Disclosure · Form 10-K · fiscal 2025
Knowles Corp 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 9, 2026· period ended December 31, 2025· KN· CIK 1587523· Updated · filing on sec.gov ↗
Knowles Corp's Form 10-K for fiscal 2025, filed February 9, 2026, names the Vice President and Chief Information Officer as its top security role, with oversight by the Audit Committee.
What Knowles' Item 1C says
Knowles' Form 10-K for fiscal 2025 places oversight of cybersecurity risk with the Audit Committee of the Board of Directors. The filing says the management team, led by the Vice President and Chief Information Officer, has operational responsibility for cybersecurity.
Board and management oversight
The head of Internal Audit reports directly to the Audit Committee and reviews with the committee the company-wide enterprise risk assessment, which includes an evaluation of cybersecurity risks and threats. The Audit Committee separately receives regular reports from the Chief Information Officer on cybersecurity risks and threats, the status of projects to strengthen information security systems, and assessments of the security program. The Chair of the Audit Committee regularly reports to the full Board on the committee's activities, including those related to the cybersecurity risk management program.
Who leads security
The Chief Information Officer has knowledge and skills gained from various roles in information technology and security for over 30 years, including serving as Chief Information Officer at two large public companies. The CIO is supported by a team of enterprise information system and security risk professionals. The CIO receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation.
How the company manages cyber risk
The company designed and assesses its cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework. The company's programs include regular scans, penetration tests, and vulnerability assessments to identify potential threats or vulnerabilities in its systems. The incident response plan outlines roles and responsibilities and criteria for measuring the severity of a cybersecurity incident, and provides for Audit Committee and Board briefings as appropriate. Employees participate in a security awareness program, receiving training on identifying potential cybersecurity risks and safeguarding company resources and information.
Third parties and incidents
The company has engaged external service providers, where appropriate, to assess, test or otherwise assist with aspects of its security processes. In conjunction with Internal Audit, the CIO supervises any retained external cybersecurity consultants. The company also assesses the cybersecurity risks presented by third parties that could adversely affect its business if a cybersecurity incident affected those third-party systems. The company states that to date it has not identified cybersecurity risks that have materially affected or are reasonably likely to materially affect its business strategy, results of operations, or financial condition.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed February 9, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Vice President and Chief Information Officer
Reports to
not identified
Board oversight
Audit Committee
“The Audit Committee of the Board of Directors considers cybersecurity risk and other information technology risk as part of its risk oversight function.”
CISO or other person named
not identified
Frameworks and standards named
NIST Cybersecurity Framework
Where the filing names it
- NIST Cybersecurity Framework: “We designed and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Cybersecurity Framework").”
Outside assessors, consultants or testers
Described
“We have engaged external service providers, where appropriate, including leading cybersecurity firms, to assess, test or otherwise assist with aspects of our security processes.”
Experience of the security leadership, as stated
Stated
“Our CIO has extensive cybersecurity knowledge and skills gained from various roles in information technology and security for over 30 years, including serving as the Chief Information Officer at two large public companies.”
Material incident
The filing states none
“To date, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.”
The section
729 words, Form 10-K filed February 9, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 25, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Knowles Corp standard industrial classification 3651, Household audio & video equipment (SEC SIC list). One other filer in our library has the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Manufacturing).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Emerson Radio CorpFY 2026, filed June 26, 2026 | not identified | not identified | audit committee of the Board |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Insteel Industries IncFY 2026, filed October 29, 2026 | Chief Information Officer | not identified | full board |
| Penguin Solutions, Inc.FY 2026, filed October 20, 2026 | Chief Information Officer | not identified | not identified |
| Napco Security Technologies, IncFY 2026, filed August 24, 2026 | Vice President of Information Technology | not identified | not identified |
| George Risk Industries, Inc.FY 2026, filed August 7, 2026 | IT Manager | CEO | audit committee |
| News CorpFY 2026, filed August 7, 2026 | Chief Information Security Officer | Chief Technology Officer | Audit Committee |
| NikeFY 2026, filed July 15, 2026 | Vice President, Foundational Technology & Services | Chief Technology Officer | Audit & Finance Committee |
| Perfect Moment Ltd.FY 2026, filed June 29, 2026 | Chief Financial Officer and Chief Operating Officer | the President | Audit Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Knowles Corp's Form 10-K as filed with the SEC on February 9, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. CYBERSECURITY
Risk Management and Strategy
As part of our overall risk management program, we have implemented processes to assess, identify, and manage the material risks facing the Company, including from cybersecurity threats. We designed and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Cybersecurity Framework"). This does not imply compliance with specific technical standards, specifications or requirements of the NIST Cybersecurity Framework, but signifies its use as a guiding principle.
