Disclosure · Form 10-K · fiscal 2025
Centrus Energy Corp 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 11, 2026· period ended December 31, 2025· LEU· CIK 1065059· Updated · filing on sec.gov ↗
Centrus Energy Corp's Form 10-K for fiscal 2025, filed February 11, 2026, places oversight of cybersecurity risk with the Cyber Risk Committee; a top security role title is not identified.
What Centrus Energy's Item 1C says
Centrus Energy's Form 10-K for fiscal 2025 places board oversight of material cybersecurity risks with the Cyber Risk Committee. The Chief Financial Officer has delegated assessment and management of material cybersecurity risks to management's Cybersecurity Risk Committee.
Board and management oversight
The Board's Cyber Risk Committee oversees the company's cybersecurity policies, procedures, and plans under its charter. The Board's Cyber Risk Committee coordinates with the Audit and Finance Committee and the Board's Technology, Competition and Regulatory Committee on cross disciplinary issues such as cybersecurity. Management's Cybersecurity Risk Committee is comprised of members of senior management, including the Director, Information Technology. Management's Cybersecurity Risk Committee will consider disclosure about a cybersecurity incident, with material issues raised with the Board.
How the company manages cyber risk
Centrus includes the evaluation of cybersecurity risk as part of its enterprise risk management process and provides periodic reporting to the Board. Centrus aligns with the National Institute of Standards and Technology Cybersecurity Framework to evaluate the sufficiency of its cybersecurity posture. The company maintains a cybersecurity incident response plan that is updated regularly.
Third parties and incidents
The assessed risk process includes evaluating risks from cybersecurity threats associated with the company's use of third-party service providers. Centrus periodically has external experts complete assessments of its cybersecurity posture. The filing states that no material effect on business strategy, results of operations or financial condition has occurred or is reasonably expected from cybersecurity threat risks.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed February 11, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
not identified
Reports to
not identified
Board oversight
Cyber Risk Committee
“The Board exercises its oversight of material risks from cybersecurity threats through its Cyber Risk Committee.”
CISO or other person named
not identified
Frameworks and standards named
NIST Cybersecurity Framework
Where the filing names it
- NIST Cybersecurity Framework: “To evaluate the sufficiency of Centrus' cybersecurity posture, Centrus aligns with the National Institute of Standards and Technology Cybersecurity Framework.”
Outside assessors, consultants or testers
Described
“We periodically (i) have external experts complete assessments of Centrus' cybersecurity posture, (ii) complete internal self-assessments and (iii) engage with third-party experts for assistance in monitoring, deterring, detecting, and addressing potential breaches.”
Experience of the security leadership, as stated
not identified
Material incident
The filing states none
“Based on our monitoring and evaluations to date, including any previously identified cybersecurity incidents, there has not been, and there is not reasonably expected to be, a material effect on the Company's business strategy, results of operations or financial condition, as a result of risks from cybersecurity threats.”
The section
479 words, Form 10-K filed February 11, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 26, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Centrus Energy Corp standard industrial classification 1400, Mining & quarrying of nonmetallic minerals (no fuels) (SEC SIC list). 2 other filers in our library have the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Energy & Transportation).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Mag Magna CorpFY 2026, filed October 7, 2026 | not identified | not identified | full board |
| Hecla Mining CoFY 2025, filed February 17, 2026 | not identified | not identified | not identified |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| EON Resources Inc.FY 2025, filed October 13, 2026 | not identified | not identified | full board |
| FedEx Freight Holding Company, Inc.FY 2026, filed August 5, 2026 | Vice President — Chief Information Security Officer | Executive Vice President — Chief Technology Officer | Risk Oversight Committee |
| Ramaco Resources, Inc.FY 2025, filed July 24, 2026 | Vice President of Information Technology and Cybersecurity | not identified | Audit Committee |
| Star Gold Corp.FY 2026, filed July 22, 2026 | CFO | not identified | Audit Committee |
| Royale Energy, Inc.FY 2025, filed July 13, 2026 | not identified | not identified | audit committee |
| NextTrip, Inc.FY 2026, filed May 29, 2026 | not identified | not identified | full board |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Centrus Energy Corp's Form 10-K as filed with the SEC on February 11, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity
Managing cybersecurity risk is critical to Centrus. Centrus expects that the complexity of cybersecurity incidents will continue to evolve. To assess the changing cyber environment, Centrus includes the evaluation of cybersecurity risk as part of its enterprise risk management process and provides periodic reporting to the Board. Assessed risks, whether general or specific to the Company, include operational risk, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy laws and other litigation and legal risk, and reputational risk. This process includes evaluating risks from cybersecurity threats associated with the Company's use of third-party service providers.
