Disclosure · Form 10-K · fiscal 2025
Phillips 66 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 20, 2026· period ended December 31, 2025· PSX· CIK 1534701· Updated · filing on sec.gov ↗· company page
Phillips 66's Form 10-K for fiscal 2025, filed February 20, 2026, names the Chief Information Security Officer as its top security role, with oversight by the Audit and Finance Committee. On CISO Tribune's record, the Chief Information Security Officer (CISO) of Phillips 66 is Connie Devine (appointment announced in week of June 1, 2026; record).
- Phillips 66: who leads security, and the seat's history
- Connie Devine, Chief Information Security Officer (CISO) of Phillips 66 on our record
- How other petroleum refining filers describe the seat
What Phillips 66's Item 1C says
Phillips 66's Form 10-K for fiscal 2025 places oversight of cybersecurity risk with the Audit and Finance Committee of the Board of Directors. The Chief Information Security Officer is responsible for assessing and managing risks from cybersecurity threats.
Board and management oversight
The A&FC receives written reports and periodic briefings from the Chief Information Security Officer on topics such as vulnerability assessment results, independent external reviews and changes to the threat environment. The A&FC provides regular reports to the Board of Directors on data protection and cybersecurity matters. The CISO also works closely with the company's Senior Counsel, Brand, Cyber & Privacy, to oversee compliance with legal, regulatory, and contractual security requirements.
Who leads security
The CISO has cybersecurity knowledge and skills gained through company experience and prior law enforcement service, supported by advanced professional certifications. The CISO leads a team that implements, monitors, and maintains cybersecurity and data protection practices across the company. Personnel reporting to the CISO have relevant educational and industry experience in threat hunting and intelligence, digital standards, data privacy, cyber training, and security operations center management.
How the company manages cyber risk
As part of its ERM program, the company conducts an annual evaluation of cybersecurity risks and shares the results with management and the A&FC. The company maintains a continuous monitoring program to detect and respond to potential threats in near real time. The Internal Audit organization conducts audits across information technology and operational technology environments to evaluate compliance with information security policies and standards. The company maintains an Enterprise Cybersecurity Incident Response Plan that provides the framework for management's response to cyber-related incidents and escalation protocols.
Third parties and incidents
The company regularly engages consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks. The company also engages external cybersecurity experts to conduct assessments, penetration testing, and cybersecurity maturity assessments. The company operates a third-party risk management program to identify, assess, monitor, and mitigate risks associated with third-party relationships, including cybersecurity risks. The company has experienced actual and attempted cybersecurity events and incidents in the past but does not believe any have materially affected its business, operations, or financial condition.
What the section does not state
The section does not name a specific security framework or standard.
Read from the Form 10-K filed February 20, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Information Security Officer
Reports to
not identified
Board oversight
Audit and Finance Committee
“The Audit and Finance Committee (A&FC) of the Board of Directors oversees the company's Enterprise Risk Management (ERM) program, including the processes that management uses to assess, identify, and manage risks associated with cybersecurity and information technology.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
Described
“In addition to internal capabilities, we regularly engage consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks.”
Experience of the security leadership, as stated
Stated
“The CISO has extensive cybersecurity knowledge and skills gained through company experience and prior law enforcement service, supported by advanced professional certifications.”
Material incident
The filing states none
“We have experienced actual and attempted cybersecurity events and incidents on our networks and systems in the past; however, we do not believe that any of these events or incidents, individually, or in the aggregate, have materially affected our business, operations, or financial condition, or are reasonably likely to have such an effect.”
