Disclosure · Form 10-K · fiscal 2026
Caro Holdings Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2026
Filed July 15, 2026· period ended March 31, 2026· CAHO· CIK 1678105· Updated · filing on sec.gov ↗
Caro Holdings Inc.'s Form 10-K for fiscal 2026, filed July 15, 2026, carries an Item 1C cybersecurity section; a top security role title is not identified.
What Caro's Item 1C says
Caro's Form 10-K for fiscal 2026 states that cybersecurity oversight is the responsibility of senior management, who identify and address potential cybersecurity risks to business programs, clients, vendors and partners.
How the company manages cyber risk
The company seeks to mitigate cybersecurity risks through monitoring and detection activities, use of anti-malware applications, and quality audits, among other processes.
Third parties and incidents
As of March 31, 2026, the company has not identified an indication of a cybersecurity incident that would have a material impact on its business and consolidated financial statements.
What the section does not state
The section does not name the person who holds the top security role. The section does not say who the top security role reports to.
Read from the Form 10-K filed July 15, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
not identified
Reports to
not identified
Board oversight
not identified
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
not identified
Material incident
The filing states none
“As of March 31, 2026, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.”
The section
171 words, Form 10-K filed July 15, 2026 for the period ended March 31, 2026
Read by claude-sonnet-5-5 on November 10, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Caro Holdings Inc. standard industrial classification 5961, Retail-catalog & mail-order houses (SEC SIC list). 3 other filers in our library have the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Trade & Services).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Stitch Fix, Inc.FY 2026, filed September 24, 2026 | Chief Information Security Officer | Chief Product and Technology Officer | Audit Committee |
| Innovative Payment Solutions, Inc.FY 2025, filed March 31, 2026 | not identified | not identified | not identified |
| AmazonFY 2025, filed February 6, 2026 | chief security officer | Chief Executive Officer | Security Committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| VIP Play, Inc.FY 2026, filed September 29, 2026 | Chief Technology Officer | not identified | full board |
| GenFlat Holdings, Inc.FY 2026, filed September 25, 2026 | Chief Executive Officer and Chief Financial Officer | not identified | full board |
| CreditRiskMonitor Com IncFY 2025, filed August 19, 2026 | Chief Technology Officer | not identified | Audit Committee |
| H&R BlockFY 2026, filed August 14, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Barnes & Noble Education, Inc.FY 2026, filed July 9, 2026 | Chief Information Security Officer | Chief Information Officer | Audit Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Caro Holdings Inc.'s Form 10-K as filed with the SEC on July 15, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity
We have implemented cybersecurity risk management procedures, in accordance with our risk profile and business size. We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.
We have designed our business applications to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, and quality audits, among other processes. Cybersecurity oversight is the responsibility of senior management , who are responsible for identifying and addressing potential cybersecurity risks to business programs, clients, vendors and partners.
As of March 31, 2026, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.
Earlier filings on record
Fiscal 2025 Form 10-K, filed July 15, 2025 sec.gov ↗
Top security role, as the filing names it
Head of IT
Reports to, as the filing names it
Chief Executive Officer
“The Head of IT Department reports to our Chief Executive Officer who reports to the Audit Committee at the board-level, as appropriate.”
Board oversight
Audit Committee
“The Head of IT Department reports to our Chief Executive Officer who reports to the Audit Committee at the board-level, as appropriate.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“As of March 31, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.”
Read by claude-sonnet-5-5 on November 10, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
We have implemented cybersecurity risk management procedures, in accordance with our risk profile and business size. We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.
We have designed our business applications to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We have a trained group of people to carry out the activities of monitoring and detection of cybersecurity threats and respond to any cybersecurity threats or incidents. The Head of IT department is responsible for oversight of cybersecurity risks and addressing potential cybersecurity risks to business programs, employees, clients, vendors and partners. The Head of IT Department reports to our Chief Executive Officer who reports to the Audit Committee at the board-level, as appropriate.
As of March 31, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.