Disclosure · Form 10-K · fiscal 2025
Mosaic Co 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 27, 2026· period ended December 31, 2025· MOS· CIK 1285785· Updated · filing on sec.gov ↗
Mosaic Co's Form 10-K for fiscal 2025, filed February 27, 2026, names the Chief Information Security Officer as its top security role, with oversight by the Audit Committee.
What Mosaic's Item 1C says
Mosaic's Form 10-K for fiscal 2025 places oversight of cybersecurity risk with the Audit Committee. The Information Technology organization is led by the CIO, who is responsible for cybersecurity and risk management.
Board and management oversight
The Board receives an annual cybersecurity update, while the Audit Committee regularly receives reports from the Chief Information Security Officer and Chief Information Officer. The Audit Committee then briefs the Board on these matters. The Enterprise Risk Management committee, made up of members of the executive leadership team, reviews and evaluates key risks identified through cybersecurity risk management processes.
Who leads security
The cybersecurity program is overseen by Mosaic's CISO and supporting cybersecurity leadership. Educational backgrounds include advanced degrees and certifications, such as Certified Information Systems Security Professional.
How the company manages cyber risk
Mosaic has integrated cybersecurity risk management into its broader risk management framework. The Governance Risk and Compliance team is a team within the cybersecurity department that focuses on identifying and mitigating cybersecurity and compliance risk.
Third parties and incidents
As part of its third-party risk management program, the company reviews risk ratings and control assessments of pertinent vendors and other third-parties. Mosaic engages external vendors to provide independent insight on overall cybersecurity program effectiveness and to assist with evaluating response preparedness. To the company's knowledge, it has not experienced any material cybersecurity incidents of its technology systems.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a specific security framework or standard.
Read from the Form 10-K filed February 27, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Information Security Officer
Reports to
not identified
Board oversight
Audit Committee
“The Board of Directors oversees Mosaic's Enterprise Risk Management program, and the Audit Committee is tasked with oversight of risk from cybersecurity threats.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“The CISO, along with the leadership team, possess many years of relevant information technology, cybersecurity and risk management experience in the manufacturing, electric, defense, financial and”
Material incident
The filing states none
“To our knowledge, we have not experienced any material cybersecurity incidents of our technology systems.”
The section
601 words, Form 10-K filed February 27, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 23, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Mosaic Co standard industrial classification 2870, Agricultural chemicals (SEC SIC list). 3 other filers in our library have the same code. Also shown: filers whose codes the SEC assigns to the same review office (Industrial Applications and Services).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Bion Environmental Technologies IncFY 2026, filed September 29, 2026 | not identified | not identified | full board |
| Nexentis Technologies Inc.FY 2025, filed March 31, 2026 | not identified | not identified | full board |
| American Vanguard CorpFY 2025, filed March 16, 2026 | VP of IT | not identified | Risk Committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Advanced Biomed Inc.FY 2026, filed October 13, 2026 | Chief Executive Officer | not identified | not identified |
| Bloomia Holdings, Inc.FY 2026, filed September 21, 2026 | not identified | not identified | Audit Committee |
| Karbon-X Corp.FY 2026, filed September 15, 2026 | Chief Executive Officer | not identified | full board |
| Aehr Test SystemsFY 2026, filed July 27, 2026 | Chief Operating Officer | not identified | Audit Committee |
| Adm Tronics Unlimited, Inc.FY 2026, filed July 10, 2026 | CSO | not identified | full board |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Mosaic Co's Form 10-K as filed with the SEC on February 27, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity.
Risk Management and Strategy
As a global company, we utilize and rely upon information technology systems in many aspects of our business, including internal and external communications and the management of our accounting, financial, production and supply chain functions. As we become more dependent on information technologies to conduct our operations, and as the number of cyberattacks increase and their sophistication evolves, the risks associated with cybersecurity also increase and evolve. Failure to effectively anticipate, prevent, detect and recover from the increasing number and sophistication of cyberattacks could have a material adverse effect on our results of operations or financial condition. To our knowledge, we have not experienced any material cybersecurity incidents of our technology systems.
