Disclosure · Form 10-K · fiscal 2026
Science Applications International Corp 10-K cybersecurity disclosure (Item 1C), fiscal 2026
Filed March 16, 2026· period ended January 30, 2026· SAIC· CIK 1571123· Updated · filing on sec.gov ↗
Science Applications International Corp's Form 10-K for fiscal 2026, filed March 16, 2026, names the Chief Information Security Officer as its top security role, with oversight by the Audit Committee.
What Science Applications International's Item 1C says
Science Applications International's Form 10-K for fiscal 2026 names the Audit Committee as the primary board committee overseeing enterprise cybersecurity risks. The filing says the information security program is led by the corporate Chief Information Security Officer.
Board and management oversight
The Audit Committee receives information regarding such risks from management, including the CISO, and reports to the Board on a quarterly basis. The Audit Committee also oversees the Board's response to any significant cybersecurity incidents. The Nominating and Corporate Governance Committee of the Board of Directors oversees the enterprise risk management process. The Chief Risk Officer reports to the Nominating and Corporate Governance Committee on a quarterly basis regarding the ERM program. Senior leadership continually monitors cybersecurity risks and their mitigations as part of enterprise risk management.
Who leads security
The corporate Chief Information Security Officer leads the information security program and works closely with stakeholders, including the Chief Information Officer. The CISO provides regular updates and written reports on cybersecurity posture and preparedness to senior management, the Audit Committee, the Nominating and Corporate Governance Committee and the Board. Those leading and supporting the information security program demonstrate cybersecurity expertise through qualifications such as prior work experience, a cybersecurity certification, a degree, or other cybersecurity experience.
How the company manages cyber risk
The company's cybersecurity program is integrated into its overall risk management systems and includes continuous monitoring, vulnerability management, penetration testing and employee training. The incident response plan provides steps to identify, mitigate, and recover from incidents, and procedures to escalate issues to senior management, legal, and, when appropriate, the Board of Directors. The company says it adheres to standards set by the National Institute of Standards and Technology and the International Organization for Standardization. The company is participating in the CMMC program and plans to obtain the appropriate CMMC certification.
Third parties and incidents
The company conducts due diligence on the cybersecurity practices and controls of its third-party providers and includes provisions in contracts requiring appropriate cybersecurity measures. Third-party service providers assess the company's security controls through penetration testing, independent audits, and consulting on best practices. The filing states that a material cybersecurity incident could have a material adverse effect on the company's financial condition, results of operations, or cash flows.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed March 16, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Information Security Officer
Reports to
not identified
Board oversight
Audit Committee
“The Audit Committee is the primary committee that oversees enterprise cybersecurity risks and reviews cybersecurity matters, including our policies and procedures for protecting our cybersecurity infrastructure and for compliance with data protection and security regulations, and related risks.”
How often the board or committee hears about it
Quarterly
“The Chief Risk Officer reports to the Nominating and Corporate Governance Committee on a quarterly basis regarding the ERM program.”
CISO or other person named
not identified
Frameworks and standards named
CMMC, NIST (publication not named)
Where the filing names them
- CMMC: “As a defense contractor, we must comply with DoW cybersecurity requirements for handling Controlled Unclassified Information ("CUI") and requirements in the Defense Federal Acquisition Regulation Supplement ("DFARS") regarding reporting cybersecurity incidents to the DoW, including the DoW's Cybersecurity Maturity Model Certification ("CMMC") program.”
- NIST (publication not named): “We also adhere to the standards set forth by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization ("ISO") to ensure the highest level of security and operational excellence.”
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“They and the other individuals supporting our information security program demonstrate their cybersecurity expertise through qualifications such as prior work experience, possession of a cybersecurity certification, degree, or other cybersecurity experience.”
Material incident
The filing states none
“A cybersecurity incident involving us or our subcontractors or suppliers could materially affect our operations, performance, and results.”
The section
849 words, Form 10-K filed March 16, 2026 for the period ended January 30, 2026
Read by claude-sonnet-5-5 on October 23, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Science Applications International Corp standard industrial classification 7373, Services-computer integrated systems design (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| OpenTextFY 2026, filed August 6, 2026 | Chief Information Security Officer | Chief Digital Officer (CDO) | Audit Committee |
| KyndrylFY 2026, filed May 29, 2026 | CISO | not identified | Audit Committee |
| OMNIQ Corp.FY 2025, filed April 15, 2026 | not identified | not identified | audit committee |
| Super League Enterprise, Inc.FY 2025, filed March 31, 2026 | not identified | not identified | Audit Committee |
| Fusemachines Inc.FY 2025, filed March 27, 2026 | Head of Technology | not identified | Audit Committee |
| Telos CorpFY 2025, filed March 16, 2026 | Chief Information Security Officer | Chief Information Technology Officer | Audit Committee |
| OneSpanFY 2025, filed February 26, 2026 | Chief Information Security Officer | CIO | Audit Committee |
| Ribbon Communications Inc.FY 2025, filed February 26, 2026 | Chief Information Security Officer | Chief Information Officer | Audit Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Science Applications International Corp's Form 10-K as filed with the SEC on March 16, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity
Risk Management and Strategy
We are subject to various cybersecurity risks and continuously monitor and assess our cybersecurity measures to protect against a multitude of cyber threats from adversaries, including nation state actors, that target critical infrastructure sectors such as the defense industrial base. A cybersecurity incident involving us or our subcontractors or suppliers could materially affect our operations, performance, and results.
