Disclosure · Form 10-K · fiscal 2025
PAVmed Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 27, 2026· period ended December 31, 2025· PAVM· CIK 1624326· Updated · filing on sec.gov ↗
PAVmed Inc.'s Form 10-K for fiscal 2025, filed March 27, 2026, places oversight of cybersecurity risk with the audit committee; a top security role title is not identified.
What PAVmed's Item 1C says
PAVmed's Form 10-K for fiscal 2025 places oversight of cybersecurity risk with the audit committee of its board. The filing says a third party vendor, CyberTeam, reports directly to the Chief Operating Officer and is responsible for identifying, assessing and managing cybersecurity risks.
Board and management oversight
The audit committee has primary responsibility for overseeing the company's risk assessment and risk management policies, including with respect to cybersecurity matters. The audit committee regularly discusses the company's major risk exposures with management, counsel, and auditors. CyberTeam provides the board and executive leadership team with periodic updates about the cybersecurity program and material risks.
Who leads security
The company retains CyberTeam, a third party vendor, to be responsible for cybersecurity risks, and it reports directly to the Chief Operating Officer. CyberTeam has been with the company since the company's inception and has over 25 years of experience in cybersecurity.
How the company manages cyber risk
Senior management, with the support of CyberTeam, monitors current events and trends related to cybersecurity and assesses any potential impact on current systems and operations. CyberTeam tracks cybersecurity risks and incidents until the risk is mitigated to an acceptable level or fully remediated. CyberTeam regularly meets with the executive leadership team to discuss identified cybersecurity risks and the potential likelihood and severity of each risk.
Third parties and incidents
The company enlists CyberTeam, when appropriate, to perform a risk and security assessment of the cybersecurity protocols and procedures of critical third-party partners. The company states that it is not currently aware of cybersecurity risks or previous incidents that have materially affected or are reasonably likely to materially affect it.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a specific security framework or standard.
Read from the Form 10-K filed March 27, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
not identified
Reports to
not identified
Board oversight
audit committee
“Our audit committee has primary responsibility for overseeing our risk assessment and risk management policies (including with respect to cybersecurity matters).”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“CyberTeam has been with the Company since the Company's inception and has over 25 years of experience in cybersecurity.”
Material incident
The filing states none
“Currently, we are not aware of any risks from cybersecurity threats, or from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company.”
The section
420 words, Form 10-K filed March 27, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 11, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns PAVmed Inc. standard industrial classification 3841, Surgical & medical instruments & apparatus (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| PetVivo Holdings, Inc.FY 2026, filed June 29, 2026 | CFO | Board | Audit Committee |
| Autonomix Medical, Inc.FY 2026, filed May 27, 2026 | Chief Executive Officer and Chief Financial Officer | Audit Committee | Audit Committee |
| Vivos Therapeutics, Inc.FY 2025, filed April 15, 2026 | Senior Vice President of Technology | Chief Financial Officer | full board |
| Vycor Medical IncFY 2025, filed March 31, 2026 | not identified | not identified | full board |
| Retractable Technologies IncFY 2025, filed March 27, 2026 | Information Security Officer | Chief Financial Officer (CFO) | full board |
| Tenon Medical, Inc.FY 2025, filed March 27, 2026 | not identified | not identified | full board |
| enVVeno Medical CorpFY 2025, filed March 26, 2026 | Chief Financial Officer | not identified | Audit Committee |
| Lucid Diagnostics Inc.FY 2025, filed March 25, 2026 | Techneto, Inc. d/b/a CyberTeam | our president and chief operating officer | audit committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of PAVmed Inc.'s Form 10-K as filed with the SEC on March 27, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity
Governance
Our board administers its cybersecurity risk oversight function directly through our audit committee. Our audit committee has primary responsibility for overseeing our risk assessment and risk management policies (including with respect to cybersecurity matters). Our audit committee regularly discusses with management, counsel, and auditors the Company's major risk exposures. This includes potential financial impact on the Company and the steps taken to monitor and control those risks. Additionally, our board is informed regarding the risks facing the Company and coordinates with management and our cybersecurity team to ensure our board receives regular risk assessment updates from management.
