Disclosure · Form 10-K · fiscal 2025
Nerdy Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 26, 2026· period ended December 31, 2025· NRDY· CIK 1819404· Updated · filing on sec.gov ↗
Nerdy Inc.'s Form 10-K for fiscal 2025, filed February 26, 2026, names the Vice President, Engineering and Security as its top security role, with oversight by the Audit Committee.
What Nerdy's Item 1C says
Nerdy's Form 10-K for fiscal 2025 places oversight of cybersecurity risk management with the Audit Committee, to which the Board of Directors has delegated it. The filing says the Vice President, Engineering and Security works with the CEO, COO, CFO and CLO, among others, to implement the cybersecurity program.
Board and management oversight
The Audit Committee receives regular presentations and reports on cybersecurity risks. The Audit Committee also receives prompt and timely information on any cybersecurity incident that meets established reporting thresholds, plus ongoing updates until the incident has been addressed. On an annual basis, the Audit Committee discusses the company's approach to cybersecurity risk management with members of the management team, including the Vice President, Engineering and Security. Management monitors cybersecurity threats and incidents in real time through ongoing communication and reports them to the Audit Committee when appropriate.
Who leads security
The Vice President, Engineering and Security has served in various roles in information technology for over 25 years. The CEO, COO, CFO and CLO each hold degrees in their respective fields and have experience managing risks, including risks arising from cybersecurity threats.
How the company manages cyber risk
The company's cybersecurity policies, standards, processes and practices are part of its risk management program and are based on recognized frameworks. The company provides regular, mandatory training for personnel regarding cybersecurity threats. The company deploys technical safeguards including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls. The company maintains incident response and recovery plans, and those plans are tested and evaluated on a regular basis. The company engages in periodic assessment and testing of its policies, standards, processes and practices designed to address cybersecurity threats and incidents.
Third parties and incidents
The company uses a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems. Cybersecurity threats, including from any previous incidents, have not materially affected the company, including its business strategy, results of operations or financial condition.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed February 26, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Vice President, Engineering and Security
Reports to
not identified
Board oversight
Audit Committee
“Our Board of Directors, recognizing the importance of maintaining the trust and confidence of our Learners, Experts, Institutional customers, clients, business partners, employees, and contractors, has delegated oversight of our cybersecurity risk management to the Audit Committee.”
CISO or other person named
not identified
Frameworks and standards named
NIST (publication not named)
Where the filing names it
- NIST (publication not named): “of Standards and Technology (the "NIST").”
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“The Vice President, Engineering and Security has served in various roles in information technology for over 25 years.”
Material incident
The filing states none
“Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition.”
The section
740 words, Form 10-K filed February 26, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 1, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Nerdy Inc. standard industrial classification 8200, Services-educational services (SEC SIC list). 3 other filers in our library have the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Trade & Services).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| PCS Edventures!, Inc.FY 2026, filed June 26, 2026 | Director of Technology | President | not identified |
| Classover Holdings, Inc.FY 2025, filed April 1, 2026 | not identified | not identified | full board |
| BEST SPAC I Acquisition Corp.FY 2025, filed February 9, 2026 | not identified | not identified | full board |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| VIP Play, Inc.FY 2026, filed September 29, 2026 | Chief Technology Officer | not identified | full board |
| GenFlat Holdings, Inc.FY 2026, filed September 25, 2026 | Chief Executive Officer and Chief Financial Officer | not identified | full board |
| Stitch Fix, Inc.FY 2026, filed September 24, 2026 | Chief Information Security Officer | Chief Product and Technology Officer | Audit Committee |
| CreditRiskMonitor Com IncFY 2025, filed August 19, 2026 | Chief Technology Officer | not identified | Audit Committee |
| H&R BlockFY 2026, filed August 14, 2026 | Chief Information Security Officer | not identified | Audit Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Nerdy Inc.'s Form 10-K as filed with the SEC on February 26, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. CYBERSECURITY.
