Disclosure · Form 10-K · fiscal 2025
Sunshine Biopharma Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed April 3, 2026· period ended December 31, 2025· SBFM· CIK 1402328· Updated · filing on sec.gov ↗
Sunshine Biopharma Inc.'s Form 10-K for fiscal 2025, filed April 3, 2026, carries an Item 1C cybersecurity section; a top security role title is not identified.
What Sunshine Biopharma's Item 1C says
Sunshine Biopharma's Form 10-K for fiscal 2025 states that management oversees the company's cybersecurity risk management efforts.
Board and management oversight
The senior management team is involved in developing cybersecurity policies, procedures and strategy. The board of directors reviews and approves the overall budget, of which cybersecurity is a part.
How the company manages cyber risk
The company conducts regular risk assessments to identify and evaluate potential cybersecurity threats and vulnerabilities. The company's risk management framework is aligned with industry standards such as the NIST Cybersecurity Framework (CSF) and ISO 27001.
Third parties and incidents
The company assesses the cybersecurity practices of its third-party vendors and partners. During the past fiscal year, the company experienced no cybersecurity incidents.
What the section does not state
The section does not name the person who holds the top security role. The section does not say who the top security role reports to. The section does not name a board committee as responsible for cybersecurity oversight. The section does not say how often the board or its committee is briefed on cybersecurity.
Read from the Form 10-K filed April 3, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
not identified
Reports to
not identified
Board oversight
not identified
CISO or other person named
not identified
Frameworks and standards named
NIST Cybersecurity Framework, ISO/IEC 27001
Where the filing names them
- NIST Cybersecurity Framework: “as the NIST Cybersecurity Framework (CSF) and ISO 27001.”
- ISO/IEC 27001: “as the NIST Cybersecurity Framework (CSF) and ISO 27001.”
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
not identified
Material incident
The filing states none
“During the past fiscal year, we experienced no cybersecurity incidents .”
The section
340 words, Form 10-K filed April 3, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 14, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Sunshine Biopharma Inc. standard industrial classification 2834, Pharmaceutical preparations (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Nanoviricides, Inc.FY 2026, filed September 28, 2026 | not identified | not identified | audit committee |
| Phibro Animal Health CorpFY 2026, filed August 26, 2026 | Chief Technology and Digital Innovation Officer | not identified | full board |
| Protagenic Therapeutics, Inc.\newFY 2026, filed August 14, 2026 | not identified | not identified | audit committee |
| Earth Science Tech, Inc.FY 2026, filed June 18, 2026 | not identified | not identified | not identified |
| GeoVax Labs, Inc.FY 2025, filed April 15, 2026 | Chief Financial Officer | not identified | Nominating and Governance Committee |
| KALA BIO, Inc.FY 2025, filed April 15, 2026 | Chief Business Officer | not identified | Audit Committee |
| Oncotelic Therapeutics, Inc.FY 2025, filed April 15, 2026 | not identified | not identified | full board |
| LFTD Partners Inc.FY 2025, filed April 1, 2026 | not identified | not identified | not identified |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Sunshine Biopharma Inc.'s Form 10-K as filed with the SEC on April 3, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. CYBERSECURITY
Risk
Our Company recognizes the critical importance
of cybersecurity in protecting our sensitive data, intellectual property, and the personal information of our employees and partners.
We have implemented a comprehensive cybersecurity risk management program that includes the following key components:
Risk Assessment and Management
We conduct regular risk assessments to identify
and evaluate potential cybersecurity threats and vulnerabilities. Our risk management framework is aligned with industry standards such
as the NIST Cybersecurity Framework (CSF) and ISO 27001. We continuously monitor and update our cybersecurity measures to address emerging
threats and ensure the protection of our assets.
Cybersecurity Governance
Our management oversees our cybersecurity risk
management efforts. Our senior management team is actively involved in cybersecurity policies, procedures and strategy development.
Incident Response and Recovery
We have a robust incident response plan in place
to quickly detect, respond to, and recover from cybersecurity incidents. We collaborate with external cybersecurity experts and law enforcement
agencies to enhance our incident response capabilities.
