Disclosure · Form 10-K · fiscal 2026
Nextpower Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2026
Filed May 19, 2026· period ended March 31, 2026· NXT· CIK 1852131· Updated · filing on sec.gov ↗
Nextpower Inc.'s Form 10-K for fiscal 2026, filed May 19, 2026, names the Chief Information Security Officer as its top security role, with oversight by the Audit Committee.
What the filing says, in plain English
Who leads security (the top role, as the filing names it)
Chief Information Security Officer
Reports to
not identified
Board oversight
Audit Committee
“The Board has delegated primary oversight of cybersecurity risk to the Audit Committee.”
CISO or other person named
not identified
Frameworks and standards named
NIST Cybersecurity Framework, CIS Controls
Where the filing names them
- NIST Cybersecurity Framework: “We design our cybersecurity practices based on recognized industry standards and frameworks, including the NIST Cybersecurity Framework (NIST CSF) and the CIS Critical Security Controls.”
- CIS Controls: “We design our cybersecurity practices based on recognized industry standards and frameworks, including the NIST Cybersecurity Framework (NIST CSF) and the CIS Critical Security Controls.”
Outside assessors, consultants or testers
Described
“• Vulnerability Management: We conduct regular vulnerability scanning and engage independent third parties to perform penetration testing across our internal and external environments.”
Experience of the security leadership, as stated
Stated
“The cybersecurity program is led by the Chief Information Security Officer (CISO), who has over 15 years of experience in cybersecurity, information security, and enterprise risk management.”
Material incident
The filing states none
“As of the date of this report, we have not identified any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, strategy, results of operations, or financial condition.”
The section
737 words, Form 10-K filed May 19, 2026 for the period ended March 31, 2026
Read by claude-sonnet-5-5 on October 21, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Nextpower Inc. standard industrial classification 3674, Semiconductors & related devices (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Penguin Solutions, Inc.FY 2026, filed October 20, 2026 | Chief Information Officer | not identified | not identified |
| Netlist IncFY 2025, filed March 19, 2026 | Chief Financial Officer | President and Chief Executive Officer | full board |
| NvidiaFY 2026, filed February 25, 2026 | Chief Security Officer | Senior Vice President of Software Engineering | Audit Committee |
| Astera LabsFY 2025, filed February 20, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Enphase Energy, Inc.FY 2025, filed February 17, 2026 | Senior Vice President of Security | not identified | Audit Committee |
| On Semiconductor CorpFY 2025, filed February 9, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Texas Instruments IncFY 2025, filed February 6, 2026 | chief information security officer | chief information officer | not identified |
| Maxlinear, IncFY 2025, filed January 29, 2026 | senior IT executive | not identified | Cybersecurity Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Nextpower Inc.'s Form 10-K as filed with the SEC on May 19, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. CYBERSECURITY
Risk management and strategy
Nextpower maintains a cybersecurity and information security program designed to identify, assess, prioritize, and manage risks to our systems, data, and operations. Cybersecurity risk management is integrated into our broader Enterprise Risk Management (ERM) framework and is treated as an ongoing, adaptive process aligned with the evolving threat landscape and regulatory expectations.
We design our cybersecurity practices based on recognized industry standards and frameworks, including the NIST Cybersecurity Framework (NIST CSF) and the CIS Critical Security Controls. We regularly evaluate and enhance our controls to address emerging threats, regulatory developments, and business requirements.
As part of our cybersecurity risk management processes, we assess whether identified cybersecurity threats or incidents are reasonably likely to materially affect the Company, including its financial condition, results of operations, or business strategy. This includes defined processes for escalation, internal reporting, and, where appropriate, disclosure in accordance with applicable SEC requirements.
Key components of our cybersecurity risk management program include:
• Governance and Leadership: A dedicated cybersecurity leadership function, led by the Chief Information Security Officer (CISO), is responsible for overseeing the cybersecurity program, strategy, and operations.
• Risk Identification and Assessment: We perform ongoing risk assessments to identify internal and external threats, vulnerabilities, and potential impacts to the business.
• Vulnerability Management: We conduct regular vulnerability scanning and engage independent third parties to perform penetration testing across our internal and external environments.