We retain Techneto, Inc. d/b/a CyberTeam ("CyberTeam"), a third party vendor that reports directly to our Chief Operating Officer, to be responsible for identifying, assessing and managing the Company's risks from cybersecurity threats. CyberTeam has been with the Company since the Company's inception and has over 25 years of experience in cybersecurity.
CyberTeam provides our board and executive leadership team with periodic updates about our cybersecurity program and material risks. This includes updates on cybersecurity practices, programs, and the status of projects designed to strengthen internal cybersecurity and data protection.
Risk Management and Strategy
Processes for identifying and assessing cybersecurity risks
Senior management, with the support of CyberTeam, monitors current events and trends related to cybersecurity and assesses any potential impact on current systems and operations. Third-party partners who are in possession of our confidential information are generally required to notify us in the event of a cybersecurity incident within their systems that have, or are reasonably likely to, compromise the security of such information. When appropriate, we enlist CyberTeam to perform a risk and security assessment of the cybersecurity protocols and procedures of critical third-party partners.
Processes for managing cybersecurity risks
CyberTeam tracks risks and incidents related to cybersecurity until the risk is mitigated to an acceptable level or fully remediated. When risks are identified, CyberTeam oversees mitigation plans with the risk owner which are communicated to necessary teams and remediation steps are taken.
Processes for incorporating cybersecurity risks into the overall risk management process
Our process for identifying, assessing, and managing risks related to cybersecurity generally involves CyberTeam regularly meeting with our executive leadership team, and when appropriate, our board and/or audit committee to discuss cybersecurity related risks identified and the potential likelihood and severity of each risk.
Currently, we are not aware of any risks from cybersecurity threats, or from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company.
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 24, 2025 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
Chief Operating Officer
“We retain Techneto, Inc. d/b/a CyberTeam ("CyberTeam"), a third party vendor that reports directly to our Chief Operating Officer, to be responsible for identifying, assessing and managing the Company's risks from cybersecurity threats.”
Board oversight
audit committee
“Our audit committee has primary responsibility for overseeing our risk assessment and risk management policies (including with respect to cybersecurity matters).”
Person named in the filing
not identified
Experience, as stated
Stated
“CyberTeam has been with the Company since the Company's inception and has over 25 years of experience in cybersecurity.”
Material incident
The filing states none
“Currently, we are not aware of any risks from cybersecurity threats, or from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company.”
Read by claude-sonnet-5-5 on November 11, 2026; every quote verified in the stored text by code; 1 proposed field not found in the text and left empty.
Item
1C. Cybersecurity
Governance
Our
board administers its cybersecurity risk oversight function directly through our audit committee. Our audit committee has primary responsibility
for overseeing our risk assessment and risk management policies (including with respect to cybersecurity matters). Our audit committee
regularly discusses with management, counsel, and auditors the Company's major risk exposures. This includes potential financial
impact on the Company and the steps taken to monitor and control those risks. Additionally, our board is informed regarding the risks
facing the Company and coordinates with management and our cybersecurity team to ensure our board receives regular risk assessment updates
from management.
We
retain Techneto, Inc. d/b/a CyberTeam ("CyberTeam"), a third party vendor that reports directly to our Chief Operating Officer,
to be responsible for identifying, assessing and managing the Company's risks from cybersecurity threats. CyberTeam has been with
the Company since the Company's inception and has over 25 years of experience in cybersecurity.
CyberTeam
provides our board and executive leadership team with periodic updates about our cybersecurity program and material risks. This includes
updates on cybersecurity practices, programs, and the status of projects designed to strengthen internal cybersecurity and data protection.
