Disclosure · Form 10-K · fiscal 2025
Avalon GloboCare Corp. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 30, 2026· period ended December 31, 2025· ALBT· CIK 1630212· Updated · filing on sec.gov ↗
Avalon GloboCare Corp.'s Form 10-K for fiscal 2025, filed March 30, 2026, names the CFO as its top security role, reporting to the Audit Committee.
What Avalon GloboCare's Item 1C says
Avalon GloboCare's Form 10-K for fiscal 2025 places oversight of cybersecurity risk management with the Board, which delegates oversight of the program to the Audit Committee. The filing places the security governance structure under the ultimate direction of the CFO, with oversight from the Board.
Board and management oversight
The CFO reports to the Audit Committee on a quarterly and as-needed basis on the cybersecurity risk management program.
Third parties and incidents
The company contracts with a third party IT consultant, Night Fox Computing, to assist in maintaining secure email systems. The company states it has not experienced any material cyber incidents during the reporting period.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a specific security framework or standard.
Read from the Form 10-K filed March 30, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
CFO
Reports to
Audit Committee
“On a quarterly and as-needed basis, the CFO reports to the Audit Committee on our cybersecurity risk management program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards.”
Board oversight
Audit Committee
“The Board delegates oversight of the cybersecurity risk management program to the Audit Committee.”
How often the board or committee hears about it
Quarterly
“quarterly and as-needed basis, the CFO reports to the Audit Committee on our cybersecurity risk management program, including any critical”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
not identified
Material incident
The filing states none
“During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.”
The section
229 words, Form 10-K filed March 30, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 15, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Avalon GloboCare Corp. standard industrial classification 7371, Services-computer programming services (SEC SIC list). 5 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Brightline Interactive, Inc.FY 2026, filed September 28, 2026 | Chief Technology Officer | Chief Executive Officer | full board |
| ZscalerFY 2026, filed September 3, 2026 | chief security officer | not identified | audit committee of the board of directors |
| EPAM Systems, Inc.FY 2025, filed February 26, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Cognizant Technology Solutions CorpFY 2025, filed February 12, 2026 | CSO | Cognizant's CLO | Audit Committee |
| HashiCorpFY 2024, filed March 21, 2024 | Chief Security Officer | not identified | Audit Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Avalon GloboCare Corp.'s Form 10-K as filed with the SEC on March 30, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. CYBERSECURITY
Cybersecurity Risk Management
We, like other companies in our industry, face
several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have
not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber
incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.
In the ordinary course of our business, we use,
store and process a bare minimum of data. To effectively prevent, detect, and respond to cybersecurity threats, we contract with a third
party IT consultant, Night Fox Computing, to assist us to maintain secure email systems.
Governance
Under the ultimate direction of our CFO, with
oversight from the Board, we maintain a security governance structure to evaluate and address cyber risk.
Our Board is responsible for the oversight of
cybersecurity risk management. The Board delegates oversight of the cybersecurity risk management program to the Audit Committee. On a
quarterly and as-needed basis, the CFO reports to the Audit Committee on our cybersecurity risk management program, including any critical
cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards.
The CFO also provides updates to the Audit Committee of any cybersecurity incidents (suspected or actual) and provides updates on the
incidents as well as cybersecurity risk mitigation activities as appropriate.
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 31, 2025 sec.gov ↗
Top security role, as the filing names it
IT Consultant
Reports to, as the filing names it
Chief Financial Officer
“The cyber risk management program falls under the responsibility of a third party IT consultant, who has cross-functional expertise in IT management, cybersecurity, and engineering with more than 30 years of experience (the "IT Consultant"), who reports directly to our Chief Financial Officer.”
Board oversight
Audit Committee
“The Board delegates oversight of the cybersecurity risk management program to the Audit Committee.”
