Disclosure · Form 10-K · fiscal 2025
Edible Garden AG Inc 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 31, 2026· period ended December 31, 2025· EDBL· CIK 1809750· Updated · filing on sec.gov ↗
Edible Garden AG Inc's Form 10-K for fiscal 2025, filed March 31, 2026, places oversight of cybersecurity risk with the full board; a top security role title is not identified.
What Edible Garden AG's Item 1C says
Edible Garden's Form 10-K for fiscal 2025 places oversight of cybersecurity infrastructure with members of its management team, including the Chief Executive Officer and Interim Chief Financial Officer.
Board and management oversight
The management team, with support from the Service Provider, would raise any significant cybersecurity risks with the Board.
How the company manages cyber risk
Through the Service Provider, the company has established an Incident Response Plan, called the IRP. Under the IRP, once a cyber incident is identified, a response team will review the details, inform management and work to secure systems and fix the vulnerability.
Third parties and incidents
Management works in tandem with a third-party service provider that reviews and updates antivirus and antimalware software and monitors the intrusion detection system.
What the section does not state
The section does not name the person who holds the top security role. The section does not say who the top security role reports to. The section does not name a board committee as responsible for cybersecurity oversight. The section does not name a specific security framework or standard. The section does not say how often the board or its committee is briefed on cybersecurity.
Read from the Form 10-K filed March 31, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
not identified
Reports to
not identified
Board oversight
Full board
“Other than engaging the Service Provider, given our overall risk profile, the Board has had limited involvement with our cybersecurity risk management.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
not identified
Material incident
The filing states none
“We have not been the victim of a cyber incident in the past but may be the subject of cyber incidents in the future.”
The section
304 words, Form 10-K filed March 31, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 14, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Edible Garden AG Inc standard industrial classification 0100, Agricultural production-crops (SEC SIC list). 6 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Bloomia Holdings, Inc.FY 2026, filed September 21, 2026 | not identified | not identified | Audit Committee |
| ESG Inc.FY 2025, filed March 31, 2026 | not identified | not identified | not identified |
| Planet 13 Holdings Inc.FY 2025, filed March 25, 2026 | Vice President of Operations | not identified | Audit Committee |
| TerrAscend Corp.FY 2025, filed March 12, 2026 | Chief Information Officer | not identified | Audit Committee |
| Fresh Del Monte Produce IncFY 2025, filed February 19, 2026 | Vice President of Information Technology | not identified | Governance Committee |
| Genvor IncFY 2025, filed December 10, 2025 | Chief Executive Officer | not identified | not identified |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Edible Garden AG Inc's Form 10-K as filed with the SEC on March 31, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. CYBERSECURITY
Cyber Security Governance
Oversight of cybersecurity infrastructure is managed by members of our management team, including our Chief Executive Officer and Interim Chief Financial Officer. Management works in tandem with a third-party service provider (the "Service Provider") who routinely reviews and updates our antivirus and antimalware software, monitors our intrusion detection system and intrusion protection system and reviews and cleans our corporate email system. Other than engaging the Service Provider, given our overall risk profile, the Board has had limited involvement with our cybersecurity risk management. The management team, with support from the Service Provider, would raise any significant cybersecurity risks with the Board.
Risk Management and Strategy
We believe we have implemented processes that are designed to effectively manage risks from cybersecurity threats. Through our Service Provider, we have established an Incident Response Plan (the "IRP"). The IRP lays out our guidelines for responding to and handling cyber incidents. The IRP helps to ensure a quick and organized response in the event of a cyber incident and helps ensure all necessary members of management are informed so action can be taken as soon as possible. Under the IRP, once a cyber incident is identified, a response team will review the details of the cyber incident, inform management and work to secure our systems and fix the vulnerability. An investigation will be conducted, with the assistance of the Service Provider if needed, to determine the root cause of the cyber incident, the materiality of the cyber incident, and any disclosure or legal obligations that will stem from the cyber incident.
