibilities. The CSO works closely with the CIO, who is responsible for Cognizant's information technology and digital transformation strategy. Together, the CSO and CIO have a mutual set of responsibilities to align, implement and govern security policies, standards and technology controls throughout the enterprise. On a quarterly basis, the CSO and CIO provide updates to the Audit Committee on, among other things, key cybersecurity metrics, status of projects to strengthen the Company's information security systems and assessments of the Company's security program. The Audit Committee reports to the Board of Directors, which also receives periodic updates on such matters.
Earlier filings on record
Fiscal 2024 Form 10-K, filed February 12, 2025 sec.gov ↗
Top security role, as the filing names it
CSO
Reports to, as the filing names it
Cognizant's Executive Vice President, Chief Legal Officer, Chief Administrative Officer and Corporate Secretary
“The CSO reports to Cognizant's Executive Vice President, Chief Legal Officer, Chief Administrative Officer and Corporate Secretary.”
Board oversight
Audit Committee
“Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee, which is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our cyber risk assessment program is managed by our Corporate Security team, which is led by our CSO, who has over 25 years of experience in the cybersecurity and technology industry.”
Material incident
The filing states none
“In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 20, 2026; every quote verified in the stored text by code.
Item 1C . Cybersecurity
Risk Management and Strategy
Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program, which is managed by Cognizant's Corporate Security team, is designed to identify, assess and manage risks from cybersecurity threats and provides a framework for handling cybersecurity threats and incidents. The program is also aligned with the risk assessment framework established by the enterprise risk management team.
Our cybersecurity risk management framework includes steps for assessing the severity of a cybersecurity threat (including an escalation process for potentially material cybersecurity threats and incidents to an internal committee comprised of members of senior management), identifying the source of a cybersecurity threat (including whether the cybersecurity threat is associated with a third-party service provider), implementing cybersecurity countermeasures and mitigation strategies. The internal committee is responsible for assessing the materiality of cybersecurity threats and incidents and informs designated members of executive leadership and of the Board of Directors of material cybersecurity threats and incidents.
Cognizant's cybersecurity risk management program is guided by industry-recognized security frameworks, including ISO/IEC 27001, TISAX and NIST. The program is periodically audited as part of external certification audits. We also engage third-party cybersecurity experts to assist with risk assessment and conduct penetration testing among other items. Key findings from the audits and third-party risk assessments are summarized and communicated to the Company's senior leadership and the Audit Committee, and remediation actions are implemented to enhance our overall cybersecurity program.
We require our vendors to comply with privacy and cybersecurity requirements, and we perform risk assessments of vendors, including their ability to protect data from unauthorized access. We include data protection and security content as part of annual training required of employees.
In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For further discussion of the cybersecurity risks and threats we face, please see Item 1A. "Risk Factors" .
Governance
As part of our overall enterprise risk management program, we prioritize the identification and management of cybersecurity risk at several levels. Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee, which is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.
Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.
Cognizant
December 31, 2024 Form 10-K
Our cyber risk assessment program is managed by our Corporate Security team, which is led by our CSO, who has over 25 years of experience in the cybersecurity and technology industry. The CSO reports to Cognizant's Executive Vice President, Chief Legal Officer, Chief Administrative Officer and Corporate Secretary. The CSO manages multiple teams within Corporate Security that are operationally responsible for the security of the Company, including Global Cyber Operations, Business Information Security, Global Business Resilience and Integrated Risk Management, each of which provides regular updates to the CSO regarding cyber threat intelligence, cyber incidents and cyber risk metrics as part of their security responsibilities. The CSO works closely with the CIO, who is responsible for Cognizant's information technology and digital transformation strategy. Together, the CSO and CIO have a mutual set of responsibilities to align, implement and govern security policies, standards and technology controls throughout the enterprise. On a periodic basis, the CSO and CIO provide updates to the Audit Committee on, among other things, key cybersecurity metrics, status of projects to strengthen the Company's information security systems and assessments of the Company's security program. The Audit Committee reports to the Board of Directors, which also receives periodic updates on such matters.