To evaluate the sufficiency of Centrus' cybersecurity posture, Centrus aligns with the National Institute of Standards and Technology Cybersecurity Framework. We periodically (i) have external experts complete assessments of Centrus' cybersecurity posture, (ii) complete internal self-assessments and (iii) engage with third-party experts for assistance in monitoring, deterring, detecting, and addressing potential breaches. The results of any internal or external assessment are reported to senior management and the Board.
Based on our monitoring and evaluations to date, including any previously identified cybersecurity incidents, there has not been, and there is not reasonably expected to be, a material effect on the Company's business strategy, results of operations or financial condition, as a result of risks from cybersecurity threats.
Governance
Centrus has policies, procedures, and strategies in place to assist in assessing and managing cybersecurity risks. To help safeguard the Company's network and information maintained on that network, the Company maintains and executes a cybersecurity program designed to monitor, prevent, detect, mitigate, and remediate cyberattacks.
The Board exercises its oversight of material risks from cybersecurity threats through its Cyber Risk Committee. Per its charter, the Board's Cyber Risk Committee oversees the Company's cybersecurity policies, procedures, and plans, including the quality and effectiveness of the related security, confidentiality, availability, recoverability, integrity, and disaster or incident response programs. It coordinates with the Audit and Finance Committee and the Board's Technology, Competition and Regulatory Committee on cross disciplinary issues such as cybersecurity.
The Chief Financial Officer has delegated the assessment and management of material risks from cybersecurity threats to management's Cybersecurity Risk Committee which is comprised of members of senior management, including the Director, Information Technology. Management's Cybersecurity Risk Committee regularly provides those delegating oversight with updates on the Company's cybersecurity program which includes the current cybersecurity risk landscape and efforts employed to assist in preventing those risks, the Company's cybersecurity policies and practices, the ongoing efforts to improve security, as well as the Company's efforts regarding significant cybersecurity events. In addition, the Company maintains a cybersecurity incident response plan, which includes the Company's processes for monitoring, preventing, detecting, mitigating, remediating, and recovery from cybersecurity incidents that is updated regularly. Disclosure with regard to a cybersecurity incident will be considered by management's Cybersecurity Risk Committee, with material issues raised with our Board .
Earlier filings on record
Fiscal 2024 Form 10-K, filed February 7, 2025 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
Cyber Risk Committee
“The Board exercises its oversight of material risks from cybersecurity threats through the Board's newly established Cyber Risk Committee.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“Based on our monitoring and evaluations to date, including any previously identified cybersecurity incidents, there has not been, and there is not reasonably expected to be, a material effect on the Company's business strategy, results of operations or financial condition, as a result of risks from cybersecurity threats.”
Read by claude-sonnet-5-5 on October 26, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
Managing cybersecurity risk is critical to Centrus. Centrus expects that the complexity of cybersecurity incidents will continue to evolve. To assess the changing cyber environment, Centrus includes the evaluation of cybersecurity risk as part of its enterprise risk management process and provides periodic reporting to the Board. Assessed risks, whether general or specific to the Company, include operational risk, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy laws and other litigation and legal risk, and reputational risk. This process includes evaluating risks from cybersecurity threats associated with the Company's use of third-party service providers.
To evaluate the sufficiency of Centrus' cybersecurity posture, Centrus aligns with the National Institute of Standards and Technology Cybersecurity Framework. We periodically (i) have external experts complete assessments of Centrus' cybersecurity posture, (ii) complete internal self-assessments and (iii) engage with third-party experts for assistance in monitoring, deterring, detecting, and addressing potential breaches. The results of any internal or external assessment are reported to senior management and the Board.
Based on our monitoring and evaluations to date, including any previously identified cybersecurity incidents, there has not been, and there is not reasonably expected to be, a material effect on the Company's business strategy, results of operations or financial condition, as a result of risks from cybersecurity threats.