The section
824 words, Form 10-K filed February 20, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 16, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Phillips 66 standard industrial classification 2911, Petroleum refining (SEC SIC list). One other filer in our library has the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Energy & Transportation).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Delek US Holdings, Inc.FY 2025, filed February 27, 2026 | Chief Information Security Officer | not identified | Technology Committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| EON Resources Inc.FY 2025, filed October 13, 2026 | not identified | not identified | full board |
| Mag Magna CorpFY 2026, filed October 7, 2026 | not identified | not identified | full board |
| FedEx Freight Holding Company, Inc.FY 2026, filed August 5, 2026 | Vice President — Chief Information Security Officer | Executive Vice President — Chief Technology Officer | Risk Oversight Committee |
| Ramaco Resources, Inc.FY 2025, filed July 24, 2026 | Vice President of Information Technology and Cybersecurity | not identified | Audit Committee |
| Star Gold Corp.FY 2026, filed July 22, 2026 | CFO | not identified | Audit Committee |
| Royale Energy, Inc.FY 2025, filed July 13, 2026 | not identified | not identified | audit committee |
| NextTrip, Inc.FY 2026, filed May 29, 2026 | not identified | not identified | full board |
More disclosures from filers CISO Tribune files under Industrial & Energy: Rockwell Automation, The Goodyear Tire & Rubber Company, Brunswick, Deere, Eversource Energy, FirstEnergy, General Motors, NN, Inc..
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Phillips 66's Form 10-K as filed with the SEC on February 20, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. CYBERSECURITY
Management has implemented a comprehensive cybersecurity program designed to manage risks and to protect the confidentiality, integrity, and availability of our information systems and the information of our customers and suppliers from cybersecurity threats that could materially and adversely affect our business, operations, or financial condition. The program includes processes and standards that leverage recognized cybersecurity frameworks, industry best practices, and U.S. Government guidance focused on cybersecurity and critical infrastructure. These processes are integrated with our enterprise risk management and incident response functions to support timely assessment, escalation, and disclosure when appropriate.
Cybersecurity Governance
Board of Directors
The Audit and Finance Committee (A&FC) of the Board of Directors oversees the company's Enterprise Risk Management (ERM) program, including the processes that management uses to assess, identify, and manage risks associated with cybersecurity and information technology. The A&FC receives written reports and periodic briefings from the Chief Information Security Officer (CISO) that address topics such as the results of vulnerability assessments, independent external reviews, changes to the threat environment, technology trends, and benchmarking. The A&FC provides regular reports to the Board of Directors on data protection and cybersecurity matters. The company maintains an Enterprise Cybersecurity Incident Response Plan (ECIRP) which provides the framework for management's response to cyber-related incidents and escalation protocols, including, reporting to the Board of Directors when appropriate.
Management
The CISO has extensive cybersecurity knowledge and skills gained through company experience and prior law enforcement service, supported by advanced professional certifications. The CISO is responsible for assessing and managing risks from cybersecurity threats and leads a team that implements, monitors, and maintains cybersecurity and data protection practices across the company . Personnel reporting to the CISO have relevant educational and industry experience in threat hunting and intelligence, digital standards, data privacy, cyber training, and security operations center management. In addition to internal capabilities, we regularly engage consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks. The CISO receives ongoing reporting on cybersecurity threats and, together with management, regularly reviews risk management measures to identify, assess, and mitigate data protection and cybersecurity risks. The CISO also works closely with the company's Senior Counsel, Brand, Cyber & Privacy, to oversee compliance with legal, regulatory, and contractual security requirements, and coordinates with our executive leadership, as well as other leaders from our legal and finance organizations to support timely materiality assessments and, where required, public disclosure.
Risk Management and Strategy
As part of our ERM program, we conduct an annual evaluation of cybersecurity risks and share the results with management and the A&FC. The CISO and internal subject-matter experts review scenarios, such as data theft, cash theft, widespread outages, and business disruptions, and the potential consequences. We maintain a continuous monitoring program to detect and respond to potential threats in near real time. Log data from technical controls are collected, aggregated, and correlated in a Security Information and Event Management (SIEM) system that identifies and categorizes events and analyzes them. If the SIEM identifies a potential security event, it can direct controls to stop the activity and generate alerts for detection and response. Alerts are monitored by a managed security service provider that augments our dedicated internal Security Operations Center team.
