Disclosure · Form 10-K · fiscal 2025
enVVeno Medical Corp 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 26, 2026· period ended December 31, 2025· NVNO· CIK 1661053· Updated · filing on sec.gov ↗
enVVeno Medical Corp's Form 10-K for fiscal 2025, filed March 26, 2026, names the Chief Financial Officer as its top security role, with oversight by the Audit Committee.
What enVVeno Medical's Item 1C says
enVVeno Medical's Form 10-K for fiscal 2025 places oversight of cybersecurity risks with the Audit Committee. The Chief Financial Officer is responsible for managing the company's efforts on cybersecurity.
Board and management oversight
The company's Audit Committee has been designated with oversight responsibility for cybersecurity risks.
Who leads security
Neither the Chief Financial Officer nor any member of the Audit Committee has relevant expertise in cybersecurity.
How the company manages cyber risk
The company conducts annual assessments of risks posed by cybersecurity threats in conjunction with its insurance renewal cycles. As a result of these assessments, the company has implemented tools and practices to monitor its systems and user accounts, including two factor authentication for logins and improved rules for password maintenance.
Third parties and incidents
The company retains an outside technical expert to support its information technology systems, including addressing cybersecurity risks. The company uses cloud-based solutions provided by several large service providers for critical information technology infrastructure such as email and file storage. Certain business partners of the company also maintain data related to its trials and ongoing product development on servers they maintain. The company requires these partners to comply with all HIPAA standards for maintaining security of their systems where this data resides. The company's approach is based on the premise that any cybersecurity incident could result in material harm to the company.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed March 26, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Financial Officer
Reports to
not identified
Board oversight
Audit Committee
“Our Audit Committee has been designated with oversight responsibility for cybersecurity risks and our Chief Financial Officer is responsible for managing our efforts in this area.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
Described
“Rather, the Company retains an outside technical expert to support our information technology systems including addressing”
Experience of the security leadership, as stated
Stated
“Neither the Chief Financial Officer nor any member of the Audit Committee has relevant expertise in cybersecurity.”
Material incident
The filing states none
“Our approach is based on the premise that any cybersecurity incident could result in material harm to the Company.”
The section
366 words, Form 10-K filed March 26, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 13, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns enVVeno Medical Corp standard industrial classification 3841, Surgical & medical instruments & apparatus (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| PetVivo Holdings, Inc.FY 2026, filed June 29, 2026 | CFO | Board | Audit Committee |
| Autonomix Medical, Inc.FY 2026, filed May 27, 2026 | Chief Executive Officer and Chief Financial Officer | Audit Committee | Audit Committee |
| Vivos Therapeutics, Inc.FY 2025, filed April 15, 2026 | Senior Vice President of Technology | Chief Financial Officer | full board |
| Vycor Medical IncFY 2025, filed March 31, 2026 | not identified | not identified | full board |
| PAVmed Inc.FY 2025, filed March 27, 2026 | not identified | not identified | audit committee |
| Retractable Technologies IncFY 2025, filed March 27, 2026 | Information Security Officer | Chief Financial Officer (CFO) | full board |
| Tenon Medical, Inc.FY 2025, filed March 27, 2026 | not identified | not identified | full board |
| Lucid Diagnostics Inc.FY 2025, filed March 25, 2026 | Techneto, Inc. d/b/a CyberTeam | our president and chief operating officer | audit committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of enVVeno Medical Corp's Form 10-K as filed with the SEC on March 26, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C.
Cybersecurity
Cybersecurity
The
Company's cybersecurity risks are theft of intellectual property, theft of other business data, fraud or extortion, lack of access
to our information systems, harm to employees, harm to business partners, violation of privacy laws, potential reputational risk, and
litigation or other legal risk if a cybersecurity incident were to occur. It is difficult to assign a monetary materiality assessment
to these risks or to the impact if the Company were to sustain a breach of its systems. Our approach is based on the premise that any
cybersecurity incident could result in material harm to the Company.
Our
Audit Committee has been designated with oversight responsibility for cybersecurity risks and our Chief Financial Officer is responsible
for managing our efforts in this area. Neither the Chief Financial Officer nor any member of the Audit Committee has relevant expertise
in cybersecurity. Rather, the Company retains an outside technical expert to support our information technology systems including addressing
cybersecurity risks.
We
conduct annual assessments of risks posed by cybersecurity threats in conjunction with our insurance renewal cycles. This includes a
thorough review of our systems and vulnerabilities. As a result of these assessments, we have implemented tools and practices to proactively
monitor our systems and user accounts including, but not limited to, deploying solutions to constantly monitor users accessing systems,
implementation of two factor authentication for logins, and improved rules for password maintenance.
Like
many companies, we make use of cloud-based solutions provided by several large service providers for critical information technology
infrastructure such as email and file storage. We do not maintain stand-alone servers for our email, file storage or other business applications.
In the normal course of our relationships with the providers of these services, we regularly monitor their message boards and other formal
and informal communications channels for signs of breaches of their systems. We also survey available public information for indications
that they have suffered a breach of their systems.
Certain
of our business partners also maintain data related to our trials and ongoing product development on servers they maintain. We require
these partners to comply with all HIPAA standards for maintaining security of their systems where this data resides.
Earlier filings on record
Fiscal 2024 Form 10-K, filed February 28, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Financial Officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“Our Audit Committee has been designated with oversight responsibility for cybersecurity risks and our Chief Financial Officer is responsible for managing our efforts in this area.”
Person named in the filing
not identified
Experience, as stated
Stated
“Neither the Chief Financial Officer nor any member of the Audit Committee has relevant expertise in cybersecurity.”
Material incident
The filing states none
“Our approach is based on the premise that any cybersecurity incident could result in material harm to the Company.”
Read by claude-sonnet-5-5 on November 13, 2026; every quote verified in the stored text by code.
ITEM
1C.
Cybersecurity
Risk
Cybersecurity
Risk
The
Company's cybersecurity risks are theft of intellectual property, theft of other business data, fraud or extortion, lack of access
to our information systems, harm to employees, harm to business partners, violation of privacy laws, potential reputational risk, and
litigation or other legal risk if a cybersecurity incident were to occur. It is difficult to assign a monetary materiality assessment
to these risks or to the impact if the Company were to sustain a breach of its systems. Our approach is based on the premise that any
cybersecurity incident could result in material harm to the Company.
Our
Audit Committee has been designated with oversight responsibility for cybersecurity risks and our Chief Financial Officer is responsible
for managing our efforts in this area. Neither the Chief Financial Officer nor any member of the Audit Committee has relevant expertise
in cybersecurity. Rather, the Company retains an outside technical expert to support our information technology systems including addressing
cybersecurity risks.
We
conduct annual assessments of risks posed by cybersecurity threats in conjunction with our insurance renewal cycles. This includes a
thorough review of our systems and vulnerabilities. As a result of these assessments, we have implemented tools and practices to proactively
monitor our systems and user accounts including, but not limited to, deploying solutions to constantly monitor users accessing systems,
implementation of two factor authentication for logins, and improved rules for password maintenance.
Like
many companies, we make use of cloud-based solutions provided by several large service providers for critical information technology
infrastructure such as email and file storage. We do not maintain stand-alone servers for our email, file storage or other business applications.
In the normal course of our relationships with the providers of these services, we regularly monitor their message boards and other formal
and informal communications channels for signs of breaches of their systems. We also survey available public information for indications
that they have suffered a breach of their systems.
Certain
of our business partners also maintain data related to our trials and ongoing product development on servers they maintain. We require
these partners to comply with all HIPAA standards for maintaining security of their systems where this data resides.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.