Disclosure · Form 10-K · fiscal 2025
AmpliTech Group, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 26, 2026· period ended December 31, 2025· AMPG· CIK 1518461· Updated · filing on sec.gov ↗
AmpliTech Group, Inc.'s Form 10-K for fiscal 2025, filed March 26, 2026, places oversight of cybersecurity risk with the full board; a top security role title is not identified.
What AmpliTech's Item 1C says
AmpliTech's Form 10-K for fiscal 2025 states that the Board of Directors has delegated oversight of cybersecurity risk management to executive management.
Board and management oversight
The delegation of oversight to executive management includes the Company's CEO, CFO, and COO. Cybersecurity concerns are discussed with executive management on an informal basis as needed, and formal reporting processes to the Board are developing.
How the company manages cyber risk
The company considers cybersecurity risks as part of broader operational risk discussions, while formal integration into enterprise risk management is still developing. The company has initiated efforts to develop a formal Information Security Management System aligned with ISO/IEC 27001, and this initiative is in the early stages. The company has conducted limited penetration testing within the past year, which is not part of a formal recurring program.
Third parties and incidents
Cybersecurity incidents are reported to executive management, and material incidents are reviewed by the Board of Directors as appropriate. The company maintains cybersecurity insurance, though coverage may not fully align with its risk exposure.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a board committee as responsible for cybersecurity oversight. The section does not say how often the board or its committee is briefed on cybersecurity.
Read from the Form 10-K filed March 26, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
not identified
Reports to
not identified
Board oversight
Full board
“The Board of Directors has delegated oversight of cybersecurity risk management, strategy, and governance to executive management, including the Company's CEO, CFO, and COO.”
CISO or other person named
not identified
Frameworks and standards named
ISO/IEC 27001
Where the filing names it
- ISO/IEC 27001: “Company has initiated efforts to develop a formal Information Security Management System aligned with ISO/IEC 27001, and this initiative”
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“Senior management does not hold formal cybersecurity certifications; oversight relies on operational experience and support from information technology specialists to assist in managing relevant risks, with plans to utilize certified external consulting.”
Material incident
The filing states none
“While cybersecurity incidents have not materially affected the Company to date, these risks continue to evolve, and the Company may be exposed to operational or financial impacts from potential cybersecurity threats in the future.”
The section
441 words, Form 10-K filed March 26, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 7, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns AmpliTech Group, Inc. standard industrial classification 3669, Communications equipment, nec (SEC SIC list). 2 other filers in our library have the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Manufacturing).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Napco Security Technologies, IncFY 2026, filed August 24, 2026 | Vice President of Information Technology | not identified | not identified |
| George Risk Industries, Inc.FY 2026, filed August 7, 2026 | IT Manager | CEO | audit committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Insteel Industries IncFY 2026, filed October 29, 2026 | Chief Information Officer | not identified | full board |
| Penguin Solutions, Inc.FY 2026, filed October 20, 2026 | Chief Information Officer | not identified | not identified |
| News CorpFY 2026, filed August 7, 2026 | Chief Information Security Officer | Chief Technology Officer | Audit Committee |
| NikeFY 2026, filed July 15, 2026 | Vice President, Foundational Technology & Services | Chief Technology Officer | Audit & Finance Committee |
| Perfect Moment Ltd.FY 2026, filed June 29, 2026 | Chief Financial Officer and Chief Operating Officer | the President | Audit Committee |
| Emerson Radio CorpFY 2026, filed June 26, 2026 | not identified | not identified | audit committee of the Board |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of AmpliTech Group, Inc.'s Form 10-K as filed with the SEC on March 26, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM
1C. CYBERSECURITY
Cybersecurity
Risk Management and Strategy
The
Company relies on internal information systems and third-party services for operational and financial processes, and these systems and
services may experience disruptions, failures, or security incidents arising from inherent cybersecurity risks. While cybersecurity incidents
have not materially affected the Company to date, these risks continue to evolve, and the Company may be exposed to operational or financial
impacts from potential cybersecurity threats in the future. The Company may experience cybersecurity incidents affecting its internal
or third-party systems, including unauthorized access, malware, or system and operational disruptions. Cybersecurity threats may originate
from a range of sources, from isolated unauthorized access attempts to more complex attacks; the Company's controls continue to
evolve, with additional measures planned. The Company maintains basic administrative and technical controls intended to address cybersecurity
risks; however, these measures may not prevent all such incidents, and capabilities for prevention, detection, and response continue
to develop. A cybersecurity incident could compromise sensitive information despite the controls in place.
Cybersecurity
risks are considered as part of broader operational risk discussions; however, formal integration into enterprise risk management is
still developing. Cybersecurity risks are reviewed periodically in the context of overall operational risk, with plans to formalize annual
cybersecurity risk assessment processes. When heightened risks are identified, responsibility for identified risks is managed by designated
personnel, with enhanced tracking and documentation processes currently in development.
Cybersecurity
Governance
The
Board of Directors has delegated oversight of cybersecurity risk management, strategy, and governance to executive management, including
the Company's CEO, CFO, and COO. Cybersecurity concerns, operational issues, and risk considerations are discussed with executive
management on an informal basis as needed; formal reporting processes to the Board are developing.
Senior
management does not hold formal cybersecurity certifications; oversight relies on operational experience and support from information
technology specialists to assist in managing relevant risks, with plans to utilize certified external consulting. The Company has conducted
limited penetration testing within the past year; however, this is not part of a formal recurring program.
Cybersecurity
incidents are reported to executive management and material incidents are reviewed by the Board of Directors as appropriate, though formal
reporting and assessment procedures are developing.