Governance
Centrus has policies, procedures, and strategies in place to assist in assessing and managing cybersecurity risks. To help safeguard the Company's network and information maintained on that network, the Company maintains and executes a cybersecurity program designed to monitor, prevent, detect, mitigate, and remediate cyberattacks.
The Board exercises its oversight of material risks from cybersecurity threats through the Board's newly established Cyber Risk Committee. Per its charter, the Board's Cyber Risk Committee oversees the Company's cybersecurity policies, procedures, and plans, including the quality and effectiveness of the related security, confidentiality, availability, recoverability, integrity, and disaster or incident response programs. It coordinates with the Audit and Finance Committee and the Board's Technology, Competition and Regulatory Committee on cross disciplinary issues such as cybersecurity.
The Chief Financial Officer has delegated the assessment and management of material risks from cybersecurity threats to management's Cybersecurity Risk Committee which is comprised of members of senior management, including the Director, Information Technology. Management's Cybersecurity Risk Committee regularly provides those delegating oversight with updates on the Company's cybersecurity program which includes the current cybersecurity risk landscape and efforts employed to assist in preventing those risks, the Company's cybersecurity policies and practices, the ongoing efforts to improve security, as well as the Company's efforts regarding significant cybersecurity events. In addition, the Company maintains a cybersecurity incident response plan, which includes the Company's processes for monitoring, preventing, detecting, mitigating, remediating, and recovery from cybersecurity incidents that is updated regularly. Disclosure with regard to a cybersecurity incident will be considered by management's Cybersecurity Risk Committee, with material issues raised with our Board .
Fiscal 2023 Form 10-K, filed February 9, 2024 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
Audit and Finance Committee
“The Board exercises its oversight of material risks from cybersecurity threats through the Board's Audit and Finance Committee and the Board's Technology, Competition and Regulatory Committee.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“Based on our monitoring and evaluations to date, including any previously identified cybersecurity incidents, there has not been, and there is not reasonably expected to be, a material effect on the Company's business strategy, results of operations or financial condition, as a result of risks from cybersecurity threats.”
Read by claude-sonnet-5-5 on October 26, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
Managing cybersecurity risk is critical to Centrus. Centrus expects that the complexity of cybersecurity incidents will continue to evolve. To assess the changing cyber environment, Centrus includes the evaluation of cybersecurity risk as part of its enterprise risk management process and provides periodic reporting to the Board. Assessed risks, whether general or specific to the Company, include operational risk, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy laws and other litigation and legal risk, and reputational risk. This process includes evaluating risks from cybersecurity threats associated with the Company's use of third-party service providers.
To continually evaluate the sufficiency of Centrus' cybersecurity posture, Centrus aligns with the National Institute of Standards and Technology Cybersecurity Framework, has external experts complete assessments of Centrus' cybersecurity posture, completes internal self-assessments and engages with third-party experts for assistance in monitoring, deterring, detecting, and addressing potential breaches. The results of any internal or external assessment are reported to senior management and the Board.
Based on our monitoring and evaluations to date, including any previously identified cybersecurity incidents, there has not been, and there is not reasonably expected to be, a material effect on the Company's business strategy, results of operations or financial condition, as a result of risks from cybersecurity threats.
Governance
Centrus has policies, procedures, and strategies in place to assist in assessing and managing cybersecurity risks. To help safeguard the Company's network and information maintained on that network, the Company maintains and executes a cybersecurity program designed to monitor, prevent, detect, mitigate, and remediate cyberattacks.
The Board exercises its oversight of material risks from cybersecurity threats through the Board's Audit and Finance Committee and the Board's Technology, Competition and Regulatory Committee. The Chief Financial Officer has delegated the assessment and management of material risks from cybersecurity threats to the Cybersecurity Risk Committee which is comprised of members of senior management, including the Director, Information Technology. The Cybersecurity Risk Committee regularly provides those delegating oversight with updates on the Company's cybersecurity program which includes the current cybersecurity risk landscape and efforts employed to assist in preventing those risks, the Company's cybersecurity policies and practices, the ongoing efforts to improve security, as well as the Company's efforts regarding significant cybersecurity events. In addition, the Company maintains a cybersecurity incident response plan, which includes the Company's processes for monitoring, preventing, detecting, mitigating, remediating, and recovery from cybersecurity incidents that is updated regularly. Disclosure with regard to a cybersecurity incident will be considered by the Cybersecurity Risk Committee, with material issues raised with our Board.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.