Mosaic's cybersecurity program is comprised of people, processes and technology that are designed to adequately protect the confidentiality, integrity and availability of information technology systems and data. Mosaic has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk awareness. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. We have a Governance Risk and Compliance team which is a dedicated team within the cybersecurity department that focuses on identifying and mitigating cybersecurity and compliance risk. The team works closely with the Operations Technology and Information Technology department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. As part of our third-party risk management program, we review risk ratings and control assessments of pertinent vendors and other third-parties. Our Enterprise Risk Management committee, which is comprised of members of our executive leadership team, reviews and evaluates key risks identified through cybersecurity risk management processes. Mosaic develops and continues to refine mitigation plans that adhere to industry best practices.
Regularly, Mosaic regularly engages external vendors to provide independent insight to overall cybersecurity program effectiveness and to assist with evaluating response preparedness.
Governance
Board of Director Oversight
The Board of Directors oversees Mosaic's Enterprise Risk Management program, and the Audit Committee is tasked with oversight of risk from cybersecurity threats. The Board receives an annual cybersecurity update while the Audit Committee regularly receives reports from the Chief Information Security Officer ( " CISO ") and Chief Information Officer ( " CIO ") . The reports to the Audit Committee include updates on key performance indicators and key risk indicators, including short-term, intermediate-term and emerging risks. The Audit Committee then briefs the Board on these matters. Ad hoc updates occur as needed .
Management ' s Role in Managing Risk
The Information Technology organization is led by the CIO who is responsible for cybersecurity and risk management, with oversight by the Audit Committee. The cybersecurity program is overseen by the Mosaic's CISO and supporting cybersecurity leadership, who lead teams to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, Mosaic. The CISO, along with the leadership team, possess many years of relevant information technology, cybersecurity and risk management experience in the manufacturing, electric, defense, financial and
Table of Content
retail sectors. Educational backgrounds include advanced degrees and certifications, such as Certified Information Systems Security Professional. During the course of leadership team's careers, they have built and sustained programs protecting other Fortune 500 companies, critical national infrastructure and military defense systems.
The CIO and CISO regularly update the Board and/or the Audit Committee on cybersecurity matters and the effectiveness of the cybersecurity program. The Board and Audit Committee also engage directly with senior leaders from the Information Technology department.
Table of Content
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 3, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“The Board of Directors oversees Mosaic's Enterprise Risk Management program, and the Audit Committee is tasked with oversight of risk from cybersecurity threats.”
Person named in the filing
not identified
Experience, as stated
Stated
“The CISO, along with the leadership team, possess many years of relevant Information Technology, cybersecurity and risk management experience in the manufacturing, electric, defense, financial and retail sectors.”
Material incident
The filing states none
“To our knowledge, we have not experienced any material cybersecurity incidents of our technology systems.”
Read by claude-sonnet-5-5 on October 23, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
Risk Management and Strategy
As a global company, we utilize and rely upon information technology systems in many aspects of our business, including internal and external communications and the management of our accounting, financial, production and supply chain functions. As we become more dependent on information technologies to conduct our operations, and as the number and sophistication of cyberattacks increase, the risks associated with cybersecurity increase. Failure to effectively anticipate, prevent, detect and recover from the increasing number and sophistication of cyberattacks could have a material adverse effect on our results of operations or financial condition. To our knowledge, we have not experienced any material cybersecurity incidents of our technology systems.
Mosaic's cybersecurity program is comprised of people, processes and technology that are designed to adequately protect the confidentiality, integrity and availability of information technology systems and data. Mosaic has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk awareness. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. We have a Governance Risk and Compliance team which is a dedicated team within the cybersecurity department that focuses on identifying and mitigating cybersecurity and compliance risk. The team works closely with the Information Technology department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our Enterprise Risk Management committee, which is comprised of members of our executive leadership team, reviews and evaluates key risks identified through cybersecurity risk management processes. Mosaic develops and continues to refine mitigation plans that adhere to industry best practices.
Regularly, Mosaic engages external vendors to provide independent insight to overall cybersecurity program effectiveness and to assist with evaluating response preparedness. As part of our third-party risk oversight, we regularly review the vendor's ratings and conduct assessments and interviews with their personnel. The results are then reported to leaders in the Information Technology department.
Governance
Board of Director Oversight
The Board of Directors oversees Mosaic's Enterprise Risk Management program, and the Audit Committee is tasked with oversight of risk from cybersecurity threats. The Board receives an annual cybersecurity update while the Audit Committee receives reports from the Chief Information Security Officer ( " CISO ") and Chief Information Officer ( " CIO ") regularly. The reports to the Audit Committee include updates on key performance indicators and key risk indicators, including short-term, intermediate-term and emerging risks. The Audit Committee then briefs the Board on these matters. Ad hoc updates occur as needed .
