Disclosure · Form 10-K/A · fiscal 2025
EON Resources Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed October 13, 2026· period ended December 31, 2025· EONR· CIK 1842556· Updated · filing on sec.gov ↗
EON Resources Inc.'s Form 10-K/A for fiscal 2025, filed October 13, 2026, places oversight of cybersecurity risk with the full board; a top security role title is not identified.
What EON Resources' Item 1C says
EON Resources' Form 10-K/A for fiscal 2025 states that the board of directors will oversee any cybersecurity risk management framework. The Vice President of Finance and Administration has been designated as the lead for implementing the incident response plan.
Board and management oversight
A dedicated committee of the board of directors will review and approve any cybersecurity policies, strategies and risk management practices. The incident response plan includes the process for informing senior management and the Board of Directors of a material cybersecurity incident.
Who leads security
The company has a Vice President of Finance and Administration designated as the lead for implementing its incident response plan.
How the company manages cyber risk
The company is in the process of evaluating its cybersecurity needs and developing measures to enhance its cybersecurity posture. The company states that it is considering external cybersecurity experts, conducting vulnerability assessments and developing an incident response strategy.
Third parties and incidents
The company acquired a cybersecurity insurance policy in 2024. The company reports that it has not experienced any significant cybersecurity incidents to date.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a specific security framework or standard. The section does not say how often the board or its committee is briefed on cybersecurity.
Read from the Form 10-K/A filed October 13, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
not identified
Reports to
not identified
Board oversight
Full board
“In addition, our board of directors will oversee any cybersecurity risk management framework and a dedicated committee of our board of directors will review and approve any cybersecurity policies, strategies and risk management practices.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
not identified
Material incident
The filing states none
“Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date.”
The section
412 words, Form 10-K/A filed October 13, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 11, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns EON Resources Inc. standard industrial classification 1311, Crude petroleum & natural gas (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Royale Energy, Inc.FY 2025, filed July 13, 2026 | not identified | not identified | audit committee |
| Norris Industries, Inc.FY 2026, filed May 29, 2026 | Chief Executive Officer | not identified | not identified |
| Blue Dolphin Energy CoFY 2025, filed March 31, 2026 | chief executive officer | not identified | full board |
| W&T Offshore IncFY 2025, filed March 16, 2026 | CIO & CISO | not identified | Audit Committee of the board of directors |
| Empire Petroleum CorpFY 2025, filed March 13, 2026 | Vice President of IT | Chief Executive Officer | Audit Committee |
| Us Energy CorpFY 2025, filed March 13, 2026 | Director of IT | not identified | Audit Committee |
| APA CorpFY 2025, filed February 26, 2026 | Executive Vice President, Administration | Chief Executive Officer | Cybersecurity Committee |
| Chord Energy CorpFY 2025, filed February 26, 2026 | Vice President, Information Technology | not identified | Audit and Reserves Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of EON Resources Inc.'s Form 10-K/A as filed with the SEC on October 13, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. CYBERSECURITY
We acknowledge the increasing importance of cybersecurity
in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data,
potentially impacting our business operations, financial condition and reputation. As a smaller reporting company, we currently do not
have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. Our
approach to cybersecurity is in the developmental stage, and we have only begun to conduct comprehensive risk assessments, establish an
incident response plan, and engage with external cybersecurity consultants for assessments or services. As of the date of this report,
we have adopted an incident response plan which governs our assessment and response upon the occurrence of a material cybersecurity incident,
including the process for informing senior management and our Board of Directors. Our Vice President of Finance and Administration has
been designated as the lead for implementing our incident response plan. In addition, in 2024, we acquired a cybersecurity insurance policy.
Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date. However,
we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches and other
cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of, sensitive information, disrupt
our business operations, result in regulatory fines or litigation costs and negatively impact our reputation among customers and partners.
We are in the process of evaluating our cybersecurity
needs and developing appropriate measures to enhance our cybersecurity posture. This includes considering the engagement of external cybersecurity
experts to advise on best practices, conducting vulnerability assessments and developing an incident response strategy. Our goal is to
establish a cybersecurity framework that is commensurate with our size, complexity and the nature of our operations, thereby reducing
our exposure to cybersecurity risks.
In addition, our board of directors will oversee
any cybersecurity risk management framework and a dedicated committee of our board of directors will review and approve any cybersecurity
policies, strategies and risk management practices.