Risk
Management and Strategy
Processes
for identifying and assessing cybersecurity risks
Senior
management, with the support of CyberTeam, monitors current events and trends related to cybersecurity and assesses any potential impact
on current systems and operations. Third-party partners who are in possession of our confidential information are generally required
to notify us in the event of a cybersecurity incident within their systems that have, or are reasonably likely to, compromise the security
of such information. When appropriate, we enlist CyberTeam to perform a risk and security assessment of the cybersecurity protocols and
procedures of critical third-party partners.
Processes
for managing cybersecurity risks
CyberTeam
tracks risks and incidents related to cybersecurity until the risk is mitigated to an acceptable level or fully remediated. When risks
are identified, CyberTeam oversees mitigation plans with the risk owner which are communicated to necessary teams and remediation steps
are taken.
Processes
for incorporating cybersecurity risks into the overall risk management process
Our
process for identifying, assessing, and managing risks related to cybersecurity generally involves CyberTeam regularly meeting with our
executive leadership team, and when appropriate, our board and/or audit committee to discuss cybersecurity related risks identified and
the potential likelihood and severity of each risk.
Currently,
we are not aware of any risks from cybersecurity threats, or from previous cybersecurity incidents, that have materially affected or
are reasonably likely to materially affect the Company.
Fiscal 2023 Form 10-K, filed March 25, 2024 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
audit committee
“Our audit committee has primary responsibility for overseeing our risk assessment and risk management policies (including with respect to cybersecurity matters).”
Person named in the filing
not identified
Experience, as stated
Stated
“CyberTeam has been with the Company since its inception and has over 25 years of experience in cybersecurity.”
Material incident
The filing states none
“Currently, we are not aware of any risks from cybersecurity threats, or from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company.”
Read by claude-sonnet-5-5 on November 11, 2026; every quote verified in the stored text by code.
Item
1C. Cybersecurity
Governance
Our
board administers its cybersecurity risk oversight function directly through our audit committee. Our audit committee has primary responsibility
for overseeing our risk assessment and risk management policies (including with respect to cybersecurity matters). Our audit committee
regularly discusses with management, counsel, and auditors the Company's major risk exposures. This includes potential financial
impact on the Company and the steps taken to monitor and control those risks. Additionally, our board is informed regarding the risks
facing the Company and coordinates with management and our cybersecurity team to ensure our board receives regular risk assessment updates
from management.
We
retain Techneto, Inc. d/b/a CyberTeam ("CyberTeam"), a third party vendor that reports directly to our Chief Operating Officer,
to be responsible for identifying, assessing and managing the Company's risks from cybersecurity threats. CyberTeam has been with
the Company since its inception and has over 25 years of experience in cybersecurity.
CyberTeam
provides our board and executive leadership team with periodic updates about our cybersecurity program and material risks. This includes
updates on cybersecurity practices, programs, and the status of projects designed to strengthen internal cybersecurity and data protection.
Risk
Management and Strategy
Processes
for identifying and assessing cybersecurity risks
Senior
management, with the support of CyberTeam, monitors current events and trends related to cybersecurity and assesses any potential impact
on current systems and operations. Third-party partners who are in possession of our confidential information are generally required
to notify us in the event of a cybersecurity incident within their systems that have, or are reasonably likely to, compromise the security
of such information. When appropriate, we enlist CyberTeam to perform a risk and security assessment of the cybersecurity protocols and
procedures of critical third-party partners.
Processes
for managing cybersecurity risks
CyberTeam
tracks risks and incidents related to cybersecurity until the risk is mitigated to an acceptable level or fully remediated. When risks
are identified, CyberTeam oversees mitigation plans with the risk owner which are communicated to necessary teams and remediation steps
are taken.
Processes
for incorporating cybersecurity risks into the overall risk management process
Our
process for identifying, assessing, and managing risks related to cybersecurity generally involves CyberTeam regularly meeting with our
executive leadership team, and when appropriate, our board and/or audit committee to discuss cybersecurity related risks identified and
the potential likelihood and severity of each risk.
Currently,
we are not aware of any risks from cybersecurity threats, or from previous cybersecurity incidents, that have materially affected or
are reasonably likely to materially affect the Company.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.