Disclosure · Form 10-K · fiscal 2026
VIP Play, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2026
Filed September 29, 2026· period ended June 30, 2026· VIPZ· CIK 1832161· Updated · filing on sec.gov ↗
VIP Play, Inc.'s Form 10-K for fiscal 2026, filed September 29, 2026, names the Chief Technology Officer as its top security role, with oversight by the full board.
What VIP Play's Item 1C says
VIP Play's Form 10-K for fiscal 2026 places oversight of cybersecurity risk with the Board of Directors. The cybersecurity program is overseen by senior management, including the Chief Technology Officer.
Board and management oversight
Senior management informs the Board of significant cybersecurity risks and material cybersecurity incidents, as appropriate.
Who leads security
The CTO is responsible for overseeing cybersecurity and information technology matters, evaluating information security risks, and coordinating the response to cybersecurity incidents. The CTO has technology and engineering experience, including technology solutions in regulated industries, payment solutions, fraud automation and data processing.
How the company manages cyber risk
The company has established processes designed to identify, assess, manage and respond to cybersecurity risks that could materially affect its business, operations or financial condition. The company periodically evaluates its cybersecurity controls through internal assessments and third-party testing, as appropriate.
Third parties and incidents
The company uses third-party service providers for certain information technology and cloud infrastructure services. In August 2025, the company identified a software defect in its information technology infrastructure that resulted in unauthorized player withdrawals. Management evaluated the incident and determined it did not materially affect the company's business strategy, results of operations or financial condition.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a board committee as responsible for cybersecurity oversight. The section does not name a specific security framework or standard. The section does not say how often the board or its committee is briefed on cybersecurity.
Read from the Form 10-K filed September 29, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Technology Officer
Reports to
not identified
Board oversight
Full board
“Our Board of Directors (the "Board") oversees risks from cybersecurity threats as part of its general oversight of our risk management activities.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“The CTO has significant technology and engineering experience, including experience with technology solutions in regulated industries, payment solutions, fraud automation and data processing.”
Material incident
The filing states none
“The Company has not identified any cybersecurity threats, including as a result of this incident, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.”
The section
388 words, Form 10-K filed September 29, 2026 for the period ended June 30, 2026
Read by claude-sonnet-5-5 on November 11, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns VIP Play, Inc. standard industrial classification 5900, Retail-miscellaneous retail (SEC SIC list). 4 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Agassi Sports Entertainment Corp.FY 2025, filed March 31, 2026 | Chief Executive Officer | Board of Directors | full board |
| Live Oak Acquisition Corp. VFY 2025, filed March 30, 2026 | not identified | not identified | Audit Committee |
| TheRealReal, Inc.FY 2025, filed February 26, 2026 | CISO | CTPO | Audit Committee |
| CIMG Inc.FY 2025, filed February 13, 2026 | not identified | not identified | full board |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of VIP Play, Inc.'s Form 10-K as filed with the SEC on September 29, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item
1C. Cybersecurity
Risk
Management and Strategy
The
Company has established processes designed to identify, assess, manage, and respond to cybersecurity risks that could materially affect
its business, operations, or financial condition. These processes are integrated into the Company's overall enterprise risk management
activities and include the implementation of administrative, technical, and physical safeguards intended to protect the confidentiality,
integrity, and availability of the Company's information systems and data.
The
Company's cybersecurity program incorporates policies and procedures designed to monitor network activity, manage access to systems,
protect cloud-based infrastructure, respond to security incidents, and periodically evaluate the effectiveness of security controls.
The Company also utilizes third-party service providers for certain information technology and cloud infrastructure services and considers
cybersecurity risks associated with those providers as part of its overall risk management process.
In
August 2025, the Company identified a software defect in its information technology infrastructure that resulted in unauthorized player
withdrawals, as further described in Note 12 to the consolidated financial statements. Management evaluated the incident and determined
that it did not materially affect the Company's business strategy, results of operations, or financial condition. The Company has
not identified any cybersecurity threats, including as a result of this incident, that have materially affected or are reasonably likely
to materially affect the Company, including its business strategy, results of operations, or financial condition.