Employee Training and Awareness
We provide ongoing cybersecurity training and awareness
programs for all employees to promote a culture of security. Our training programs cover topics such as phishing prevention, secure data
handling, and recognizing potential cyber threats.
Third-Party Risk Management
We assess the cybersecurity practices of our third-party
vendors and partners to ensure they meet our security standards. Our contracts with third parties include provisions for cybersecurity
requirements and incident reporting.
Regulatory Compliance
We comply with all relevant cybersecurity regulations
and standards, including the Health Insurance Portability and Accountability Act (HIPAA) and the General Data Protection Regulation (GDPR).
We regularly review and update our cybersecurity policies and procedures to ensure compliance with evolving regulatory requirements.
Investments in Cybersecurity
We continuously invest in advanced cybersecurity
technologies, including threat detection and prevention systems, encryption, and secure access controls. Our cybersecurity is part of
our overall budget which is reviewed and approved by our board of directors to ensure adequate resources are allocated to protect our
assets.
Cybersecurity Incidents
During the past fiscal year, we experienced no
cybersecurity incidents .
Earlier filings on record
Fiscal 2024 Form 10-K, filed April 1, 2025 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
not identified
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“During the past fiscal year, we experienced no cybersecurity incidents.”
Read by claude-sonnet-5-5 on November 14, 2026; every quote verified in the stored text by code.
ITEM
1C. CYBERSECURITY
Our
Company recognizes the critical importance of cybersecurity in protecting our sensitive data, intellectual property, and the personal
information of our employees and partners. We
have implemented
a comprehensive cybersecurity risk management program that includes the following key components:
Risk
Assessment and Management
We
conduct regular risk assessments to identify and evaluate potential cybersecurity threats and vulnerabilities. Our risk management framework
is aligned with industry standards such as the NIST Cybersecurity Framework (CSF) and ISO 27001. We continuously monitor and update our
cybersecurity measures to address emerging threats and ensure the protection of our assets.
Cybersecurity
Governance
Our
management oversees our cybersecurity risk management efforts. Our
senior management team is actively involved in cybersecurity policies, procedures and strategy
development.
Incident
Response and Recovery
We
have a robust incident response plan in place to quickly detect, respond to, and recover from cybersecurity incidents. We
collaborate with external cybersecurity experts and law enforcement agencies to enhance our incident response capabilities.
Employee
Training and Awareness
We
provide ongoing cybersecurity training and awareness programs for all employees to promote a culture of security. Our training programs
cover topics such as phishing prevention, secure data handling, and recognizing potential cyber threats.
Third-Party
Risk Management
We
assess the cybersecurity practices of our third-party vendors and partners to ensure they meet our security standards. Our contracts
with third parties include provisions for cybersecurity requirements and incident reporting.
Regulatory
Compliance
We
comply with all relevant cybersecurity regulations and standards, including the Health Insurance Portability and Accountability Act (HIPAA)
and the General Data Protection Regulation (GDPR). We regularly review and update our cybersecurity policies and procedures to ensure
compliance with evolving regulatory requirements.
Investments
in Cybersecurity
We
continuously invest in advanced cybersecurity technologies, including threat detection and prevention systems, encryption, and
secure access controls. Our cybersecurity is part of our overall budget which is reviewed and approved by our board of
directors to ensure adequate resources are allocated to protect our assets.
Cybersecurity
Incidents
During
the past fiscal year, we
experienced no cybersecurity incidents.
Fiscal 2023 Form 10-K, filed March 28, 2024 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
not identified
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.”
Read by claude-sonnet-5-5 on November 14, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
Risk Management
and Strategy
We recognize the critical importance of developing,
implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity,
and availability of our data.
Managing Material
Risks & Integrated Overall Risk Management
We have strategically integrated cybersecurity
risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration
ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works
closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and
operational needs.
Oversee Third-party
Risk
Because we are aware of the risks associated with
third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security
assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity
standards. The monitoring includes annual assessments of the SOC reports of our providers and implementing complementary controls. This
approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.
Risks from Cybersecurity
Threats
We have not encountered cybersecurity challenges
that have materially impaired our operations or financial standing.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.