Disclosure · Form 10-K · fiscal 2025
Owlet, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 9, 2026· period ended December 31, 2025· OWLT· CIK 1816708· Updated · filing on sec.gov ↗
Owlet, Inc.'s Form 10-K for fiscal 2025, filed March 9, 2026, names the Chief Technology Officer as its top security role, with oversight by the Audit Committee.
What Owlet's Item 1C says
Owlet's Form 10-K for fiscal 2025 places oversight of cybersecurity risk with the Audit Committee, to which the Board has delegated that oversight. The Chief Technology Officer and Chief Operating Officer are primarily responsible for assessing and managing material risks from cybersecurity threats.
Board and management oversight
The Chief Technology Officer and Chief Operating Officer provide the Audit Committee of the Board of Directors with quarterly updates on the performance of the program. The CTO regularly updates the full Board of Directors on information security matters and risk, including cybersecurity, as requested by the Committee. Management updates the Committee, where it deems appropriate, regarding any significant cybersecurity incidents.
Who leads security
The CTO has over 10 years of experience overseeing cybersecurity functions within technology-driven organizations, and the COO has over 5 years of experience overseeing cybersecurity and IT functions.
How the company manages cyber risk
The company's cybersecurity risk management program is designed and assessed to align with practices recommended by the National Institute of Standards and Technology ("NIST") and the FDA. The program is integrated into the Quality Management system and overall enterprise risk management. The program includes cybersecurity awareness training for employees, security tools that monitor and detect threats, cyber liability insurance, and an incident response plan. The company has established a data security team of cross-functional team members to address cybersecurity threats and incidents.
Third parties and incidents
The company uses external service providers, where appropriate, to assess, test or otherwise assist with aspects of its security controls. The program includes a third-party risk management process, including contractual obligations, for service providers, suppliers and vendors who have access to critical systems and information. The company states it has not identified risks from known cybersecurity threats, including from prior incidents, that have materially affected it.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed March 9, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Technology Officer
Reports to
not identified
Board oversight
Audit Committee
“Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.”
How often the board or committee hears about it
Quarterly
“Our Chief Technology Officer ("CTO") and Chief Operating Officer ("COO") are primarily responsible for assessing and managing our material risks from cybersecurity threats, and provide the Audit Committee of the Board of Directors with quarterly updates on the performance of our program.”
CISO or other person named
not identified
Frameworks and standards named
NIST (publication not named)
Where the filing names it
- NIST (publication not named): “Our cybersecurity risk management program is designed and assessed to align with practices recommended by the National Institute of Standards and Technology ("NIST") and the FDA, to help us identify, assess and manage cybersecurity risks relevant to our business.”
Outside assessors, consultants or testers
Described
“Our Company has also established a data security team, comprised of cross-functional team members to address cybersecurity threats and incidents and engage third-party consultants as needed to address these risks.”
Experience of the security leadership, as stated
Stated
“Our CTO has over 10 years of experience overseeing cybersecurity functions within technology-driven organizations and our COO has over 5 years of experience overseeing cybersecurity and IT functions.”
Material incident
The filing states none
“We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.”
The section
631 words, Form 10-K filed March 9, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 5, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Owlet, Inc. standard industrial classification 3829, Measuring & controlling devices, nec (SEC SIC list). 3 other filers in our library have the same code. Also shown: filers whose codes the SEC assigns to the same review office (Industrial Applications and Services).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Birchtech Corp.FY 2025, filed March 31, 2026 | Vice President of Operations | Board of Directors | full board |
| 908 Devices Inc.FY 2025, filed March 9, 2026 | Senior Director of Information Technology | not identified | audit committee |
| Rockwell AutomationFY 2025, filed November 12, 2025 | Chief Information Security Officer | Chief Information Officer (CIO) | Audit Committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Advanced Biomed Inc.FY 2026, filed October 13, 2026 | Chief Executive Officer | not identified | not identified |
| Bion Environmental Technologies IncFY 2026, filed September 29, 2026 | not identified | not identified | full board |
| Bloomia Holdings, Inc.FY 2026, filed September 21, 2026 | not identified | not identified | Audit Committee |
| Karbon-X Corp.FY 2026, filed September 15, 2026 | Chief Executive Officer | not identified | full board |
| Aehr Test SystemsFY 2026, filed July 27, 2026 | Chief Operating Officer | not identified | Audit Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Owlet, Inc.'s Form 10-K as filed with the SEC on March 9, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity.
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is designed and assessed to align with practices recommended by the National Institute of Standards and Technology ("NIST") and the FDA, to help us identify, assess and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
Our cybersecurity risk management program is integrated into our Quality Management system, our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas.
Key elements of our cybersecurity risk management program include, but are not limited to the following:
• a framework for identifying, mitigating and responding to cybersecurity threats and vulnerabilities;
• cybersecurity management and support, including team members responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;
• the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including benchmarking against NIST and FDA standards, and support customer data transfer;
• cybersecurity awareness training for employees;
• security tools in our system to monitor and detect cybersecurity threats;
• cyber liability insurance;
• a cybersecurity incident response plan that includes how to respond to cybersecurity incidents; and
• a third-party risk management process , including contractual obligations, for service providers, suppliers and vendors who have access to our critical systems and information.