Person named in the filing
not identified
Experience, as stated
Stated
“The cyber risk management program falls under the responsibility of a third party IT consultant, who has cross-functional expertise in IT management, cybersecurity, and engineering with more than 30 years of experience (the "IT Consultant"), who reports directly to our Chief Financial Officer.”
Material incident
The filing states none
“During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.”
Read by claude-sonnet-5-5 on November 15, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
Cybersecurity Risk Management
We, like other companies in our industry, face
several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have
not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber
incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.
In the ordinary course of our business, we use,
store and process a bare minimum of data. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk
management program, which is comprised of data segregation, penetration testing, and training. The cyber risk management program falls
under the responsibility of a third party IT consultant, who has cross-functional expertise in IT management, cybersecurity, and engineering
with more than 30 years of experience (the "IT Consultant"), who reports directly to our Chief Financial Officer. Under the
guidance of the IT Consultant, we have minimized our data footprint to keep our cyber risk low.
We have implemented a cybersecurity risk management
program that is designed to limit and mitigate risks from cybersecurity threats. Our cybersecurity risk management program incorporates
several components, including employee training, periodic penetration tests, and multifactor authentications.
Governance
Under the ultimate direction of our CFO, with
oversight from the Board, we maintain a security governance structure to evaluate and address cyber risk.
Our Board is responsible for the oversight of
cybersecurity risk management. The Board delegates oversight of the cybersecurity risk management program to the Audit Committee. On a
quarterly and as-needed basis, the CFO reports to the Audit Committee on our cybersecurity risk management program, including any critical
cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards.
The CFO also provides updates to the Audit Committee of any cybersecurity incidents (suspected or actual) and provides updates on the
incidents as well as cybersecurity risk mitigation activities as appropriate.
Fiscal 2023 Form 10-K, filed April 15, 2024 sec.gov ↗
Top security role, as the filing names it
IT Consultant
Reports to, as the filing names it
Chief Financial Officer
“The cyber risk management program falls under the responsibility of a third party IT consultant, who has cross-functional expertise in IT management, cybersecurity, and engineering with more than 30 years of experience (the "IT Consultant"), who reports directly to our Chief Financial Officer.”
Board oversight
Audit Committee
“The Board delegates oversight of the cybersecurity risk management program to the Audit Committee.”
Person named in the filing
not identified
Experience, as stated
Stated
“The cyber risk management program falls under the responsibility of a third party IT consultant, who has cross-functional expertise in IT management, cybersecurity, and engineering with more than 30 years of experience (the "IT Consultant"), who reports directly to our Chief Financial Officer.”
Material incident
The filing states none
“During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.”
Read by claude-sonnet-5-5 on November 15, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
Cybersecurity Risk Management
We,
like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results
of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period,
we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.
In
the ordinary course of our business, we use, store and process a bare minimum of data. To effectively prevent, detect, and respond to
cybersecurity threats, we maintain a cyber risk management program, which is comprised of data segregation, penetration testing, and training.
The cyber risk management program falls under the responsibility of a third party IT consultant, who has cross-functional expertise in
IT management, cybersecurity, and engineering with more than 30 years of experience (the "IT Consultant"), who reports directly
to our Chief Financial Officer. Under the guidance of the IT Consultant, we have minimized our data footprint to keep our cyber risk low.
We
have implemented a cybersecurity risk management program that is designed to limit and mitigate risks from cybersecurity threats. Our
cybersecurity risk management program incorporates several components, including employee training, periodic penetration tests, and multifactor
authentications.
Governance
Under
the ultimate direction of our CFO, with oversight from the Board, we maintain a security governance structure to evaluate and address
cyber risk.
Our
Board is responsible for the oversight of cybersecurity risk management. The Board delegates oversight of the cybersecurity risk management
program to the Audit Committee. On a quarterly and as-needed basis, the CFO reports to the Audit Committee on our cybersecurity risk management
program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements
and industry standards. The CFO also provides updates to the Audit Committee of any cybersecurity incidents (suspected or actual) and
provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.