Disclosure · Form 10-K · fiscal 2025
908 Devices Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 9, 2026· period ended December 31, 2025· MASS· CIK 1555279· Updated · filing on sec.gov ↗
908 Devices Inc.'s Form 10-K for fiscal 2025, filed March 9, 2026, names the Senior Director of Information Technology as its top security role, with oversight by the audit committee.
What 908 Devices' Item 1C says
908 Devices' Form 10-K for fiscal 2025 places oversight of cybersecurity risk with the board of directors, which exercises its oversight function through the audit committee. The Senior Director of Information Technology is responsible for the day-to-day administration and management of the cybersecurity program.
Board and management oversight
The board of directors, as a whole and through its committees, holds overall oversight responsibility for risk management processes, including in relation to risks from cybersecurity threats. The audit committee receives quarterly reports from the Senior Director of Information Technology on the status of the cybersecurity program. The Chair of the audit committee provides a quarterly report to the board of directors, which includes updates on certain cybersecurity matters, as applicable.
Who leads security
The Senior Director of Information Technology is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments. The Senior Director of Information Technology has approximately 21 years of information technology experience, including 12 years of cybersecurity experience.
How the company manages cyber risk
The company maintains various information security processes designed to identify, assess and manage material risks from cybersecurity threats to its critical computer networks. The company's assessment and management of material cybersecurity risks are integrated into its overall risk management processes. The Senior Director of Information Technology and the incident response team are tasked with helping to identify, assess and manage the company's cybersecurity threats and risks. The company's cybersecurity incident response processes are designed to escalate certain incidents to members of management depending on the circumstances, including the Chief Financial Officer and Chief Legal and Administrative Officer.
Third parties and incidents
The company has a vendor management program designed to manage cybersecurity risks associated with its use of third-party service providers. From time to time, the company uses third-party service providers such as cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms to help manage cybersecurity risks. The company works with external security service providers to support security monitoring and threat detection and reports relevant findings to the Senior Director of Information Technology. The company's incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a specific security framework or standard.
Read from the Form 10-K filed March 9, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Senior Director of Information Technology
Reports to
not identified
Board oversight
audit committee
“Our board of directors exercises its oversight function through the audit committee , which oversees the management of risk exposure across various areas, including cybersecurity risks.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“Our Senior Director of Information Technology has approximately 21 years of information technology experience, including 12 years of cybersecurity experience.”
Material incident
not identified
The section
908 words, Form 10-K filed March 9, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns 908 Devices Inc. standard industrial classification 3829, Measuring & controlling devices, nec (SEC SIC list). 3 other filers in our library have the same code. Also shown: filers whose codes the SEC assigns to the same review office (Industrial Applications and Services).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Birchtech Corp.FY 2025, filed March 31, 2026 | Vice President of Operations | Board of Directors | full board |
| Owlet, Inc.FY 2025, filed March 9, 2026 | Chief Technology Officer | not identified | Audit Committee |
| Rockwell AutomationFY 2025, filed November 12, 2025 | Chief Information Security Officer | Chief Information Officer (CIO) | Audit Committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Advanced Biomed Inc.FY 2026, filed October 13, 2026 | Chief Executive Officer | not identified | not identified |
| Bion Environmental Technologies IncFY 2026, filed September 29, 2026 | not identified | not identified | full board |
| Bloomia Holdings, Inc.FY 2026, filed September 21, 2026 | not identified | not identified | Audit Committee |
| Karbon-X Corp.FY 2026, filed September 15, 2026 | Chief Executive Officer | not identified | full board |
| Aehr Test SystemsFY 2026, filed July 27, 2026 | Chief Operating Officer | not identified | Audit Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of 908 Devices Inc.'s Form 10-K as filed with the SEC on March 9, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity.
Cybersecurity Risk Management and Strategy
We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature (collectively, Information Systems and Data).
Our Senior Director of Information Technology and our incident response team are tasked with helping to identify, assess and manage the Company's cybersecurity threats and risks. They identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, conducting scans of the threat environment, internal and external audits, and conducting vulnerability assessments to identify vulnerabilities.
Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plans , disaster recovery and business continuity plans, risk assessments, encryption of data, network security controls, data segregation, access controls, physical security measures, systems monitoring, employee training, penetration testing, cybersecurity insurance, as well as asset management, tracking and disposal.
Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, as part of our cybersecurity risk management program, we have a process to assess and review the cybersecurity practices of major third-party vendors and service providers that access, process, collect, share, create, store, transmit or destroy our information or have access to our systems, including through review of applicable certifications, and security reports, and contractual requirements, as appropriate.
From time to time, we use third-party service providers to assist us in an effort to identify, assess, and manage material risks from cybersecurity threats, including, for example: cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms.
We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers, which includes, as appropriate, a review of the relevant vendor's security program. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.
For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security. Our actual or perceived failure (or that of the third parties with whom we work) to comply with such obligations could lead to regulatory investigations or actions; litigation (including class claims) and mass arbitration demands; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse business consequences."
Governance Related to Cybersecurity Risks
Our board of directors, as a whole and through its committees, holds overall oversight responsibility for our risk management processes, including in relation to risks from cybersecurity threats. Our board of directors exercises its oversight function through the audit committee , which oversees the management of risk exposure across various areas, including cybersecurity risks. The audit committee receives quarterly reports from our Senior Director of Information Technology on the status of our cybersecurity program, including measures designed to monitor and address cybersecurity risks and threats, as appropriate. The Chair of the audit committee provides a quarterly report to the board of directors, which includes updates on certain cybersecurity matters, as applicable.
Our Senior Director of Information Technology is responsible for the day-to-day administration and management of our cybersecurity program, including hiring appropriate personnel, helping to integrate cybersecurity risk considerations
into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Senior Director of Information Technology is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our Senior Director of Information Technology has approximately 21 years of information technology experience, including 12 years of cybersecurity experience. We also work with external security service providers to support our security monitoring and threat detection capabilities and have implemented a process to report relevant findings to the Senior Director of Information Technology and other members of executive management, where appropriate.
Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Financial Officer and Chief Legal and Administrative Officer, who work with the Company's incident response team to help the Company respond to, mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 7, 2025 sec.gov ↗
Top security role, as the filing names it
Director of Information Technology
Reports to, as the filing names it
Chief Product Officer
“Our Director of Information Technology is responsible for the day-to-day administration and management of our cybersecurity program, under the direct supervision of our Chief Product Officer (formerly our Chief Technology Officer) .”
Board oversight
audit committee
“Our board of directors exercises its oversight function through the audit committee, which oversees the management of risk exposure across various areas, including cybersecurity risks, in accordance with its charter.”
Person named in the filing
not identified
Experience, as stated
Stated
“Currently, the Director of Information Technology role is held by an individual who has approximately 20 years of information technology experience and 11 years of cybersecurity experience.”
Material incident
The filing states none
“We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition ; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security”
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
Governance Related to Cybersecurity Risks
Our board of directors, as a whole and through its committees, holds overall oversight responsibility for our risk management processes, including in relation to risks from cybersecurity threats. Our board of directors exercises its oversight function through the audit committee, which oversees the management of risk exposure across various areas, including cybersecurity risks, in accordance with its charter. The audit committee receives quarterly reports from our Director of Information Technology on the status of our cybersecurity program, including measures implemented to monitor and address cybersecurity risks and threats, as appropriate. The Chair of the audit committee provides a quarterly report to the board of directors, which includes any key updates on cybersecurity matters, as applicable.
Our Director of Information Technology is responsible for the day-to-day administration and management of our cybersecurity program, under the direct supervision of our Chief Product Officer (formerly our Chief Technology Officer) . Currently, the Director of Information Technology role is held by an individual who has approximately 20 years of information technology experience and 11 years of cybersecurity experience. We also work with external security service providers to support our security monitoring and threat detection capabilities and have implemented a process to report relevant findings to the Director of Information Technology and up to the Chief Product Officer and other members of executive management, where appropriate.
Cybersecurity Risk Management and Strategy
We maintain a cybersecurity program, which is informed by industry standards, that includes processes for identification, assessment, and management of cybersecurity risks. We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify potential areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security testing and have established a vulnerability management process, supported by security testing, that is designed to address the treatment of identified security risks based on severity.