Third‑Party Risk Management
We operate a third‑party risk management (TPRM) program to identify, assess, monitor, and mitigate risks associated with third‑party relationships, including cybersecurity risks. The TPRM program is designed to help confirm that appropriate controls and measures are in place to manage potential risks and vulnerabilities associated with third parties.
Our policies and procedures govern the lifecycle from initial due diligence, selection, and contracting through oversight and termination, and include provisions to address security incident notification and cooperation when appropriate.
Audit and Third-party Assessments
Our Internal Audit organization conducts audits across our information technology and operational technology environments to evaluate compliance with information security policies and standards. Process control network assurance audits are conducted on a risk‑based rotating schedule, providing coverage across each major operational business area at intervals no greater than five years. We also engage external cybersecurity experts to conduct assessments, penetration testing, and cybersecurity maturity assessments.
Incident Response
Our ECIRP provides a documented framework for responding to cybersecurity incidents, including investigating, containing, documenting, and mitigating incidents, with defined reporting to senior management and other key stakeholders and escalation to the Board, when appropriate.
Materiality and Disclosure Practices
We have experienced actual and attempted cybersecurity events and incidents on our networks and systems in the past; however, we do not believe that any of these events or incidents, individually, or in the aggregate, have materially affected our business, operations, or financial condition, or are reasonably likely to have such an effect. Our procedures include defined processes for prompt escalation of potentially material cybersecurity incidents to our management for materiality assessment and, if required, public disclosure in accordance with applicable securities laws and regulations. For additional information concerning cybersecurity risks, see "Item 1A. Risk Factors."
Earlier filings on record
Fiscal 2024 Form 10-K, filed February 21, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
Audit and Finance Committee
“The Audit and Finance Committee of the Board of Directors (the Audit and Finance Committee) is responsible for overseeing the company's Enterprise Risk Management (ERM) program, including oversight of the processes management has implemented to assess, identify and manage risks associated with cybersecurity and information technology.”
Person named in the filing
not identified
Experience, as stated
Stated
“At the management level, our CISO has extensive cybersecurity knowledge and skills gained from work experience at the company and with a law enforcement agency, as well as from obtaining advanced professional certifications.”
Material incident
The filing states none
“Although we have experienced actual and attempted cybersecurity events and incidents on our networks and systems in the past, we do not believe that the risks from any of these events or incidents, individually or in the aggregate, have materially affected our business, operations, or financial condition, or are reasonably likely to have such an effect.”
Read by claude-sonnet-5-5 on October 16, 2026; every quote verified in the stored text by code.
Item 1C. CYBERSECURITY
Management has implemented a comprehensive cybersecurity program that is designed to protect our information, and that of our customers and suppliers, against cybersecurity threats that may materially and adversely affect the confidentiality, integrity, and availability of our information systems. Our cybersecurity program includes processes and standards that leverage recognized cybersecurity frameworks, industry best practices and guidance from U.S. Government security directives that focus on cybersecurity and critical infrastructure.
Cybersecurity Governance
Board of Directors
The Audit and Finance Committee of the Board of Directors (the Audit and Finance Committee) is responsible for overseeing the company's Enterprise Risk Management (ERM) program, including oversight of the processes management has implemented to assess, identify and manage risks associated with cybersecurity and information technology.
In carrying out this responsibility, the Audit and Finance Committee regularly receives written reports from the company's Chief Information Security Officer (CISO) and periodic briefings from the CISO. These presentations may address a wide range of topics, such as the results of recent vulnerability assessments and third-party independent reviews, changes to the threat environment, technological trends and other recent developments, and peer and other third-party benchmarking.
The Audit and Finance Committee makes regular reports to the Board of Directors on data protection and cybersecurity matters. The company maintains an Enterprise Cybersecurity Incident Response Plan (ECIRP) which provides the framework for management's response to cyber-related incidents and escalation protocols, including, when appropriate, prompt reporting to the Board of Directors.
