Disclosure · Form 10-K · fiscal 2025
DoubleVerify Holdings, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 26, 2026· period ended December 31, 2025· DV· CIK 1819928· Updated · filing on sec.gov ↗
DoubleVerify Holdings, Inc.'s Form 10-K for fiscal 2025, filed February 26, 2026, names the Chief Information Security Officer as its top security role, reporting to the Chief Information Officer, with oversight by the Audit Committee.
What DoubleVerify's Item 1C says
DoubleVerify's Form 10-K for fiscal 2025 places oversight of the adequacy and effectiveness of information and technology security policies with the Audit Committee of the Board. The Chief Information Security Officer leads the cybersecurity team and reports to the Chief Information Officer.
Board and management oversight
The Board as a whole oversees the risk management program and exercises that oversight responsibility directly and through its committees. The Audit Committee also oversees management's implementation of the cybersecurity risk management program. The Audit Committee receives reports from management at least quarterly on topics that include cybersecurity risks attendant to the business and third-party and independent reviews. Management updates the Audit Committee regarding material or potentially material cybersecurity incidents. The Audit Committee provides reports to the full Board at least quarterly. The full Board also receives periodic briefings from management on the information security organization and risk management programs.
Who leads security
The Chief Information Security Officer reports to the Chief Information Officer and leads the cybersecurity team. The cybersecurity team has decades of experience managing cybersecurity risk worldwide, and members hold certifications such as Certified Ethical Hacker.
How the company manages cyber risk
The company's cybersecurity risk management program is integrated into its overall enterprise risk management program and uses cross-functional teams to assess risk. The program is informed by recognized standards including the National Institute of Standards and Technology Cybersecurity Framework and the AICPA Trust Services Criteria. The company's cybersecurity risk management program includes risk assessments designed to assess, identify and manage material cybersecurity risks to critical systems, information, solutions and the broader IT environment. The program includes an incident response plan, as well as vulnerability management, penetration testing, tabletop exercises and ongoing threat intelligence.
Third parties and incidents
The company uses third parties, where appropriate, to engage in penetration testing, conduct audits of its systems and engage in monitoring. The cybersecurity team supervises both internal cybersecurity personnel and retained external cybersecurity consultants. The company states it has not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect it during the period covered by the report.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed February 26, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Information Security Officer
Reports to
Chief Information Officer
“The Company's Chief Information Security Officer reports to our Chief Information Officer and leads the Company's cybersecurity team.”
Board oversight
Audit Committee
“The Audit Committee also oversees management's implementation of our cybersecurity risk management program.”
How often the board or committee hears about it
At least quarterly
“The Audit Committee receives reports from management at least quarterly on a broad range of relevant topics, which include cybersecurity risks attendant to our business, recent developments in the cybersecurity landscape and practice, third-party and independent reviews, benchmarking and resource allocation, among other topics.”
CISO or other person named
not identified
Frameworks and standards named
NIST Cybersecurity Framework, SOC 2
Where the filing names them
- NIST Cybersecurity Framework: “Our cyber risk management program is informed by recognized standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework ("CSF"), the International Organization Standardization ("ISO") 27001:2022 Information Security Management System Requirements and the AICPA Trust Services Criteria, which are independently validated and attested via our SOC 2 Type II report.”
- SOC 2: “Our cyber risk management program is informed by recognized standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework ("CSF"), the International Organization Standardization ("ISO") 27001:2022 Information Security Management System Requirements and the AICPA Trust Services Criteria, which are independently validated and attested via our SOC 2 Type II report.”
Outside assessors, consultants or testers
Described
“This team is principally responsible for managing the Company's cybersecurity risk management program, in cross-functional partnership with business leaders across the Company, reporting cybersecurity risks and incidents, among other things, to the Audit Committee, and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants.”
Experience of the security leadership, as stated
Stated
“Collectively, our cybersecurity team has decades of experience managing cybersecurity risk worldwide and members hold accreditations such as the Certified Information Systems Security Professional, Certified Ethical Hacker and Certified Information Security Manager certifications.”
Material incident
The filing states none
“During the period covered by this Annual Report, we have not identified cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.”
