Disclosure · Form 10-K · fiscal 2026
Addentax Group Corp. 10-K cybersecurity disclosure (Item 1C), fiscal 2026
Filed June 29, 2026· period ended March 31, 2026· ATXG· CIK 1650101· Updated · filing on sec.gov ↗
Addentax Group Corp.'s Form 10-K for fiscal 2026, filed June 29, 2026, names the Chief Financial Officer as its top security role, with oversight by the audit committee.
What Addentax's Item 1C says
Addentax's Form 10-K for fiscal 2026 places oversight of cybersecurity risk with the board of directors, which acts directly and through its committees. The filing states that the Company's Chief Financial Officer is primarily responsible in management for assessing and managing material cybersecurity risks day to day.
Board and management oversight
The audit committee oversees the process by which risk assessment and management is undertaken, which would include cybersecurity risks, in accordance with its charter. The audit committee holds regular meetings and receives periodic reports from management regarding risk management, including major financial risk exposures from cybersecurity threats or incidents.
Who leads security
The Chief Financial Officer also keeps the senior executive officers informed on a regular basis of the identification, assessment and management of cybersecurity risks and of any cybersecurity incidents. Such management personnel have prior experience and training in managing information systems and cybersecurity matters and participate in ongoing training programs.
How the company manages cyber risk
The company identifies and assesses material cybersecurity risks by monitoring and evaluating its threat environment on an ongoing basis, using manual and automated tools, threat reports and services, scans and risk assessments. The company manages these risks through processes that include incident detection and response, vulnerability management, disaster recovery and business continuity plans, encryption of data and employee training, depending on the environment.
Third parties and incidents
The company seeks to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the services, the information processed and the provider, the company's processes may include due diligence on the provider's cybersecurity practices and contractual cybersecurity obligations on the provider. As of the date of the annual report, the Company has not encountered cybersecurity incidents that it believes to have been material to the Company taken as a whole.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a specific security framework or standard.
Read from the Form 10-K filed June 29, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Financial Officer
Reports to
not identified
Board oversight
audit committee
“The audit committee holds regular meetings and receives periodic reports from management regarding risk management, including major financial risk exposures from cybersecurity threats or incidents.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“Such management personnel have prior experience and training in managing information systems and cybersecurity matters and participate in ongoing training programs.”
Material incident
The filing states none
“As of the date of this annual report, the Company has not encountered cybersecurity incidents that the Company believes to have been material to the Company taken as a whole.”
The section
534 words, Form 10-K filed June 29, 2026 for the period ended March 31, 2026
Read by claude-sonnet-5-5 on November 12, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Addentax Group Corp. standard industrial classification 7330, Services-mailing, reproduction, commercial art & photography (SEC SIC list). Shown: filers whose codes the SEC assigns to the same review office (Office of Trade & Services).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| VIP Play, Inc.FY 2026, filed September 29, 2026 | Chief Technology Officer | not identified | full board |
| GenFlat Holdings, Inc.FY 2026, filed September 25, 2026 | Chief Executive Officer and Chief Financial Officer | not identified | full board |
| Stitch Fix, Inc.FY 2026, filed September 24, 2026 | Chief Information Security Officer | Chief Product and Technology Officer | Audit Committee |
| CreditRiskMonitor Com IncFY 2025, filed August 19, 2026 | Chief Technology Officer | not identified | Audit Committee |
| H&R BlockFY 2026, filed August 14, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Caro Holdings Inc.FY 2026, filed July 15, 2026 | not identified | not identified | not identified |
| Barnes & Noble Education, Inc.FY 2026, filed July 9, 2026 | Chief Information Security Officer | Chief Information Officer | Audit Committee |
| PCS Edventures!, Inc.FY 2026, filed June 26, 2026 | Director of Technology | President | not identified |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Addentax Group Corp.'s Form 10-K as filed with the SEC on June 29, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item
1C. Cybersecurity
Risk
Management and Strategy
We
identify and assess material risks from cybersecurity threats to our information systems and the information residing in our information
systems by monitoring and evaluating our threat environment on an ongoing basis using various methods including, for example, using manual
and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat
actors, conducting scans of the threat environment, and conducting risk assessments.