Our commitment extends to various programs and processes to stay informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. This includes regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. We also conduct "tabletop" exercises to simulate cybersecurity incidents to enhance our readiness and resilience in the face of potential cybersecurity threats. These exercises are conducted at both the technical level and senior management level. We have engaged external service providers, where appropriate, including leading cybersecurity firms, to assess, test or otherwise assist with aspects of our security processes.
We have a well-defined cybersecurity incident response plan aimed at facilitating an effective response and handling of cybersecurity incidents. The incident response plan outlines roles and responsibilities, criteria for measuring the severity of a cybersecurity incident, and provides for Audit Committee and Board briefings as appropriate. We have also implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.
Our employees participate in a security awareness program, receiving training on identifying potential cybersecurity risks and safeguarding our resources and information. This training is reinforced by testing initiatives, including periodic phishing tests. We also assess the cybersecurity risks presented by third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we maintain business continuity and disaster recovery plans, as well as cybersecurity insurance.
To date, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. That said, while we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks, and data or those of our third party providers. See "Item 1A. Risk Factors – Our business and operations could suffer in the event of security breaches, cybersecurity incident, other unauthorized disclosures, or network disruptions."
Governance
The Audit Committee of the Board of Directors considers cybersecurity risk and other information technology risk as part of its risk oversight function. Our head of Internal Audit reports directly to the Audit Committee and is responsible for reviewing with the Committee our company-wide enterprise risk assessment, which includes an evaluation of cybersecurity risks and threats. In addition, the Audit Committee separately receives regular reports from our Chief Information Officer on, among other things, our cybersecurity risks and threats, the status of projects to strengthen our information security systems, and assessments of our security program. The Chair of the Audit Committee regularly reports to the full Board regarding its activities, including those related to our cybersecurity risk management program.
Our management team, led by our Vice President and Chief Information Officer ("CIO"), has operational responsibility for our cybersecurity and information security framework and risk management. Our CIO has extensive cybersecurity knowledge and skills gained from various roles in information technology and security for over 30 years, including serving as the Chief Information Officer at two large public companies. Our CIO is supported by a team of enterprise information system and security risk professionals. The CIO receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation. He, in turn, provides regular updates on these matters to our Chief Financial Officer and our Chief Transformation Officer and works closely with our Legal department to oversee compliance with legal, regulatory, and contractual security requirements. In addition, in conjunction with Internal Audit, our CIO supervises any retained external cybersecurity consultants.
Earlier filings on record
Fiscal 2024 Form 10-K, filed February 13, 2025 sec.gov ↗
Top security role, as the filing names it
Vice President and Chief Information Officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“The Audit Committee of the Board of Directors considers cybersecurity risk and other information technology risk as part of its risk oversight function.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our CIO has extensive cybersecurity knowledge and skills gained from various roles in information technology and security for over 31 years, including serving as the Chief Information Officer at two large public companies.”
Material incident
The filing states none
“To date, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 25, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
Risk Management and Strategy
As part of our overall risk management program, we have implemented processes to assess, identify, and manage the material risks facing the Company, including from cybersecurity threats. We designed and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Cybersecurity
Framework"). This does not imply compliance with specific technical standards, specifications or requirements of the NIST Cybersecurity Framework, but signifies its use as a guiding principle.
Our commitment extends to various programs and processes to stay informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. This includes regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. We also conduct "tabletop" exercises to simulate cybersecurity incidents to enhance our readiness and resilience in the face of potential cybersecurity threats. These exercises are conducted at both the technical level and senior management level. We have engaged external service providers, where appropriate, including leading cybersecurity firms, to assess, test or otherwise assist with aspects of our security processes.
We have a well-defined cybersecurity incident response plan aimed at facilitating an effective response and handling of cybersecurity incidents. The incident response plan outlines roles and responsibilities, criteria for measuring the severity of a cybersecurity incident, and provides for Audit Committee and Board briefings as appropriate. We have also implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.
Our employees participate in a security awareness program, receiving training on identifying potential cybersecurity risks and safeguarding our resources and information. This training is reinforced by testing initiatives, including periodic phishing tests. We also assess the cybersecurity risks presented by third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we maintain business continuity and disaster recovery plans, as well as cybersecurity insurance.
To date, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. That said, while we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks, and data or those of our third party providers. See "Item 1A. Risk Factors – Our business and operations could suffer in the event of security breaches, cybersecurity incident, other unauthorized disclosures, or network disruptions."