The section
727 words, Form 10-K filed February 26, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 26, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns DoubleVerify Holdings, Inc. standard industrial classification 7370, Services-computer programming, data processing, etc. (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Intelligent Protection Management Corp.FY 2025, filed March 17, 2026 | Chief Information Security Officer | the President | Audit Committee |
| Teads Holding Co.FY 2025, filed March 16, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Health Catalyst, Inc.FY 2025, filed March 12, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Rackspace TechnologyFY 2025, filed March 6, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| NIQ Global Intelligence plcFY 2025, filed February 27, 2026 | Chief Security Officer | not identified | Audit Committee |
| Pinterest, Inc.FY 2025, filed February 12, 2026 | Chief Security Officer | Chief Technology Officer | Audit and Risk Committee |
| AlphabetFY 2025, filed February 5, 2026 | Vice President of Privacy, Safety, and Security | not identified | Risk and Compliance Committee |
| MetaFY 2025, filed January 29, 2026 | Chief Information Security Officer | not identified | Audit & Privacy Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of DoubleVerify Holdings, Inc.'s Form 10-K as filed with the SEC on February 26, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity
We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. In furtherance thereof, we have made information security and protection a strategic priority. We have implemented multi-layered organizational, technical, and administrative measures which we continuously advance and proactively invest in.
Cybersecurity Risk Management and Strategy
We have a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into and serves as an important component of our overall enterprise risk management program, and utilizes cross-functional teams to proactively assess risk and ensure that security controls are built-in prior to deployment.
Our cyber risk management program is informed by recognized standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework ("CSF"), the International Organization Standardization ("ISO") 27001:2022 Information Security Management System Requirements and the AICPA Trust Services Criteria, which are independently validated and attested via our SOC 2 Type II report.
Our cybersecurity risk management program includes:
● risk assessments designed to assess, identify and manage material cybersecurity risks to our critical systems, information, solutions, and our broader IT environment;
● an incident response plan;
● vulnerability management, penetration testing, tabletop exercises and ongoing threat intelligence;
● the use of third-parties , where appropriate, to engage in penetration testing, conduct audits of our systems and engage in monitoring ;
● enterprise-wide cybersecurity awareness training; and
● a third-party risk management process for vendors.
Cybersecurity Governance
Cybersecurity is an important part of our risk management processes and an area of focus for the Board of Directors of DoubleVerify (the "Board") and management. Our Board as a whole has responsibility for overseeing our risk management program. The Board exercises this oversight responsibility directly and through its committees. The Board has primary responsibility for evaluating strategic and operational risk management, including cybersecurity risk management, and has delegated to the Audit Committee of the Board (the "Audit Committee") oversight of the adequacy and effectiveness of the Company's information and technology security policies as well as the internal controls regarding information and technology security, cybersecurity and privacy related areas. The Audit Committee also oversees management's implementation of our cybersecurity risk management program.
The Audit Committee receives reports from management at least quarterly on a broad range of relevant topics, which include cybersecurity risks attendant to our business, recent developments in the cybersecurity landscape and practice, third-party and independent reviews, benchmarking and resource allocation, among other topics. In addition, management updates the Audit Committee regarding material or potentially material cybersecurity incidents. The Audit Committee provides reports to the full Board regarding these and other matters at least quarterly. The full Board also receives periodic briefings from management on our information security organization and risk management programs.
The Company's Chief Information Security Officer reports to our Chief Information Officer and leads the Company's cybersecurity team. This team is principally responsible for managing the Company's cybersecurity risk management program, in cross-functional partnership with business leaders across the Company, reporting cybersecurity risks and incidents, among other things, to the Audit Committee, and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. Collectively, our cybersecurity team has decades of experience managing cybersecurity risk worldwide and members hold accreditations such as the Certified Information Systems Security Professional, Certified Ethical Hacker and Certified Information Security Manager certifications.
During the period covered by this Annual Report, we have not identified cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We recognize that we face a number of cybersecurity risks in connection with our business and that institutions like us, as well as our employees, service providers and other third parties on whom we rely have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of increasingly sophisticated cyber attacks. For more information about the cybersecurity risks we face, see the risk factor: "System failures, security breaches, cyberattacks or natural disasters could interrupt the operation of our platform and data centers and significantly harm our business, financial condition and results of operations" under the caption "Risk Factors" in this Annual Report on Form 10-K.