Fiscal 2023 Form 10-K, filed February 14, 2024 sec.gov ↗
Top security role, as the filing names it
CSO
Reports to, as the filing names it
Cognizant's Executive Vice President, General Counsel, Chief Corporate Affairs Officer and Secretary
“The CSO reports to Cognizant's Executive Vice President, General Counsel, Chief Corporate Affairs Officer and Secretary.”
Board oversight
Audit Committee
“Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee, which is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our cyber risk assessment program is managed by our Corporate Security team, which is led by our CSO, who has over 25 years of experience in the cybersecurity and technology industry.”
Material incident
The filing states none
“In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 20, 2026; every quote verified in the stored text by code.
Item 1C . Cybersecurity
Risk Management and Strategy
Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program, which is managed by Cognizant's Corporate Security team, is designed to identify, assess and manage risks from cybersecurity threats and provides a framework for handling cybersecurity threats and incidents. The program is also aligned with the risk assessment framework that has been established by the enterprise risk management team.
Our cybersecurity risk management framework includes steps for assessing the severity of a cybersecurity threat (including an escalation process for potentially material cybersecurity threats and incidents to an internal committee comprised of members of senior management), identifying the source of a cybersecurity threat (including whether the cybersecurity threat is associated with a third-party service provider), implementing cybersecurity countermeasures and mitigation strategies. The internal committee is responsible for assessing the materiality of cybersecurity threats and incidents and informs designated members of executive leadership and of the Board of Directors of material cybersecurity threats and incidents.
Cognizant's cyber risk management program is periodically audited as part of external certification audits. We also engage third-party cybersecurity experts to assist with risk assessment and conduct penetration testing among other items. Key findings from the audits and third-party risk assessments are summarized and communicated to the Company's senior leadership and the Audit Committee, and remediation actions are implemented to enhance our overall cybersecurity program.
We require our vendors to comply with privacy and cybersecurity requirements, and we perform risk assessments of vendors, including their ability to protect data from unauthorized access. We include data protection and security content as part of annual training required of employees.
In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. In 2020, we experienced a previously-disclosed cybersecurity incident that resulted in unauthorized access to certain data and caused significant disruptions to our business operations. In response, we engaged leading outside forensics and cybersecurity experts, launched a comprehensive containment and remediation effort and forensic investigation, restored the security of our internal systems and networks and adopted various enhancements to the security of our systems and networks.
Governance
As part of our overall enterprise risk management program, we prioritize the identification and management of cybersecurity risk at several levels. Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee, which is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee previously utilized an IT Cybersecurity Subcommittee, comprised of members of the Audit Committee, to assist in carrying out a portion of these responsibilities. In December 2023, the Audit Committee transitioned away from use of the subcommittee structure. At all times, the full Audit Committee has maintained and continues to maintain oversight responsibility for cybersecurity risk management .
Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.
Our cyber risk assessment program is managed by our Corporate Security team, which is led by our CSO, who has over 25 years of experience in the cybersecurity and technology industry. The CSO reports to Cognizant's Executive Vice President, General Counsel, Chief Corporate Affairs Officer and Secretary. The CSO manages multiple teams within Corporate Security that are operationally responsible for the security of the Company, including Global Cyber Operations, Business Information Security, Global Business Resilience and Integrated Risk Management, each of which provides regular updates to the CSO regarding cyber threat intelligence, cyber incidents and cyber risk metrics as part of their security responsibilities. The CSO works closely with the CIO, who is responsible for Cognizant's information technology and digital transformation strategy. Together, the CSO and CIO have a mutual set of responsibilities to align, implement, and govern security policies, standards, and technology controls throughout the enterprise. On a periodic basis, the CSO and CIO provide updates to the Audit Committee on, among other things, key cybersecurity metrics, status of projects to strengthen the Company's information security systems and assessments of the Company's security program. The Audit Committee reports to the Board of Directors, which also receives periodic updates on such matters.
Cognizant
December 31, 2023 Form 10-K
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.