Despite our efforts to improve our cybersecurity
measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity
risks is constantly evolving, and we will continue to assess and update our cybersecurity measures in response to emerging threats.
For a discussion of potential cybersecurity risks
affecting us, please refer to the " Risk Factors " section.
Earlier filings on record
Fiscal 2024 Form 10-K/A, filed April 27, 2026 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
Full board
“In addition, our board of directors will oversee any cybersecurity risk management framework and a dedicated committee of our board of directors will review and approve any cybersecurity policies, strategies and risk management practices.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date.”
Read by claude-sonnet-5-5 on November 11, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
We acknowledge the increasing importance of cybersecurity
in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data,
potentially impacting our business operations, financial condition and reputation.
As a smaller reporting company, we currently do
not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks.
Our approach to cybersecurity is in the developmental stage, and we have only begun to conduct comprehensive risk assessments, establish
an incident response plan, and engage with external cybersecurity consultants for assessments or services. As of the date of this report,
we have adopted an incident response plan which governs our assessment and response upon the occurrence of a material cybersecurity incident,
including the process for informing senior management and our Board of Directors. Our Vice President of Finance and Administration has
been designated as the lead for implanting our incident response plan. In addition, in 2024, we have acquired a cybersecurity insurance
policy.
Given our current stage of cybersecurity development,
we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity
framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead
to unauthorized access to, or disclosure of, sensitive information, disrupt our business operations, result in regulatory fines or litigation
costs and negatively impact our reputation among customers and partners.
We are in the process of evaluating our cybersecurity
needs and developing appropriate measures to enhance our cybersecurity posture. This includes considering the engagement of external cybersecurity
experts to advise on best practices, conducting vulnerability assessments and developing an incident response strategy. Our goal is to
establish a cybersecurity framework that is commensurate with our size, complexity and the nature of our operations, thereby reducing
our exposure to cybersecurity risks.
In addition, our board of directors will oversee
any cybersecurity risk management framework and a dedicated committee of our board of directors will review and approve any cybersecurity
policies, strategies and risk management practices.
Despite our efforts to improve our cybersecurity
measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity
risks is constantly evolving, and we will continue to assess and update our cybersecurity measures in response to emerging threats.
For a discussion of potential cybersecurity risks
affecting us, please refer to the " Risk Factors " section.
Fiscal 2023 Form 10-K, filed May 3, 2024 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
Full board
“In addition, our board of directors will oversee any cybersecurity risk management framework and a dedicated committee of our board of directors will review and approve any cybersecurity policies, strategies and risk management practices.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date.”
Read by claude-sonnet-5-5 on November 11, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
We acknowledge the increasing importance of cybersecurity
in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data,
potentially impacting our business operations, financial condition and reputation.
As a smaller reporting company, we currently
do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity
risks. Our approach to cybersecurity is in the developmental stage, and we have only begun to conduct comprehensive risk assessments,
establish an incident response plan, and engage with external cybersecurity consultants for assessments or services. As of the date of
this report, we have adopted an incident response plan which governs our assessment and response upon the occurrence of a material cybersecurity
incident, including the process for informing senior management and our Board of Directors. Our Vice President of Finance and Administration
has been designated as the lead for implanting our incident response plan. In addition, in 2024, we have acquired a cybersecurity insurance
policy.
Given our current stage of cybersecurity development,
we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity
framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead
to unauthorized access to, or disclosure of, sensitive information, disrupt our business operations, result in regulatory fines or litigation
costs and negatively impact our reputation among customers and partners.
We are in the process of evaluating our cybersecurity
needs and developing appropriate measures to enhance our cybersecurity posture. This includes considering the engagement of external
cybersecurity experts to advise on best practices, conducting vulnerability assessments and developing an incident response strategy.
Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity and the nature of our operations, thereby
reducing our exposure to cybersecurity risks.
In addition, our board of directors will oversee
any cybersecurity risk management framework and a dedicated committee of our board of directors will review and approve any cybersecurity
policies, strategies and risk management practices.
Despite our efforts to improve our cybersecurity
measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity
risks is constantly evolving, and we will continue to assess and update our cybersecurity measures in response to emerging threats.
For a discussion of potential cybersecurity risks
affecting us, please refer to the " Risk Factors " section.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.