Earlier filings on record
Fiscal 2024 Form 10-K, filed February 27, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
Chief Information Officer
“The Company's Chief Information Security Officer reports to our Chief Information Officer and leads the Company's cybersecurity team.”
Board oversight
Audit Committee
“The Board has primary responsibility for evaluating strategic and operational risk management, including cybersecurity risk management, and has delegated to the Audit Committee of the Board (the "Audit Committee") oversight of the adequacy and effectiveness of the Company's information and technology security policies as well as the internal controls regarding information and technology security, cybersecurity and privacy related areas.”
Person named in the filing
not identified
Experience, as stated
Stated
“Collectively, our cybersecurity team has decades of experience managing cybersecurity risk worldwide and members hold accreditations such as the Certified Information Systems Security Professional, Certified Ethical Hacker and Certified Information Security Manager certifications.”
Material incident
The filing states none
“During the period covered by this Annual Report, we have not identified cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 26, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. In furtherance thereof, we have made information security and protection a strategic priority. We have implemented multi-layered organizational, technical, and administrative measures which we continuously advance and proactively invest in.
Cybersecurity Risk Management and Strategy
We have a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into and serves as an important component of our overall enterprise risk management program, and utilizes cross-functional teams to proactively assess risk and ensure that security controls are built-in prior to deployment.
Our cyber risk management program is informed by recognized standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework ("CSF"), the International Organization Standardization ("ISO") 27001:2013 Information Security Management System Requirements and the AICPA Trust Services Criteria, which are independently validated and attested via our SOC 2 Type II report.
Our cybersecurity risk management program includes:
● risk assessments designed to assess, identify and manage material cybersecurity risks to our critical systems, information, solutions, and our broader IT environment;
● an incident response plan;
● vulnerability management, penetration testing, tabletop exercises and ongoing threat intelligence;
● the use of third-parties , where appropriate, to engage in penetration testing, conduct audits of our systems and engage in monitoring ;
● enterprise-wide cybersecurity awareness training; and
● a third-party risk management process for vendors.
Cybersecurity Governance
Cybersecurity is an important part of our risk management processes and an area of focus for the Board of Directors of DoubleVerify (the "Board") and management. Our Board as a whole has responsibility for overseeing our risk management program. The Board exercises this oversight responsibility directly and through its committees. The Board has primary responsibility for evaluating strategic and operational risk management, including cybersecurity risk management, and has delegated to the Audit Committee of the Board (the "Audit Committee") oversight of the adequacy and effectiveness of the Company's information and technology security policies as well as the internal controls regarding information and technology security, cybersecurity and privacy related areas. The Audit Committee also oversees management's implementation of our cybersecurity risk management program.
The Audit Committee receives reports from management at least quarterly on a broad range of relevant topics, which include cybersecurity risks attendant to our business, recent developments in the cybersecurity landscape and practice, third-party and independent reviews, benchmarking and resource allocation, among other topics. In addition, management updates the Audit Committee regarding material or potentially material cybersecurity incidents. The Audit Committee provides reports to the full Board regarding these and other matters at least quarterly. The full Board also receives periodic briefings from management on our information security organization and risk management programs.
The Company's Chief Information Security Officer reports to our Chief Information Officer and leads the Company's cybersecurity team. This team is principally responsible for managing the Company's cybersecurity risk management program, in cross-functional partnership with business leaders across the Company, reporting cybersecurity risks and incidents, among other things, to the Audit Committee, and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. Collectively, our cybersecurity team has decades of experience managing cybersecurity risk worldwide and members hold accreditations such as the Certified Information Systems Security Professional, Certified Ethical Hacker and Certified Information Security Manager certifications.
During the period covered by this Annual Report, we have not identified cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We recognize that we face a number of cybersecurity risks in connection with our business and that institutions like us, as well as our employees, service providers and other third parties on whom we rely have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of increasingly sophisticated cyber attacks. For more information about the cybersecurity risks we face, see the risk factor: "System failures, security breaches, cyberattacks or natural disasters could interrupt the operation of our platform and data centers and significantly harm our business, financial condition and results of operations" under the caption "Risk Factors" in this Annual Report on Form 10-K.