As part of our cybersecurity risk management program, we have a process to assess and review the cybersecurity practices of major third-party vendors and service providers that access, process, collect, share, create, store, transmit or destroy our information or have access to our systems, including through review of applicable certifications, and security reports, and contractual requirements, as appropriate.
We have implemented a process to periodically conduct security awareness training for employees and simulated phishing campaigns. We also conduct specific training and tabletop exercises for key personnel involved in cybersecurity risk management.
Our Director of Information Technology and his team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third-party security software and technology services. In addition, we use various internal and external processes and technologies, including third-party security solutions, monitoring, and alerting tools and resources, designed to monitor, identify, and address risks from cybersecurity threats. We also have implemented processes and technologies for network monitoring and data loss prevention procedures.
We have adopted an incident response plan to guide us in responding to cybersecurity incidents and maintain processes to inform and update executive management and the audit committee about security incidents that may pose a significant risk for our business, as applicable.
We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition ; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security
incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10 K for more information.
Fiscal 2023 Form 10-K, filed March 8, 2024 sec.gov ↗
Top security role, as the filing names it
Director of Information Technology
Reports to, as the filing names it
Chief Product Officer
“Our Director of Information Technology is responsible for the day-to-day administration and management of our cybersecurity program, under the direct supervision of our Chief Product Officer (formerly our Chief Technology Officer).”
Board oversight
audit committee
“Our board of directors exercises its oversight function through the audit committee, which oversees the management of risk exposure across various areas, including cybersecurity risks, in accordance with its charter.”
Person named in the filing
not identified
Experience, as stated
Stated
“Currently, the Director of Information Technology role is held by an individual who has approximately 19 years of information technology experience and 10 years of cybersecurity experience.”
Material incident
The filing states none
“We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems.”
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
Governance Related to Cybersecurity Risks
Our board of directors, as a whole and through its committees, holds overall oversight responsibility for our risk management processes, including in relation to risks from cybersecurity threats. Our board of directors exercises its oversight function through the audit committee, which oversees the management of risk exposure across various areas, including cybersecurity risks, in accordance with its charter. The audit committee receives quarterly reports from our Director of Information Technology on the status of our cybersecurity program, including measures implemented to monitor and address cybersecurity risks and threats, as appropriate. The Chair of the audit committee provides a quarterly report to the board of directors, which includes any key updates on cybersecurity matters, as applicable.
Our Director of Information Technology is responsible for the day-to-day administration and management of our cybersecurity program, under the direct supervision of our Chief Product Officer (formerly our Chief Technology Officer). Currently, the Director of Information Technology role is held by an individual who has approximately 19 years of information technology experience and 10 years of cybersecurity experience. We also work with external security service providers to support our security monitoring and threat detection capabilities and have implemented a process to report relevant findings to the Director of Information Technology and up to the Chief Product Officer and other members of executive management, where appropriate.
Cybersecurity Risk Management and Strategy
We maintain a cybersecurity program, which is informed by industry standards, that includes processes for identification, assessment, and management of cybersecurity risks. We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify potential areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security testing and have established a vulnerability management process, supported by security testing, that is designed to address the treatment of identified security risks based on severity.
As part of our cybersecurity risk management program, we have a process to assess and review the cybersecurity practices of major third-party vendors and service providers that access, process, collect, share, create, store, transmit or destroy our information or have access to our systems, including through review of applicable certifications, and security reports, and contractual requirements, as appropriate.
We have implemented a process to periodically conduct security awareness training for employees and simulated phishing campaigns. We also conduct specific training and tabletop exercises for key personnel involved in cybersecurity risk management.
Our Director of Information Technology and his team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third-party security software and technology services. In addition, we use various internal and external processes and technologies, including third-party security solutions, monitoring, and alerting tools and resources, designed to monitor, identify, and address risks from cybersecurity threats. We also have implemented processes and technologies for network monitoring and data loss prevention procedures.
We have adopted an incident response plan to guide us in responding to cybersecurity incidents and maintain processes to inform and update executive management and the audit committee about security incidents that may pose a significant risk for our business, as applicable.
We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10 K for more information.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.