Disclosure · Form 10-K · fiscal 2026
Ooma Inc 10-K cybersecurity disclosure (Item 1C), fiscal 2026
Filed April 3, 2026· period ended January 31, 2026· OOMA· CIK 1327688· Updated · filing on sec.gov ↗
Ooma Inc's Form 10-K for fiscal 2026, filed April 3, 2026, names the Chief Information Security Officer as its top security role, with oversight by the full board.
What the filing says, in plain English
Who leads security (the top role, as the filing names it)
Chief Information Security Officer
Reports to
not identified
Board oversight
Full board
“Our board of directors as a whole oversees the Company's privacy and data security, including cybersecurity, risk exposures, policies and practices, and the steps management has taken to prevent, detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations, and reputation.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“Our CISO has served in various information technology and security leadership roles for over 30 years.”
Material incident
The filing states none
“We believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have no t materially affected our business to date.”
The section
417 words, Form 10-K filed April 3, 2026 for the period ended January 31, 2026
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Ooma Inc standard industrial classification 7374, Services-computer processing & data preparation (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| ReposiTrak, Inc.FY 2026, filed September 28, 2026 | not identified | not identified | Audit Committee |
| 8x8, Inc.FY 2026, filed May 22, 2026 | Chief Information Security Officer | Chief Legal Officer | Technology & Cybersecurity Committee |
| DXC TechnologyFY 2026, filed May 8, 2026 | Global Chief Information Security Officer | President of Global Infrastructure Services | Nominating/Corporate Governance Committee |
| Gloo Holdings, Inc.FY 2026, filed April 15, 2026 | Director of Security & Information Technology | not identified | Audit Committee |
| Corvex, Inc.FY 2025, filed March 31, 2026 | Vice President of Engineering | CEO | full board |
| SharonAI Holdings Inc.FY 2025, filed March 31, 2026 | not identified | not identified | Audit and Risk Management committee |
| SPECTRAL CAPITAL CorpFY 2025, filed March 31, 2026 | not identified | not identified | full board |
| Tucows IncFY 2025, filed March 12, 2026 | not identified | not identified | full board |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Ooma Inc's Form 10-K as filed with the SEC on April 3, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. Cybersecurity
Risk Management, Governance and Strategy
We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.
Our board of directors as a whole oversees the Company's privacy and data security, including cybersecurity, risk exposures, policies and practices, and the steps management has taken to prevent, detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations, and reputation. We have tools and protocols in place designed to prevent, detect and escalate security incidents within the Company.
Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. This process is owned by the Chief Information Security Officer ("CISO") and is supported by both management and our board of directors. Our CISO has served in various information technology and security leadership roles for over 30 years. He has a Master of Science degree in Electrical Engineering from Stanford University.
Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments and reviews. As part of our risk assessment process, we may perform cybersecurity risk evaluations when selecting applicable third-party vendors, suppliers, and other service providers. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive cybersecurity reviews of systems and applications, conduct employee phishing training, and monitor emerging laws and regulations related to data protection and information security.
We have implemented incident response and breach management processes. Notifications are made based on the level of threat of the incident. Incidents are evaluated to determine materiality as well as operational and business impact. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors.
The "Risk Factors" section includes further detail about the material cybersecurity risks we face. We believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have no t materially affected our business to date.
Although we continue to invest in cybersecurity and to enhance our internal controls and processes, we cannot guarantee these measures will be sufficient to protect us from a network security incident. For further information regarding the risks we face from cybersecurity threats refer to the "Risk Factors" within this Form 10-K.
Earlier filings on record
Fiscal 2025 Form 10-K, filed April 1, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
Full board
“Our board of directors as a whole oversees the Company's privacy and data security, including cybersecurity, risk exposures, policies and practices, and the steps management has taken to prevent, detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations, and reputation.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our CISO has served in various information technology and security leadership roles for over 30 years.”
Material incident
The filing states none
“We believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have no t materially affected our business to date.”
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
ITEM 1C. Cybersecurity
Risk Management, Governance and Strategy
We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.
Our board of directors as a whole oversees the Company's privacy and data security, including cybersecurity, risk exposures, policies and practices, and the steps management has taken to prevent, detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations, and reputation. We have tools and protocols in place designed to prevent, detect and escalate security incidents within the Company.
Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. This process is owned by the Chief Information Security Officer ("CISO") and is supported by both management and our board of directors. Our CISO has served in various information technology and security leadership roles for over 30 years. He has a Master of Science degree in Electrical Engineering from Stanford University.
Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments and reviews. As part of our risk assessment process, we may perform cybersecurity risk evaluations when selecting applicable third-party vendors, suppliers, and other service providers. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive cybersecurity reviews of systems and applications, conduct employee phishing training, and monitor emerging laws and regulations related to data protection and information security.
We have implemented incident response and breach management processes. Notifications are made based on the level of threat of the incident. Incidents are evaluated to determine materiality as well as operational and business impact. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors.
The "Risk Factors" section includes further detail about the material cybersecurity risks we face. We believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have no t materially affected our business to date.
Although we continue to invest in cybersecurity and to enhance our internal controls and processes, we cannot guarantee these measures will be sufficient to protect us from a network security incident. For further information regarding the risks we face from cybersecurity threats refer to the "Risk Factors" within this Form 10-K.
Fiscal 2024 Form 10-K, filed April 2, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
Full board
“Our board of directors as a whole oversees the Company's privacy and data security, including cybersecurity, risk exposures, policies and practices, and the steps management has taken to prevent, detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations, and reputation.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our CISO has served in various information technology and security leadership roles for over 30 years.”
Material incident
The filing states none
“Although the "Risk Factors" section includes further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date.”
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
ITEM 1C. Cybersecurity
Risk Management, Governance and Strategy
We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. This process is owned by the Chief Information Security Officer ("CISO") and is supported by both management and our board of directors. Our CISO has served in various information technology and security leadership roles for over 30 years. He has a Master of Science degree in Electrical Engineering from Stanford University.
Our board of directors as a whole oversees the Company's privacy and data security, including cybersecurity, risk exposures, policies and practices, and the steps management has taken to prevent, detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations, and reputation. We have tools and protocols in place designed to prevent, detect and escalate security incidents within the Company.
Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments and reviews. As part of our risk assessment process, we may perform cybersecurity risk evaluations when selecting applicable third-party vendors, suppliers, and other service providers. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive cybersecurity reviews of systems and applications, conduct employee phishing training, and monitor emerging laws and regulations related to data protection and information security.
We have implemented incident response and breach management processes. Notifications are made based on the level of threat of the incident. Incidents are evaluated to determine materiality as well as operational and business impact. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors.
Although the "Risk Factors" section includes further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date.
Although we continue to invest in cybersecurity and to enhance our internal controls and processes, we cannot guarantee these measures will be sufficient to protect us from a network security incident. For further information regarding the risks we face from cybersecurity threats refer to the "Risk Factors" within this Form 10-K.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.