We have not been the victim of a cyber incident in the past but may be the subject of cyber incidents in the future. See Item 1A, Risk Factors for more information about the risk posed to us by cybersecurity threats.
Earlier filings on record
Fiscal 2024 Form 10-K, filed April 1, 2025 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
Full board
“Other than engaging the Service Provider prior to our initial public offering, given our overall risk profile, the Board has had limited involvement with our cybersecurity risk management.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“We have not been the victim of a cyber incident in the past but may be the subject of cyber incidents in the future.”
Read by claude-sonnet-5-5 on November 14, 2026; every quote verified in the stored text by code.
Item 1C. CYBERSECURITY
Cyber Security Governance
Oversight of cybersecurity infrastructure is managed by members of our management team, including our Chief Executive Officer and Interim Chief Financial Officer. Management works in tandem with a third-party service provider (the "Service Provider") who routinely reviews and updates our antivirus and antimalware software, monitors our intrusion detection system and intrusion protection system and reviews and cleans our corporate email system. Other than engaging the Service Provider prior to our initial public offering, given our overall risk profile, the Board has had limited involvement with our cybersecurity risk management. The management team, with support from the Service Provider, would raise any significant cybersecurity risks with the Board.
Risk Management and Strategy
We believe we have implemented processes that are designed to effectively manage risks from cybersecurity threats. Through our Service Provider, we have established an Incident Response Plan (the "IRP"). The IRP lays out our guidelines for responding to and handling cyber incidents. The IRP helps to ensure a quick and organized response in the event of a cyber incident and helps ensure all necessary members of management are informed so action can be taken as soon as possible. Under the IRP, once a cyber incident is identified, a response team will review the details of the cyber incident, inform management and work to secure our systems and fix the vulnerability. An investigation will be conducted, with the assistance of the Service Provider if needed, to determine the root cause of the cyber incident, the materiality of the cyber incident, and any disclosure or legal obligations that will stem from the cyber incident.
We have not been the victim of a cyber incident in the past but may be the subject of cyber incidents in the future. See Item 1A, Risk Factors for more information about the risk posed to us by cybersecurity threats.
Fiscal 2023 Form 10-K, filed April 1, 2024 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
Full board
“The management team, with support from the Service Provider, would raise any significant cybersecurity risks with the Board.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“We have not been the victim of a cyber incident in the past but may be the subject of cyber incidents in the future.”
Read by claude-sonnet-5-5 on November 14, 2026; every quote verified in the stored text by code.
Item 1C. CYBERSECURITY
Cyber Security Governance
Oversight of cybersecurity infrastructure is managed by members of our management team, including our Chief Executive Officer and Chief Data Officer. Management works in tandem with a third-party service provider (the "Service Provider"). The Service Provider routinely reviews and updates our antivirus and antimalware software, monitors our intrusion detection system and intrusion protection system and reviews and cleans our corporate email system. Other than engaging the Service Provider prior to our initial public offering, given our overall risk profile, the Board has had limited involvement with our cybersecurity risk management. The management team, with support from the Service Provider, would raise any significant cybersecurity risks with the Board.
Risk Management and Strategy
We believe we have implemented processes that are designed to effectively manage risks from cybersecurity threats. Through our Service Provider, we have established an Incident Response Plan (the "IRP"). The IRP lays out our guidelines for responding to and handling cyber incidents. The IRP helps to ensure a quick and organized response in the event of a cyber incident and helps ensure all necessary members of management are informed so action can be taken as soon as possible. Under the IRP, once a cyber incident is identified, a response team will review the details of the cyber incident, inform management and work to secure our systems and fix the vulnerability. An investigation will be conducted, with the assistance of the Service Provider if needed, to determine the root cause of the cyber incident, the materiality of the cyber incident, and any disclosure or legal obligations that will stem from the cyber incident.
We have not been the victim of a cyber incident in the past but may be the subject of cyber incidents in the future. See Item 1A, Risk Factors for more information about the risk posed to us by cybersecurity threats.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.