Management
At the management level, our CISO has extensive cybersecurity knowledge and skills gained from work experience at the company and with a law enforcement agency, as well as from obtaining advanced professional certifications. The CISO is responsible for the assessment and management of risks from cybersecurity threats and leads a team responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across the company. The individuals who report directly to our CISO possess relevant educational and industry experience in the areas of cyber threat hunting and intelligence, digital standards, data privacy, cyber training, and cybersecurity operations center management. In addition to our internal cybersecurity capabilities, we also regularly engage consultants, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. The CISO receives reports on cybersecurity threats on an ongoing basis, and in conjunction with management, regularly reviews risk management measures implemented by the company to identify, assess and mitigate data protection and cybersecurity risks. Our CISO works closely with the company's Senior Counsel, Intellectual Property and Data Protection, to oversee compliance with legal, regulatory and contractual security requirements.
Risk Management and Strategy
On an annual basis, we conduct an evaluation of our cybersecurity risks as part of the ERM program. Through the ERM program, the CISO and other internal subject matter experts review potential cybersecurity threat scenarios, such as data theft, cash theft, widespread outages and business disruptions, and the potential consequences of such scenarios. The results of the risk assessment are shared with management and the Audit and Finance Committee.
We have a continuous monitoring program to detect and respond to potential cybersecurity threats in real-time. Log data from our technical controls are collected, aggregated, and correlated in a Security Information and Event Management (SIEM) system that identifies and categorizes events, as well as analyzes them. If the SIEM system identifies a potential security event, it can direct other controls to stop the activity and also generate alerts for detection and response. These alerts are monitored by a managed security service provider that augments our dedicated internal Security Operations Center team.
In addition, we utilize a third-party risk management (TPRM) program to identify, assess, monitor, and mitigate risks associated with third-party relationships, including cybersecurity risks. The TPRM program is designed to help ensure proper controls and measures are in place to manage the potential risks and vulnerabilities associated with third parties. Our policies and procedures aid in the governance from initial due diligence, selection, and contracting to termination.
With respect to cybersecurity incident response, our ECIRP provides a documented framework for responding to cybersecurity incidents. The ECIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.
Our Internal Audit organization performs audits of our cybersecurity program. Each year, we conduct audits across the company's information technology and operation technology infrastructure, networks, systems, applications, and operational processes and procedures to evaluate compliance with our information security policies and standards. Process control network assurance audits are conducted on a rotating schedule that is risk-based and provides coverage across each major operational business area no greater than five years. In addition to the internal audits, we also engage external cybersecurity experts and auditors to conduct assessments, penetration testing, and cybersecurity maturity assessments . Although we have experienced actual and attempted cybersecurity events and incidents on our networks and systems in the past, we do not believe that the risks from any of these events or incidents, individually or in the aggregate, have materially affected our business, operations, or financial condition, or are reasonably likely to have such an effect. For more information concerning cybersecurity risks we face , see the discussion in "Item 1A. Risk Factors" in this report.
Fiscal 2023 Form 10-K, filed February 21, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
Audit and Finance Committee
“The Audit and Finance Committee of the Board of Directors (the Audit and Finance Committee) is responsible for overseeing the company's Enterprise Risk Management (ERM) program, including oversight of the processes management has implemented to assess, identify and manage risks associated with cybersecurity and information technology.”
Person named in the filing
not identified
Experience, as stated
Stated
“At the management level, our CISO has extensive cybersecurity knowledge and skills gained from work experience at the company and with a law enforcement agency, as well as from obtaining advanced professional certifications.”
Material incident
The filing states none
“Although we have experienced actual and attempted cybersecurity events and incidents on our networks and systems in the past, we do not believe that the risks from any of these events or incidents, individually or in the aggregate, have materially affected our business, operations, or financial condition, or are reasonably likely to have such an effect.”
Read by claude-sonnet-5-5 on October 16, 2026; every quote verified in the stored text by code.
Item 1C. CYBERSECURITY
Management has implemented a comprehensive cybersecurity program that is designed to protect our information, and that of our customers and suppliers, against cybersecurity threats that may materially and adversely affect the confidentiality, integrity, and availability of our information systems. Our cybersecurity program includes processes and standards that leverage recognized cybersecurity frameworks, industry best practices and guidance from U.S. Government security directives that focus on cybersecurity and critical infrastructure.