The
Company has initiated efforts to develop a formal Information Security Management System aligned with ISO/IEC 27001, and this initiative
is in the early stages. Notwithstanding the Company's ongoing efforts to enhance its cybersecurity program, the Company may not
be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect. The Company maintains cybersecurity
insurance; however, coverage may not fully align with its risk exposure or address all potential incidents or losses.
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 31, 2025 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the Audit Committee of the Board of Directors (the "Audit Committee") .”
Person named in the filing
not identified
Experience, as stated
Stated
“Although members of our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with in-house information-technology specialists, enables them to effectively assess and manage material risks from cybersecurity threats.”
Material incident
The filing states none
“Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems, including attempts to gain unauthorized access to our confidential data, and other electronic security breaches.”
Read by claude-sonnet-5-5 on November 7, 2026; every quote verified in the stored text by code.
ITEM
1C. CYBERSECURITY
Cybersecurity
Risk Management and Strategy
The
Company depends on the proper functioning, availability and security of its information systems, including financial, data processing,
communications and operating systems. Several information systems are software applications provided by third parties. Although risks
from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect,
us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to
time, experience threats and security incidents related to our and our third-party vendors' information systems, including attempts
to gain unauthorized access to our confidential data, and other electronic security breaches. Such cybersecurity attacks can range from
individual attempts to gain unauthorized access to our information technology systems to more sophisticated security threats. While we
employ a number of measures to prevent, detect and mitigate these threats, there is no guarantee such efforts will be successful in preventing
a cybersecurity attack. A cybersecurity attack could compromise the confidential information of our employees, customers and vendors.
A successful cybersecurity attack could disrupt and otherwise adversely affect our business operations.
Assessment,
identification and management of cybersecurity related risks are integrated into our overall risk management process. Cybersecurity related
risks are included in the risk universe we evaluate to assess top risks to the Company at least annually. To the extent our processes
identify a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to
completion.
Cybersecurity
Governance
Our
Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk
strategy and governance and of other information technology risks to the Audit Committee of the Board of Directors (the "Audit
Committee") . The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.
Senior management, including the Company's Chief Executive Officer, Chief Financial Officer and Chief Operating Officer, is responsible
for assessing and managing cybersecurity risk, and provides briefings regarding the assessment and management of such risk to the Audit
Committee, which then reports, as necessary, to the Board of Directors .
Although
members of our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing
the Company, which includes consulting and coordinating as necessary with in-house information-technology specialists, enables them to
effectively assess and manage material risks from cybersecurity threats.
The
Company relies on in-house information-technology specialists to assist in managing relevant risks. Any cybersecurity incident would
be reported promptly to management and material and potentially material incidents would be assessed by management and the Audit Committee
for remediation and future prevention and detection.
The
Company, at least annually, updates its policies or procedures that could help mitigate cybersecurity risks. Notwithstanding the extensive
approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material
adverse effect on us . The Company has incorporated cybersecurity coverage in its insurance policies; however, there is no assurance that
the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related
losses.
Fiscal 2023 Form 10-K, filed April 1, 2024 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
Audit Committee of the Board of Directors
“Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the Audit Committee of the Board of Directors (the "Audit Committee").”
Person named in the filing
not identified
Experience, as stated
Stated
“Although members of our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with in-house information-technology specialists, enables them to effectively assess and manage material risks from cybersecurity threats.”
Material incident
The filing states none
“Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems, including attempts to gain unauthorized access to our confidential data, and other electronic security breaches.”
Read by claude-sonnet-5-5 on November 7, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
Cybersecurity Risk
Management and Strategy
The Company depends on the
proper functioning, availability and security of its information systems, including financial, data processing, communications and operating
systems. Several information systems are software applications provided by third parties. Although risks from cybersecurity threats have
to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results
of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security
incidents related to our and our third-party vendors' information systems, including attempts to gain unauthorized access to our
confidential data, and other electronic security breaches. Such cybersecurity attacks can range from individual attempts to gain unauthorized
access to our information technology systems to more sophisticated security threats. While we employ a number of measures to prevent,
detect and mitigate these threats, there is no guarantee such efforts will be successful in preventing a cybersecurity attack. A cybersecurity
attack could compromise the confidential information of our employees, customers and vendors. A successful cybersecurity attack could
disrupt and otherwise adversely affect our business operations.
Assessment, identification
and management of cybersecurity related risks are integrated into our overall risk management process. Cybersecurity related risks are
included in the risk universe we evaluate to assess top risks to the Company at least annually. To the extent our processes identify a
heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.
Cybersecurity Governance
Our Board of Directors considers
cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and
of other information technology risks to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit
Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Senior management,
including the Company's Chief Executive Officer, Chief Financial Officer and Chief Operating Officer, is responsible for assessing
and managing cybersecurity risk, and provides briefings regarding the assessment and management of such risk to the Audit Committee, which
then reports, as necessary, to the Board of Directors.
Although members of our senior management do not have direct cybersecurity expertise
obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with in-house information-technology
specialists, enables them to effectively assess and manage material risks from
cybersecurity threats.
The Company relies on in-house
information-technology specialists to assist in managing relevant risks. Any cybersecurity incident would be reported promptly to management
and material and potentially material incidents would be assessed by management and the Audit Committee for remediation and future prevention
and detection.
The Company, at least annually,
updates its policies or procedures that could help mitigate cybersecurity risks. Notwithstanding the extensive approach we take to cybersecurity,
we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. The Company
has incorporated cybersecurity coverage in its insurance policies; however, there is no assurance that the insurance the Company maintains
will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.