We expend considerable resources on our cybersecurity management and oversight program designed to identify, manage, and mitigate cybersecurity risks. This program is integrated into our overall risk management systems and processes and includes continuous monitoring of cybersecurity threats, regular assessments of information systems, vulnerability management, penetration testing, employee training on cybersecurity best practices, and ongoing assessments of risk.
We have established an incident response plan to promptly and effectively address cybersecurity incidents. The incident response plan provides steps to identify, mitigate, and recover from incidents, and procedures to escalate issues to senior management, legal, and, when appropriate, our Board of Directors. The plan includes procedures for investigating and containing incidents, notifying affected parties, as appropriate, and implementing corrective actions.
As a defense contractor, we must comply with DoW cybersecurity requirements for handling Controlled Unclassified Information ("CUI") and requirements in the Defense Federal Acquisition Regulation Supplement ("DFARS") regarding reporting cybersecurity incidents to the DoW, including the DoW's Cybersecurity Maturity Model Certification ("CMMC") program. We are participating in this program and plan to obtain the appropriate CMMC certification. We also adhere to the standards set forth by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization ("ISO") to ensure the highest level of security and operational excellence. Our commitment to compliance with these rigorous frameworks is integral to maintaining the confidentiality, integrity, and availability of our services and products.
We rely on various third-party providers, such as vendors, suppliers and other business partners for certain aspects of our operations. These third parties are also susceptible to cybersecurity risks. We conduct due diligence on the cybersecurity practices and controls on these providers and include provisions in our contracts requiring appropriate cybersecurity measures. In addition, in the case of a third-party cybersecurity incident, we identify and mitigate risks to minimize the effects to us from third-party incidents.
We share and receive threat intelligence with our peers in the defense industrial base, government agencies, information sharing and analysis centers, and cybersecurity associations. We have relationships with third-party service providers who also assess our security controls through penetration testing, independent audits, and consulting on best practices to address emerging challenges. These assessments evaluate the effectiveness of our security controls.
Governance
Management's Responsibilities
Our information security program is led by our corporate Chief Information Security Officer ("CISO") , who works closely in a cross-functional capacity with key corporate and operational business stakeholders, including our Chief Information Officer. They and the other individuals supporting our information security program demonstrate their cybersecurity expertise through qualifications such as prior work experience, possession of a cybersecurity certification, degree, or other cybersecurity experience. The CISO collaborates with these functions for the purpose
SCIENCE APPLICATIONS INTERNATIONAL CORPORATION
of establishing processes and procedures to monitor potential cybersecurity risks, identifying cybersecurity incidents, implementing appropriate mitigation measures, reporting cybersecurity breaches, assessing materiality, maintaining our cybersecurity program, and other information security incidents. The CISO provides regular updates and written reports on our cybersecurity posture and preparedness to senior management, the Audit Committee, the Nominating and Corporate Governance Committee and the Board.
Board of Directors' Roles and Responsibilities
Our cybersecurity risks and associated mitigations, as part of our enterprise risk management ("ERM"), are continually monitored by senior leadership. The Nominating and Corporate Governance Committee of our Board of Directors oversees the ERM process. The Chief Risk Officer reports to the Nominating and Corporate Governance Committee on a quarterly basis regarding the ERM program.
These risks and mitigations are also subject to oversight by the Audit Committee of our Board of Directors. The Audit Committee is the primary committee that oversees enterprise cybersecurity risks and reviews cybersecurity matters, including our policies and procedures for protecting our cybersecurity infrastructure and for compliance with data protection and security regulations, and related risks. The Audit Committee receives information regarding such risks from management, including our CISO, and reports to the Board on a quarterly basis. The Audit Committee also oversees the Board's response to any significant cybersecurity incidents.