Our Board of Directors, recognizing the importance of maintaining the trust and confidence of our Learners, Experts, Institutional customers, clients, business partners, employees, and contractors, has delegated oversight of our cybersecurity risk management to the Audit Committee. Our cybersecurity policies, standards, processes, and practices have been established as part of our risk management program and are based on recognized frameworks, including as adopted by the National Institute
of Standards and Technology (the "NIST"). In general, we seek to address cybersecurity risks through a cross-functional approach focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
Our cybersecurity program focuses on these key areas:
• Governance : The Audit Committee has oversight of cybersecurity risk management and regularly interacts with our Vice President, Engineering and Security and other members of management.
• Education and Awareness : We provide regular, mandatory training for personnel regarding cybersecurity threats to equip them with effective tools to address and mitigate cybersecurity threats, and to communicate our information security policies, standards, processes, and practices.
• Cross-Functional Approach : We employ a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.
• Third-Party Risk Management : We have adopted a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.
• Technical Safeguards : We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and revised through vulnerability and cybersecurity threat assessments.
• Incident Response and Recovery Planning : We maintain incident response and recovery plans addressing our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.
We engage in the periodic assessment and testing of our policies, standards, processes, and practices designed to address cybersecurity threats and incidents. These efforts include internal and external activities, including reviews of our information security control environment, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning, and information security maturity assessments.
The Audit Committee receives regular presentations and reports on cybersecurity risks. Those presentations and reports have covered or will cover topics such as recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, and technological and peer company trends. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Audit Committee discusses the Company's approach to cybersecurity risk management with the members of the management team, including the Vice President, Engineering and Security.
Our Vice President, Engineering and Security in coordination with our Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), Chief Financial Officer ("CFO"), and Chief Legal Officer ("CLO") , among others, work collaboratively across functions to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communication, we monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.
The Vice President, Engineering and Security has served in various roles in information technology for over 25 years. Our CEO, COO, CFO and CLO each hold degrees in their respective fields, and each have experience managing risks, including risks arising from cybersecurity threats.
Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. Depending on their nature, cybersecurity threats in the future may materially affect our business strategy, results of operations, or financial condition. See "Risk Factors" in Part I, Item 1A of this report.
Earlier filings on record
Fiscal 2024 Form 10-K, filed February 27, 2025 sec.gov ↗
Top security role, as the filing names it
Vice President, Engineering and Security
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“Our Board of Directors, recognizing the importance of maintaining the trust and confidence of our Learners, Experts, Institutional customers, clients, business partners, and employees, has delegated oversight of our cybersecurity risk management to the Audit Committee.”
Person named in the filing
not identified
Experience, as stated
Stated
“The Vice President, Engineering and Security has served in various roles in information technology for over 25 years.”
Material incident
The filing states none
“Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on November 1, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY.
Our Board of Directors, recognizing the importance of maintaining the trust and confidence of our Learners, Experts, Institutional customers, clients, business partners, and employees, has delegated oversight of our cybersecurity risk management to the Audit Committee. Our cybersecurity policies, standards, processes, and practices have been established as part of our risk management program and are based on recognized frameworks, including as adopted by the National Institute
of Standards and Technology (the "NIST"). In general, we seek to address cybersecurity risks through a cross-functional approach focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
Our cybersecurity program focuses on these key areas:
• Governance : The Audit Committee has oversight of cybersecurity risk management and regularly interacts with our Chief Technology Officer ("CTO") and other members of management.
• Education and Awareness : We provide regular, mandatory training for personnel regarding cybersecurity threats to equip them with effective tools to address and mitigate cybersecurity threats, and to communicate our information security policies, standards, processes, and practices.
• Cross-Functional Approach : We employ a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.
• Third-Party Risk Management : We have adopted a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.
• Technical Safeguards : We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and revised through vulnerability and cybersecurity threat assessments.
• Incident Response and Recovery Planning : We maintain incident response and recovery plans addressing our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.
We engage in the periodic assessment and testing of our policies, standards, processes, and practices designed to address cybersecurity threats and incidents. These efforts include internal and external activities, including reviews of our information security control environment, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning, and information security maturity assessments.