Management ' s Role in Managing Risk
The Information Technology organization is led by the CIO who is responsible for cybersecurity and risk management, with oversight by the Audit Committee. The cybersecurity program is overseen by the Mosaic's CISO and supporting
Table of Content
cybersecurity leadership, who lead teams to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, Mosaic. The CISO, along with the leadership team, possess many years of relevant Information Technology, cybersecurity and risk management experience in the manufacturing, electric, defense, financial and retail sectors. Educational backgrounds include advanced degrees and certifications, such as Certified Information Systems Security Professional. During the course of leadership team's careers, they have built and sustained programs protecting other Fortune 500 companies, critical national infrastructure and military defense systems.
The CIO and CISO regularly update the Board and/or the Audit Committee on cybersecurity matters and the effectiveness of the cybersecurity program. The Board and Audit Committee also engage directly with senior leaders from the Information Technology department.
Table of Content
Fiscal 2023 Form 10-K, filed February 22, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“The Board of Directors oversees Mosaic's Enterprise Risk Management program, and the Audit Committee is tasked with oversight of risk from cybersecurity threats.”
Person named in the filing
not identified
Experience, as stated
Stated
“The CISO, along with the leadership team, possess many years of relevant Information Technology, cybersecurity, and risk management experience in the manufacturing, electric, defense, financial, and retail sectors.”
Material incident
The filing states none
“To our knowledge, we have not experienced any material cybersecurity incidents of our technology systems.”
Read by claude-sonnet-5-5 on October 23, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
Risk Management and Strategy
As a global company, we utilize and rely upon information technology systems in many aspects of our business, including internal and external communications and the management of our accounting, financial, production and supply chain functions. As we become more dependent on information technologies to conduct our operations, and as the number and sophistication of cyberattacks increase, the risks associated with cybersecurity increase. Failure to effectively anticipate, prevent, detect, and recover from the increasing number and sophistication of cyberattacks could have a material adverse
Table of Co ntent
effect on our results of operations or financial condition. To our knowledge, we have not experienced any material cybersecurity incidents of our technology systems.
Mosaic's cybersecurity program is comprised of people, processes, and technology that are designed to adequately protect the confidentiality, integrity, and availability of information technology systems and data. Mosaic has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk awareness. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. We have a Governance Risk and Compliance team which is a dedicated team within the cybersecurity department that focuses on identifying and mitigating cybersecurity and compliance risk. The team works closely with the Information Technology department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our Enterprise Risk Management committee, which is comprised of members from our executive leadership team, reviews and evaluates key risks identified through cybersecurity risk management processes. Mosaic develops and continues to refine mitigation plans that adhere to industry best practices.
Regularly, Mosaic engages external vendors to provide independent insight to overall cybersecurity program effectiveness and to assist with evaluating response preparedness. As part of our third-party risk oversight, we regularly review the vendor's ratings and conduct assessments and interviews with their personnel. The results are then reported to leaders in the Information Technology department.
Governance
Board of Director Oversight
The Board of Directors oversees Mosaic's Enterprise Risk Management program, and the Audit Committee is tasked with oversight of risk from cybersecurity threats. The Board receives an annual cybersecurity update while the Audit Committee receives reports from the Chief Information Security Officer ( " CISO ") and Chief Information Officer ("CIO") regularly. The reports to the Audit Committee include updates on key performance indicators and key risk indicators, including short-term, intermediate-term and emerging risks. The Audit Committee then briefs the Board on these matters. Ad hoc updates occur as needed.
Management ' s Role in Managing Risk
The Information Technology organization is led by the CIO who is responsible for cybersecurity and risk management, with oversight by the Audit Committee. The cybersecurity program is overseen by the Mosaic's CISO and supporting cybersecurity leadership, who lead teams to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, Mosaic.The CISO, along with the leadership team, possess many years of relevant Information Technology, cybersecurity, and risk management experience in the manufacturing, electric, defense, financial, and retail sectors. Educational backgrounds include advanced degrees and certifications, such as Certified Information Systems Security Professional. During the course of leadership team's careers, they have built and sustained programs protecting other Fortune 500 companies, critical national infrastructure, and military defense systems.
The CIO and CISO regularly update the Board and/or the Audit Committee on cybersecurity matters and the effectiveness of the cybersecurity program. The Board and Audit Committee also engage directly with senior leaders from the Information Technology department.
Table of Co ntent
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.