Governance
The Audit Committee of the Board of Directors considers cybersecurity risk and other information technology risk as part of its risk oversight function. Our head of Internal Audit reports directly to the Audit Committee and is responsible reviewing with the Committee our company-wide enterprise risk assessment, which includes an evaluation of cybersecurity risks and threats. In addition, the Audit Committee separately receives regular reports from our Chief Information Officer on, among other things, our cybersecurity risks and threats, the status of projects to strengthen our information security systems, and assessments of our security program. The Chair of the Audit Committee regularly reports to the full Board regarding its activities, including those related to our cybersecurity risk management program.
Our management team, led by our Vice President and Chief Information Officer ("CIO"), has operational responsibility for our cybersecurity and information security framework and risk management. Our CIO has extensive cybersecurity knowledge and skills gained from various roles in information technology and security for over 31 years, including serving as the Chief Information Officer at two large public companies. Our CIO is supported by a team of enterprise information system and security risk professionals. The CIO receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation. He, in turn, provides regular updates on these matters to our Chief Financial Officer and our Chief Transformation Officer and works closely with our Legal department to oversee compliance with legal, regulatory, and contractual security requirements. In addition, in conjunction with Internal Audit, our CIO supervises any retained external cybersecurity consultants.
Fiscal 2023 Form 10-K, filed February 21, 2024 sec.gov ↗
Top security role, as the filing names it
Vice President of Information Technology
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“The Audit Committee of the Board of Directors considers cybersecurity risk and other information technology risk as part of its risk oversight function.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our VP of IT has extensive cybersecurity knowledge and skills gained from over 20 years of experience in leading and managing global IT operations and security teams.”
Material incident
The filing states none
“To date, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 25, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
Risk Management and Strategy
As part of our overall risk management program, we have implemented processes to assess, identify, and manage the material risks facing the Company, including from cybersecurity threats. We designed and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Cybersecurity Framework"). This does not imply compliance with specific technical standards, specifications or requirements of the NIST Cybersecurity Framework, but signifies its use as a guiding principle.
Our commitment extends to various programs and processes to stay informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. This includes regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. We also conduct "tabletop" exercises to simulate cybersecurity incidents to enhance our readiness and resilience in the face of potential cybersecurity threats. These exercises are conducted at both the technical level and senior management level. We have engaged external service providers, where appropriate, including leading cybersecurity firms, to assess, test or otherwise assist with aspects of our security processes.
We have a well-defined cybersecurity incident response plan aimed at facilitating an effective response and handling of cybersecurity incidents. The incident response plan outlines roles and responsibilities, criteria for measuring the severity of a cybersecurity incident, and provides for Audit Committee and Board briefings as appropriate. We have also implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.
Our employees participate in a security awareness program, receiving training on identifying potential cybersecurity risks and safeguarding our resources and information. This training is reinforced by testing initiatives, including periodic phishing tests. We also assess the cybersecurity risks presented by third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we maintain business continuity and disaster recovery plans, as well as cybersecurity insurance.
To date, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. That said, while we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks, and data or those of our third party providers. See "Item 1A. Risk Factors – Our business and operations could suffer in the event of security breaches, cybersecurity incident, other unauthorized disclosures, or network disruptions."
Governance
The Audit Committee of the Board of Directors considers cybersecurity risk and other information technology risk as part of its risk oversight function. Our head of Internal Audit reports directly to the Audit Committee and is responsible reviewing with the Committee our company-wide enterprise risk assessment, which includes an evaluation of cybersecurity risks and threats. In addition, the Audit Committee separately receives regular reports from our Vice President of Information Technology on, among other things, our cybersecurity risks and threats, the status of projects to strengthen our information security systems, and assessments of our security program. The Chair of the Audit Committee regularly reports to the full Board regarding its activities, including those related to our cybersecurity risk management program.
Our management team, led by our Vice President of Information Technology ("VP of IT"), has operational responsibility for our cybersecurity and information security framework and risk management. Our VP of IT has extensive cybersecurity knowledge and skills gained from over 20 years of experience in leading and managing global IT operations and security teams. In addition, our VP of IT has a Master of Science degree in Management of Information Systems from Rensselaer Polytechnic Institute. Our VP of IT is supported by a team of enterprise information system and security risk professionals. The VP of IT receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation. He, in turn, provides regular updates on these matters to our Chief Financial Officer and our Chief Administrative Officer and works closely with our Legal department to oversee compliance with legal, regulatory, and contractual security requirements. In addition, in conjunction with Internal Audit, our VP of IT supervises any retained external cybersecurity consultants.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.