Cybersecurity Threats
While we have taken significant steps to manage cybersecurity risks, there can be no assurance that these measures will prevent all potential incidents. A material cybersecurity incident could have material adverse effect on our financial condition, results of operations, or cash flows. We are committed to addressing cybersecurity risks in an ever-evolving technological landscape. Management will continue to evaluate and enhance its cybersecurity measures to adapt to emerging threats and comply with evolving regulatory requirements.
We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our organizational strategy, results of operations, or financial condition as part of our risk factor disclosures in Part I, Item 1A of this report.
Earlier filings on record
Fiscal 2025 Form 10-K, filed March 17, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
not identified
Person named in the filing
not identified
Experience, as stated
Stated
“They and the other individuals supporting our information security program demonstrate their cybersecurity expertise through qualifications such as prior work experience, possession of a cybersecurity certification, degree, or other cybersecurity experience.”
Material incident
The filing states none
“A material cybersecurity incident could have material adverse effect on our financial condition, results of operations, or cash flows.”
Read by claude-sonnet-5-5 on October 23, 2026; every quote verified in the stored text by code; 1 proposed field not found in the text and left empty.
Item 1C. Cybersecurity
Risk Management and Strategy
We are subject to various cybersecurity risks and continuously monitor and assess our cybersecurity measures to protect against a multitude of cyber threats from adversaries, including nation state actors, that target critical infrastructure sectors such as the defense industrial base. A cybersecurity incident impacting us or our subcontractors or suppliers could materially adversely affect our operations, performance, and results.
We expend considerable resources on our cybersecurity management and oversight program designed to identify, manage, and mitigate cybersecurity risks. This program is integrated into our overall risk management systems and processes and includes continuous monitoring of cybersecurity threats, regular assessments of information systems, vulnerability management, penetration testing, employee training on cybersecurity best practices, and ongoing assessments of risk.
We have established an incident response plan to promptly and effectively address cybersecurity incidents. The incident response plan provides steps to identify, mitigate, and recover from incidents, and procedures to escalate issues to senior management, legal, and, when appropriate, our Board of Directors. The plan includes procedures for investigating and containing incidents, notifying affected parties, as appropriate, and implementing corrective actions.
As a defense contractor, we must comply with DoD cybersecurity requirements for handling Controlled Unclassified Information ("CUI") and requirements in the Defense Federal Acquisition Regulation Supplement ("DFARS") regarding reporting cybersecurity incidents to the DoD, including the DoD's Cybersecurity Maturity Model Certification ("CMMC") program. We are prepared to participate in this program and obtain associated CMMC certification. We also adhere to the standards set forth by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization ("ISO") to ensure the highest level of security and operational excellence. Our commitment to compliance with these rigorous frameworks is integral to maintaining the confidentiality, integrity, and availability of our services and products.
We rely on various third-party providers, such as vendors, suppliers and other business partners for certain aspects of our operations. These third parties are also susceptible to cybersecurity risks. We conduct due diligence on the cybersecurity practices and controls on these providers and include provisions in our contracts requiring appropriate cybersecurity measures. In addition, in the case of a third-party cybersecurity incident, we identify and mitigate risks to minimize impacts to us from third-party incidents.
We share and receive threat intelligence with our peers in the defense industrial base, government agencies, information sharing and analysis centers, and cybersecurity associations. We have relationships with third-party service providers who also assess our security controls through penetration testing, independent audits, and consulting on best practices to address emerging challenges. These assessments evaluate the effectiveness of our security controls.
Governance
Management's Responsibilities
Our information security program is led by our corporate Chief Information Security Officer ("CISO") , who works closely in a cross-functional capacity with key corporate and operational business stakeholders, including our Chief Information Officer. They and the other individuals supporting our information security program demonstrate their cybersecurity expertise through qualifications such as prior work experience, possession of a cybersecurity certification, degree, or other cybersecurity experience. The CISO collaborates with these functions for the purpose of establishing processes and procedures to monitor potential cybersecurity risks, identifying cybersecurity incidents, implementing appropriate mitigation measures, reporting cybersecurity breaches, assessing materiality,
SCIENCE APPLICATIONS INTERNATIONAL CORPORATION
maintaining our cybersecurity program, and other information security incidents. The CISO provides regular updates on our cybersecurity posture and preparedness to senior management.
Board of Directors' Roles and Responsibilities
Our cybersecurity risks and associated mitigations, as part of our enterprise risk management, are continually monitored by senior leadership. These risks and mitigations are also subject to oversight by the Audit Committee and the Risk Oversight Committee ("ROC") of our Board of Directors. The ROC is the primary committee that oversees enterprise cybersecurity risks and reviews cybersecurity matters, including our policies and procedures for protecting our cybersecurity infrastructure and for compliance with data protection and security regulations, and related risks. The ROC receives information regarding such risks from management, including our CISO, and reports to the Board on a quarterly basis. The ROC also oversees the Board's response to any significant cybersecurity incidents.