We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see Part I. Item 1A "Risk Factors— Risks Related to Our Business and Operations— Our business and operations may suffer in the event of IT system failures, cyberattacks or deficiencies in our cybersecurity."
Cybersecurity Governance
Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. Our Chief Technology Officer ("CTO") and Chief Operating Officer ("COO") are primarily responsible for assessing and managing our material risks from cybersecurity threats, and provide the Audit Committee of the Board of Directors with quarterly updates on the performance of our program. Our CTO has over 10 years of experience overseeing cybersecurity functions within technology-driven organizations and our COO has over 5 years of experience overseeing cybersecurity and IT functions. The CTO regularly updates the full Board of Directors on information security matters and risk, including cybersecurity, as requested by the Committee. In addition, management updates the Committee, where it deems appropriate, regarding any significant cybersecurity incidents.
Our management team takes steps to stay informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment. Our Company has also established a data security team, comprised of cross-functional team members to address cybersecurity threats and incidents and engage third-party consultants as needed to address these risks.
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 11, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Technology Officer
Reports to, as the filing names it
Audit Committee of the Board of Directors
“Our Chief Technology Officer ("CTO") and Chief Operating Officer ("COO") are primarily responsible for assessing and managing our material risks from cybersecurity threats, and provide the Audit Committee of the Board of Directors with quarterly updates on the performance of our program.”
Board oversight
Audit Committee
“Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our CTO has over 10 years of experience overseeing cybersecurity functions within technology-driven organizations and our COO has over 5 years of experience overseeing cybersecurity and IT functions.”
Material incident
The filing states none
“We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on November 5, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is designed and assessed to align with practices recommended by the National Institute of Standards and Technology ("NIST") and the FDA, to help us identify, assess and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
Our cybersecurity risk management program is integrated into our Quality Management system, our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas.
Key elements of our cybersecurity risk management program include, but are not limited to the following:
• a framework for identifying, mitigating and responding to cybersecurity threats and vulnerabilities;
• cybersecurity management and support, including team members responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;
• the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including benchmarking against NIST and FDA standards, and support customer data transfer;
• cybersecurity awareness training for employees;
• security tools in our system to monitor and detect cybersecurity threats;
• cyber liability insurance;
• a cybersecurity incident response plan that includes how to respond to cybersecurity incidents; and
• a third-party risk management process , including contractual obligations, for service providers, suppliers and vendors who have access to our critical systems and information.
We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more
information, see Part I. Item 1A "Risk Factors— Risks Related to Our Business and Operations— Our business and operations may suffer in the event of IT system failures, cyberattacks or deficiencies in our cybersecurity."
Cybersecurity Governance
Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. Our Chief Technology Officer ("CTO") and Chief Operating Officer ("COO") are primarily responsible for assessing and managing our material risks from cybersecurity threats, and provide the Audit Committee of the Board of Directors with quarterly updates on the performance of our program. Our CTO has over 10 years of experience overseeing cybersecurity functions within technology-driven organizations and our COO has over 5 years of experience overseeing cybersecurity and IT functions. The CTO regularly updates the full Board of Directors on information security matters and risk, including cybersecurity, as requested by the Committee. In addition, management updates the Committee, where it deems appropriate, regarding any significant cybersecurity incidents.
Our management team takes steps to stay informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment. Our Company has also established a data security team, comprised of cross-functional team members to address cybersecurity threats and incidents and engage third-party consultants as needed to address these risks.
Fiscal 2023 Form 10-K, filed March 8, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Technology Officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other IT risks.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on November 5, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is designed and assessed to align with practices recommended by the National Institute of Standards and Technology (NIST) and the FDA, to help us identify, assess and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
Our cybersecurity risk management program is integrated into our Quality Management system, our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas.
Key elements of our cybersecurity risk management program include, but are not limited to the following:
• a framework for identifying, mitigating and responding to cybersecurity threats and vulnerabilities;
• cybersecurity management and support, including team members responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;
• the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including benchmarking against NIST and FDA standards, and support customer data transfer;
• cybersecurity awareness training for employees;
• security tools in our system to monitor and detect cybersecurity threats;
• cyber liability insurance
• a cybersecurity incident response plan that includes how to respond to cybersecurity incidents; and
• a third-party risk management process, including contractual obligations, for service providers, suppliers and vendors who have access to our critical systems and information.
We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see Part I. Item 1A "Risk Factors— Risks Related to Our Business and Operations— Our business and operations may suffer in the event of IT system failures, cyberattacks or deficiencies in our cybersecurity."
Cybersecurity Governance
Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other IT risks. The Committee oversees management's implementation of our cybersecurity risk management program. Our Chief Technology Officer (CTO) and Chief Operating Officer are responsible for assessing and managing our material risks from cybersecurity threats, and provide the Audit Committee of the Board of Directors with quarterly updates on the performance of our program. The CTO regularly updates the full Board of Directors on information security matters and risk, including cybersecurity, as requested by the Committee. In addition, management updates the Committee, as necessary, regarding any significant cybersecurity incidents.
Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Our Company has also established a data security team, comprised of cross-functional team members to address cybersecurity threats and incidents and engage third-party consultants as needed to address these risks.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.