We
manage material risks from cybersecurity threats to our information systems and the information residing in our information systems through
various processes and procedures, including, depending on the environment, risk assessment, incident detection and response, vulnerability
management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions,
encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, and employee
training. We engage third-party service providers to provide some of the resources used in our information systems and some third-party
service providers have access to information residing in our information systems. With respect to such third parties, we seek to engage
reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature and extent of the services provided,
the sensitivity and quantity of information processed, and the identity of the service provider, our processes may include conducting
due diligence on the cybersecurity practices of such provider and contractually imposing cybersecurity related obligations on the provider.
We
are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected
or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.
Refer to "Item 1A. Risk Factors— Risks Associated with Our Company — Unauthorized disclosure, destruction or modification
of data, through cybersecurity breaches, computer viruses or otherwise or disruption of our services could expose us to liability, protracted
and costly litigation and damage our reputation".
Cybersecurity
Governance
Our
board of directors holds oversight responsibility over our Company's risk management and strategy, including material risks related
to cybersecurity threats. This oversight is executed directly by our board of directors and through its committees. Our audit committee
oversees the management of our Company's major financial risk exposures, the steps management has taken to monitor and control
such exposures, and the process by which risk assessment and management is undertaken and handled, which would include cybersecurity
risks, in accordance with its charter. The audit committee holds regular meetings and receives periodic reports from management regarding
risk management, including major financial risk exposures from cybersecurity threats or incidents.
Within
management, the Company's Chief Financial Officer is primarily responsible for assessing and managing our material risks from cybersecurity
threats on a day-to-day basis and keep the senior executive officers informed on a regular basis of the identification, assessment, and
management of cybersecurity risks and of any cybersecurity incidents. Such management personnel have prior experience and training in
managing information systems and cybersecurity matters and participate in ongoing training programs.
As
of the date of this annual report, the Company has not encountered cybersecurity incidents that the Company believes to have been material
to the Company taken as a whole.
Earlier filings on record
Fiscal 2025 Form 10-K, filed June 30, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Financial Officer
Reports to, as the filing names it
not identified
Board oversight
audit committee
“Our audit committee oversees the management of our Group's major financial risk exposures, the steps management has taken to monitor and control such exposures, and the process by which risk assessment and management is undertaken and handled, which would include cybersecurity risks, in accordance with its charter.”
Person named in the filing
not identified
Experience, as stated
Stated
“Such management personnel have prior experience and training in managing information systems and cybersecurity matters and participate in ongoing training programs.”
Material incident
The filing states none
“As of the date hereof, the Company has not encountered cybersecurity incidents that the company believes to have been material to the Company taken as a whole.”
Read by claude-sonnet-5-5 on November 12, 2026; every quote verified in the stored text by code.
Item
1C. Cybersecurity
Risk
Management and Strategy
We
identify and assess material risks from cybersecurity threats to our information systems and the information residing in our information
systems by monitoring and evaluating our threat environment on an ongoing basis using various methods including, for example, using manual
and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat
actors, conducting scans of the threat environment, and conducting risk assessments.
We
manage material risks from cybersecurity threats to our information systems and the information residing in our information systems through
various processes and procedures, including, depending on the environment, risk assessment, incident detection and response, vulnerability
management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions,
encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, and employee
training. We engage third-party service providers to provide some of the resources used in our information systems and some third-party
service providers have access to information residing in our information systems. With respect to such third parties, we seek to engage
reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature and extent of the services provided,
the sensitivity and quantity of information processed, and the identity of the service provider, our processes may include conducting
due diligence on the cybersecurity practices of such provider and contractually imposing cybersecurity related obligations on the provider.
We
are no t aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected
or are reasonably likely to materially affect our Group, including our business strategy, results of operations, or financial condition.
Refer to "Item 1A. Risk Factors— Risks Associated with Our Company — Unauthorized disclosure, destruction or modification
of data, through cybersecurity breaches, computer viruses or otherwise or disruption of our services could expose us to liability, protracted
and costly litigation and damage our reputation".