The Audit Committee receives regular presentations and reports on cybersecurity risks. Those presentations and reports have covered or will cover topics such as recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, and technological and peer company trends. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Audit Committee discusses the Company's approach to cybersecurity risk management with the members of the management team, including the CTO and the Vice President, Engineering and Security.
The CTO and Vice President, Engineering and Security in coordination with our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and Chief Legal Officer ("CLO"), among others, work collaboratively across functions to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communication, we monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.
Our CTO has served in various roles in information technology and information security for over a decade, and holds a doctorate in mathematics from the London School of Economics and Political Science. The Vice President, Engineering and Security has served in various roles in information technology for over 25 years. Our CEO, CFO and CLO each hold degrees in their respective fields, and each have experience managing risks, including risks arising from cybersecurity threats.
Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. Depending on their nature, cybersecurity threats in the future may materially affect our business strategy, results of operations, or financial condition. See "Risk Factors" in Part I, Item 1A of this report.
Fiscal 2023 Form 10-K, filed February 27, 2024 sec.gov ↗
Top security role, as the filing names it
Vice President, Engineering and Security
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“Our Board of Directors, recognizing the importance of maintaining the trust and confidence of our Learners, Experts, Institutional customers, clients, business partners, and employees, has delegated oversight of our cybersecurity risk management to the Audit Committee.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our CTO has served in various roles in information technology and information security for over a decade, and holds a doctorate in mathematics from the London School of Economics and Political Science.”
Material incident
The filing states none
“Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on November 1, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY.
Our Board of Directors, recognizing the importance of maintaining the trust and confidence of our Learners, Experts, Institutional customers, clients, business partners, and employees, has delegated oversight of our cybersecurity risk management to the Audit Committee. Our cybersecurity policies, standards, processes, and practices have been established as part of our risk management program and are based on recognized frameworks, including as adopted by the National Institute of Standards and Technology (the "NIST"). In general, we seek to address cybersecurity risks through a cross-functional approach focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
Our cybersecurity program focuses on these key areas:
• Governance : The Audit Committee has oversight of cybersecurity risk management and regularly interacts with our Chief Technology Officer ("CTO") and other members of management.
• Education and Awareness : We provide regular, mandatory training for personnel regarding cybersecurity threats to equip them with effective tools to address and mitigate cybersecurity threats, and to communicate our information security policies, standards, processes, and practices.
• Cross-Functional Approach : We have adopted a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.
• Third-Party Risk Management : We have adopted a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.
• Technical Safeguards : We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and revised through vulnerability and cybersecurity threat assessments.
• Incident Response and Recovery Planning : We maintain incident response and recovery plans addressing our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.
We engage in the periodic assessment and testing of our policies, standards, processes, and practices designed to address cybersecurity threats and incidents. These efforts include internal and external activities, including reviews of our information security control environment, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning, and information security maturity assessments.
In late 2023, the Board of Directors delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee receives regular presentations and reports on cybersecurity risks, and prior to the Board's delegation, the Board periodically received such presentations and reports. Those presentations and reports have covered or will cover topics such as recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, and technological and peer company trends. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Audit Committee discusses the Company's approach to cybersecurity risk management with the members of the management team, including the CTO and the Vice President, Engineering and Security.
The CTO and Vice President, Engineering and Security in coordination with our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and Chief Legal Officer ("CLO"), among others, work collaboratively across functions to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communication, we
monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.
Our CTO has served in various roles in information technology and information security for over a decade, and holds a doctorate in mathematics from the London School of Economics and Political Science. The Vice President, Engineering and Security has served in various roles in information technology for over 25 years. Our CEO, CFO and CLO each hold degrees in their respective fields, and each have experience managing risks, including risks arising from cybersecurity threats.
Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. Depending on their nature, cybersecurity threats in the future may materially affect our business strategy, results of operations, or financial condition. See "Risk Factors" in Part I, Item 1A of this report.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.