Cybersecurity Threats
While we have taken significant steps to manage cybersecurity risks, there can be no assurance that these measures will prevent all potential incidents. A material cybersecurity incident could have material adverse effect on our financial condition, results of operations, or cash flows. We are committed to addressing cybersecurity risks in an ever-evolving technological landscape. Management will continue to evaluate and enhance its cybersecurity measures to adapt to emerging threats and comply with evolving regulatory requirements.
We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our organizational strategy, results of operations, or financial condition as part of our risk factor disclosures in Part I, Item 1A of this report.
Fiscal 2024 Form 10-K, filed March 20, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
not identified
Person named in the filing
not identified
Experience, as stated
Stated
“The individuals supporting the Company's information security program demonstrate their cybersecurity expertise through qualifications such as prior work experience, possession of a cybersecurity certification, degree, or other cybersecurity experience.”
Material incident
The filing states none
“To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business operations or financial condition.”
Read by claude-sonnet-5-5 on October 23, 2026; every quote verified in the stored text by code; 1 proposed field not found in the text and left empty.
Item 1C. Cybersecurity
Risk Management and Strategy
The Company is subject to various cybersecurity risks and continuously monitors and assesses its cybersecurity measures to protect against potential threats. These risks include operational disruption, reputational harm, theft of intellectual property, fraud, extortion, harm to customers or employees, and violation of data privacy or security laws.
The Company has a comprehensive cybersecurity management and oversight program designed to identify, manage, and mitigate potential risks. This program is integrated into our overall risk management systems and processes and includes continuous monitoring of cybersecurity threats, regular assessments of information systems, vulnerability management, penetration testing, employee training on cybersecurity best practices, and ongoing assessments of risk.
In the event of a cybersecurity incident, the Company has established an incident response plan to promptly and effectively address the situation. Cybersecurity events and data incidents are evaluated, ranked by severity and prioritized for escalation to senior management and the Risk Oversight Committee ("ROC") of our Board of Directors, response and remediation. The plan includes procedures for investigating and containing incidents, notifying affected parties, and implementing corrective actions to prevent future occurrences.
The Company relies on various third party providers, such as vendors, suppliers and other business partners for certain aspects of its operations. These third parties may also be susceptible to cybersecurity risks. The Company conducts due diligence on the cybersecurity practices and controls on these providers, as well as inclusion of contractual provisions requiring the providers to maintain appropriate cybersecurity measures. In addition, in the case of a third-party cybersecurity incident, the Company identifies and mitigates risks to minimize impacts to us from third party incidents.
Governance
Management's Responsibilities
The Company's information security program is led by our corporate Chief Information Security Officer ("CISO"), who works closely in a cross-functional capacity with key corporate and operational business stakeholders. The individuals supporting the Company's information security program demonstrate their cybersecurity expertise through qualifications such as prior work experience, possession of a cybersecurity certification, degree, or other cybersecurity experience. The CISO collaborates with these functions for the purpose of establishing processes and procedures to monitor potential cybersecurity risks, identifying cybersecurity incidents, implementing appropriate mitigation measures, reporting cybersecurity breaches, assessing materiality, and other information security incidents, and maintaining our cybersecurity program. The CISO provides regular updates on the Company's cybersecurity posture and preparedness to senior management.
Board of Directors' Roles and Responsibilities
Our cybersecurity risks and associated mitigations, as part of our enterprise risk management, are evaluated by senior leadership. These risks and mitigations are also subject to oversight by the Audit Committee and the ROC of our Board of Directors The ROC is the primary committee that oversees enterprise cybersecurity risks and reviews cybersecurity matters. The ROC oversees our policies and procedures for protecting our cybersecurity infrastructure
SCIENCE APPLICATIONS INTERNATIONAL CORPORATION
and for compliance with data protection and security regulations, and related risks. The ROC receives information regarding such risks from management, including our CISO, and reports to the Board on a quarterly basis. The ROC also oversees the Board's response to any significant cybersecurity incidents.
Cybersecurity Threats
To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business operations or financial condition. While the Company has taken significant steps to manage cybersecurity risks, there can be no assurance that these measures will prevent all potential incidents. A material cybersecurity incident could have material adverse effect on the Company's financial condition, results of operations, or cash flows. The Company is committed to addressing cybersecurity risks in an ever-evolving technological landscape. Management will continue to evaluate and enhance its cybersecurity measures to adapt to emerging threats and comply with evolving regulatory requirements.
We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our organizational strategy, results of operations, or financial condition as part of our risk factor disclosures in Part I, Item 1A of this report.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.