Cybersecurity
Governance
Our
Board of Directors holds oversight responsibility over our Group's risk management and strategy, including material risks related
to cybersecurity threats. This oversight is executed directly by our board of directors and through its committees. Our audit committee
oversees the management of our Group's major financial risk exposures, the steps management has taken to monitor and control such
exposures, and the process by which risk assessment and management is undertaken and handled, which would include cybersecurity risks,
in accordance with its charter. The audit committee holds regular meetings and receives periodic reports from management regarding risk
management, including major financial risk exposures from cybersecurity threats or incidents.
Within
management, the Group's Chief Financial Officer is primarily responsible for assessing and managing our material risks from cybersecurity
threats on a day-to-day basis and keep the senior executive officers informed on a regular basis of the identification, assessment, and
management of cybersecurity risks and of any cybersecurity incidents. Such management personnel have prior experience and training in
managing information systems and cybersecurity matters and participate in ongoing training programs.
As
of the date hereof, the Company has not encountered cybersecurity incidents that the company believes to have been material to the Company
taken as a whole.
Fiscal 2024 Form 10-K, filed July 15, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Financial Officer
Reports to, as the filing names it
not identified
Board oversight
audit committee
“Our audit committee oversees the management of our Group's major financial risk exposures, the steps management has taken to monitor and control such exposures, and the process by which risk assessment and management is undertaken and handled, which would include cybersecurity risks, in accordance with its charter.”
Person named in the filing
not identified
Experience, as stated
Stated
“Such management personnel have prior experience and training in managing information systems and cybersecurity matters and participate in ongoing training programs.”
Material incident
The filing states none
“As of the date hereof, the Company has not encountered cybersecurity incidents that the company believes to have been material to the Company taken as a whole.”
Read by claude-sonnet-5-5 on November 12, 2026; every quote verified in the stored text by code.
Item
1C. Cybersecurity
Risk
Management and Strategy
We
identify and assess material risks from cybersecurity threats to our information systems and the information residing in our information
systems by monitoring and evaluating our threat environment on an ongoing basis using various methods including, for example, using manual
and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat
actors, conducting scans of the threat environment, and conducting risk assessments.
We
manage material risks from cybersecurity threats to our information systems and the information residing in our information systems through
various processes and procedures, including, depending on the environment, risk assessment, incident detection and response, vulnerability
management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions,
encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, and employee
training. We engage third-party service providers to provide some of the resources used in our information systems and some third-party
service providers have access to information residing in our information systems. With respect to such third parties, we seek to engage
reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature and extent of the services provided,
the sensitivity and quantity of information processed, and the identity of the service provider, our processes may include conducting
due diligence on the cybersecurity practices of such provider and contractually imposing cybersecurity related obligations on the provider.
We
are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected
or are reasonably likely to materially affect our Group, including our business strategy, results of operations, or financial condition.
Refer to "Item 1A. Risk Factors— Risks Associated with Our Company — Unauthorized disclosure, destruction or modification
of data, through cybersecurity breaches, computer viruses or otherwise or disruption of our services could expose us to liability, protracted
and costly litigation and damage our reputation".
Cybersecurity
Governance
Our
Board of Directors holds oversight responsibility over our Group's risk management and strategy, including material risks related
to cybersecurity threats. This oversight is executed directly by our board of directors and through its committees. Our audit committee
oversees the management of our Group's major financial risk exposures, the steps management has taken to monitor and control such
exposures, and the process by which risk assessment and management is undertaken and handled, which would include cybersecurity risks,
in accordance with its charter. The audit committee holds regular meetings and receives periodic reports from management regarding risk
management, including major financial risk exposures from cybersecurity threats or incidents.
Within
management, the Group's Chief Financial Officer is primarily responsible for assessing and managing our material risks from cybersecurity
threats on a day-to-day basis and keep the senior executive officers informed on a regular basis of the identification, assessment, and
management of cybersecurity risks and of any cybersecurity incidents. Such management personnel have prior experience and training in
managing information systems and cybersecurity matters and participate in ongoing training programs.
As
of the date hereof, the Company has not encountered cybersecurity incidents that the company believes to have been material to the Company
taken as a whole.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.