Cybersecurity Governance
Board of Directors
The Audit and Finance Committee of the Board of Directors (the Audit and Finance Committee) is responsible for overseeing the company's Enterprise Risk Management (ERM) program, including oversight of the processes management has implemented to assess, identify and manage risks associated with cybersecurity and information technology. In carrying out this responsibility, the Audit and Finance Committee regularly receives written reports from the company's Chief Information Security Officer (CISO) and periodic briefings from the CISO. These presentations may address a wide range of topics, such as the results of recent vulnerability assessments and third-party independent reviews, changes to the threat environment, technological trends and other recent developments, and peer and other third-party benchmarking. The Audit and Finance Committee makes regular reports to the Board of Directors on data protection and cybersecurity matters. The company maintains an Enterprise Cybersecurity Incident Response Plan (ECIRP) which provides the framework for management's response to cyber-related incidents and escalation protocols, including, when appropriate, prompt reporting to the Board of Directors.
Management
At the management level, our CISO has extensive cybersecurity knowledge and skills gained from work experience at the company and with a law enforcement agency, as well as from obtaining advanced professional certifications. The CISO is responsible for the assessment and management of risks from cybersecurity threats and leads a team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across the company. The individuals who report directly to our CISO possess relevant educational and industry experience in the areas of cyber threat hunting and intelligence, digital standards, data privacy, cyber training, and cybersecurity operations center management. In addition to our internal cybersecurity capabilities, we also regularly engage consultants, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. The CISO receives reports on cybersecurity threats on an ongoing basis, and in conjunction with management, regularly reviews risk management measures implemented by the company to identify, assess and mitigate data protection and cybersecurity risks. Our CISO works closely with the company's Senior Counsel, Intellectual Property and Data Protection, to oversee compliance with legal, regulatory and contractual security requirements.
Index to Financial Statements
Risk Management and Strategy
On an annual basis, we conduct an evaluation of our cybersecurity risks as part of the ERM program. Through the ERM program, the CISO and other internal subject matter experts review potential cybersecurity threat scenarios, such as data theft, cash theft, widespread outages and business disruptions, and the potential consequences of such scenarios. The results of the risk assessment are shared with management and the Audit and Finance Committee.
We have a continuous monitoring program to detect and respond to potential cybersecurity threats in real-time. Log data from our technical controls are collected, aggregated, and correlated in a Security Information and Event Management (SIEM) system that identifies and categorizes events, as well as analyzes them. If the SIEM system identifies a potential security event, it can direct other controls to stop the activity and also generate alerts for detection and response. These alerts are monitored by a managed security service provider that augments a dedicated internal Security Operations Center team.
In addition, we utilize a third-party risk management (TPRM) program to identify, assess, monitor, and mitigate risks associated with third-party relationships, including cybersecurity risks. The TPRM program is designed to help ensure proper controls and measures are in place to manage the potential risks and vulnerabilities associated with third parties. Our policies and procedures aid in the governance from initial due diligence, selection, and contracting to termination.
With respect to cybersecurity incident response, our ECIRP provides a standardized framework for responding to cybersecurity incidents. The ECIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.
Internal audit performs audits of our cybersecurity program. Each year, we conduct audits across the company's information technology and operation technology infrastructure, networks, systems, applications, and operational processes and procedures to evaluate compliance with our information security policies and standards. Process control network assurance audits are conducted on a rotating schedule that is risk-based and provides coverage across each operational business area no greater than five years. In addition to the internal audits, we also engage external cybersecurity experts and auditors to conduct assessments, penetration testing, and cybersecurity maturity assessments. Although we have experienced actual and attempted cybersecurity events and incidents on our networks and systems in the past, we do not believe that the risks from any of these events or incidents, individually or in the aggregate, have materially affected our business, operations, or financial condition, or are reasonably likely to have such an effect. For more information concerning cybersecurity risks we face, see the discussion in "Item 1A. Risk Factors" in this report.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.