Governance
Our
Board of Directors (the "Board") oversees risks from cybersecurity threats as part of its general oversight of our risk management
activities. Senior management informs the Board of significant cybersecurity risks and material cybersecurity incidents, as appropriate.
Our
cybersecurity program is overseen by senior management, including our Chief Technology Officer ("CTO"), who provides services
to us through Fuzebox AI, Inc. The CTO is responsible for overseeing cybersecurity and information technology matters, evaluating information
security risks, and coordinating our response to cybersecurity incidents. The CTO has significant technology and engineering experience,
including experience with technology solutions in regulated industries, payment solutions, fraud automation and data processing. The
CTO communicates with senior management regarding significant cybersecurity risks, emerging threats and cybersecurity incidents, as appropriate.
Assessment
and Oversight
The
Company periodically evaluates its cybersecurity controls through internal assessments and third-party testing, as appropriate. The Company
continually reviews and updates its cybersecurity policies and procedures in response to evolving threats, technological developments,
and changes in its business operations.
Earlier filings on record
Fiscal 2025 Form 10-K, filed September 29, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Technology Officer
Reports to, as the filing names it
not identified
Board oversight
Full board
“The Board of Directors receives updates regarding the Company's cybersecurity posture and material risks, including matters relating to network protection, firewall management, and incident response readiness.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
not identified
Read by claude-sonnet-5-5 on November 11, 2026; every quote verified in the stored text by code.
Item
1C. Cybersecurity
Risk
Management and Strategy
The
Company maintains policies, procedures, and technical safeguards designed to protect its network infrastructure, segregate environments,
and monitor for potential cybersecurity threats. Our approach aligns with ISO/IEC 27001:2022 standards and includes:
● Intrusion
Detection and Monitoring – We utilize cloud-native IDS/IPS services and firewall-based
alerting to monitor traffic for suspicious activity. Alerts are reviewed daily, and high-risk
alerts trigger immediate escalation under our Incident Response procedures. IDS/IPS configurations
are reviewed and tuned on a quarterly basis.
● Firewall
Rule Management – All ingress and egress traffic is filtered through firewalls or security
groups, following a default-deny principle. Firewall rule changes require approval by the
Security team and are documented. Rules are reviewed at least annually and following major
system changes.
● Network
Segmentation – Logical separation is maintained between production, staging, development,
and internal environments through VPCs, VLANs, or subnet segmentation. Administrative access
is segregated from user-facing systems, with restricted access to shared infrastructure.
These
measures are designed to reduce the risk of unauthorized access and support the confidentiality, integrity, and availability of our systems
and customer data. We maintain documentation of firewall changes, alert logs, network segmentation diagrams, and annual testing to evidence
compliance.
Governance
Oversight
of cybersecurity is integrated into our enterprise risk management program. The Company's Chief Technology Officer (CTO) serves
as the control owner for network security and provides regular updates to senior management. The Security team, in coordination with
IT and Infrastructure administrators, is responsible for:
● Configuring
and maintaining intrusion detection/prevention systems and firewall monitoring tools.
● Reviewing
alerts daily and investigating potential incidents.
● Approving
firewall changes and overseeing segmentation enforcement.
● Conducting
annual reviews of network security controls.
The
Board of Directors receives updates regarding the Company's cybersecurity posture and material risks, including matters relating
to network protection, firewall management, and incident response readiness.
Assessment
and Oversight
The
Company performs annual reviews and penetration testing of network controls, with results shared with senior management. Third-party
connections (e.g., payment processors, monitoring tools) are subject to access restrictions through IP allowlisting or VPN requirements.
The
Company will continue to monitor and enhance its network security controls and allocate resources to mitigate future risk.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.