Fiscal 2023 Form 10-K, filed February 28, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
Chief Information Officer
“The Company's Chief Information Security Officer reports to our Chief Information Officer and leads the Company's cybersecurity team.”
Board oversight
Audit Committee
“The Board has primary responsibility for evaluating strategic and operational risk management, including cybersecurity risk management, and has delegated to the Audit Committee of the Board (the "Audit Committee") oversight of the adequacy and effectiveness of the Company's information and technology security policies as well as the internal controls regarding information and technology security, cybersecurity and privacy related areas.”
Person named in the filing
not identified
Experience, as stated
Stated
“Collectively, our cybersecurity team has decades of experience managing cybersecurity risk worldwide and members hold accreditations such as the Certified Information Systems Security Professional, Certified Ethical Hacker and Certified Information Security Manager certifications.”
Material incident
The filing states none
“During the period covered by this Annual Report, we have not identified cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on October 26, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. In furtherance thereof, we have made information security and protection a strategic priority. We have implemented multi-layered organizational, technical, and administrative measures which we continuously advance and proactively invest in.
Cybersecurity Risk Management and Strategy
We have a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into and serves as an important component of our overall enterprise risk management program, and utilizes cross-functional teams to proactively assess risk and ensure that security controls are built-in prior to deployment.
Our cyber risk management program is informed by recognized standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework ("CSF"), the International Organization Standardization ("ISO") 27001:2013 Information Security Management System Requirements and the AICPA Trust Services Criteria, which are independently validated and attested via our SOC 2 Type II report.
Our cybersecurity risk management program includes:
● risk assessments designed to assess, identify and manage material cybersecurity risks to our critical systems, information, solutions, and our broader IT environment;
● an incident response plan;
● vulnerability management, penetration testing, tabletop exercises and ongoing threat intelligence;
● the use of third-parties, where appropriate, to engage in penetration testing, conduct audits of our systems and engage in monitoring;
● enterprise-wide cybersecurity awareness training; and
● a third-party risk management process for vendors.
Cybersecurity Governance
Cybersecurity is an important part of our risk management processes and an area of focus for the Board of Directors of DoubleVerify (the "Board") and management. Our Board as a whole has responsibility for overseeing our risk management program. The Board exercises this oversight responsibility directly and through its committees. The Board has primary responsibility for evaluating strategic and operational risk management, including cybersecurity risk management, and has delegated to the Audit Committee of the Board (the "Audit Committee") oversight of the adequacy and effectiveness of the Company's information and technology security policies as well as the internal controls regarding information and technology security, cybersecurity and privacy related areas. The Audit Committee also oversees management's implementation of our cybersecurity risk management program.
The Audit Committee receives reports from management at least quarterly on a broad range of relevant topics, which include cybersecurity risks attendant to our business, recent developments in the cybersecurity landscape and practice, third-party and independent reviews, benchmarking and resource allocation, among other topics. In addition, management updates the Audit Committee regarding material or potentially material cybersecurity incidents. The Audit Committee provides reports to the full Board regarding these and other matters at least quarterly. The full Board also receives periodic briefings from management on our information security organization and risk management programs.
The Company's Chief Information Security Officer reports to our Chief Information Officer and leads the Company's cybersecurity team. This team is principally responsible for managing the Company's cybersecurity risk management program, in cross-functional partnership with business leaders across the Company, reporting cybersecurity risks and incidents, among other things, to the Audit Committee, and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. Collectively, our cybersecurity team has decades of experience managing cybersecurity risk worldwide and members hold accreditations such as the Certified Information Systems Security Professional, Certified Ethical Hacker and Certified Information Security Manager certifications.
During the period covered by this Annual Report, we have not identified cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We recognize that we face a number of cybersecurity risks in connection with our business and that institutions like us, as well as our employees, service providers and other third parties on whom we rely have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of increasingly sophisticated cyber attacks. For more information about the cybersecurity risks we face, see the risk factor: "System failures, security breaches, cyberattacks or natural disasters could interrupt the operation of our platform and data centers and significantly harm our business, financial condition and results of operations" under the caption "Risk Factors" in this Annual Report on Form 10-K.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.