• Third-Party Risk Management: We assess the security posture of critical vendors and service providers through due diligence, contractual requirements, and ongoing monitoring.
• Threat Monitoring and Detection: We utilize a combination of automated tools, security monitoring platforms, and threat intelligence feeds to detect, analyze, and respond to potential threats in a timely manner.
• Incident Response and Recovery: We maintain and periodically test an incident response plan designed to enable timely detection, containment, remediation, and recovery from cybersecurity incidents. We incorporate lessons learned from incidents and exercises into program improvements.
• Security Awareness and Training: We provide ongoing cybersecurity awareness and training programs to employees to reduce human-related risk factors.
• Risk Prioritization and Remediation: Identified risks are documented in a centralized risk register and prioritized based on potential business impact, with remediation efforts tracked through formal governance processes.
We engage external cybersecurity firms and advisors, where appropriate, to support assessments, testing, and program maturity evaluations.
We regularly review and update our cybersecurity program to reflect changes in the threat landscape, business operations, and regulatory environment.
As of the date of this report, we have not identified any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, strategy, results of operations, or financial condition. However, cybersecurity threats continue to increase in frequency and sophistication, and we remain focused on strengthening our defenses, detection capabilities, and response readiness.
For additional information regarding cybersecurity risks, refer to the risk factor titled "Cybersecurity or other data security incidents could materially disrupt our operations, compromise sensitive information, and adversely affect our financial performance and reputation" in Item 1A. Risk Factors of this Annual Report on Form 10-K.
Governance
Our Board of Directors oversee enterprise risk management, including cybersecurity risk. The Board has delegated primary oversight of cybersecurity risk to the Audit Committee.
The Audit Committee is responsible for reviewing management's assessment of cybersecurity risks, including the overall threat landscape, key risk exposures, and the effectiveness of mitigation strategies and investments. The Audit Committee receives regular updates from management on cybersecurity matters and reports to the full Board as appropriate.
Management is responsible for the day-to-day management of cybersecurity risks. This includes identifying and assessing risks, implementing and maintaining controls, monitoring for threats, determining materiality of incidents, and responding to cybersecurity events.
The cybersecurity program is led by the Chief Information Security Officer (CISO), who has over 15 years of experience in cybersecurity, information security, and enterprise risk management. The CISO has held senior leadership roles, including prior CISO positions, overseeing the design and operation of enterprise security programs across cloud and on-premises environments, including areas such as threat detection and response, vulnerability management, and security governance. The CISO holds the Certified Information Systems Security Professional (CISSP) certification. The CISO regularly reports to senior management and the Audit Committee on cybersecurity risks, incidents, program maturity, strategic initiatives, regulatory
compliance, and significant developments in the cybersecurity landscape, and is responsible for providing updates during potentially material cybersecurity incidents.
Earlier filings on record
Fiscal 2025 Form 10-K, filed May 22, 2025 sec.gov ↗
Top security role, as the filing names it
Cybersecurity Leader
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“Our Board of Directors has oversight responsibility for our overall enterprise risk management, and has delegated cybersecurity risk management oversight to the Audit Committee of our Board of Directors.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our cybersecurity program includes some key aspects such as (i) a Cybersecurity Leader who oversees our day-to-day program and who is a long-standing member of both the ISC2 and ISACA organizations, which specialize in cybersecurity and governance, (ii) a cybersecurity council comprised of a cross-section of management with oversight over our program, (iii) incident response, and (iv) ongoing security awareness training.”
Material incident
The filing states none
“As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably expected to materially affect our business.”
Read by claude-sonnet-5-5 on October 21, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
Risk management and strategy
Nextracker places emphasis on addressing cybersecurity threats and effectively managing associated risks. Our cybersecurity program is designed to identify, assess, and proactively manage material risks.
Our approach to cybersecurity is not a one-time effort but an ongoing process. We engage in monitoring, risk assessments, and robust security measures designed to ensure the confidentiality, integrity, and availability of our information systems, including critical computer networks, hosted services, communication systems, hardware, and software and to protect critical data, including our employees' and customers' data, intellectual property, confidential and proprietary data, and strategic competitive information. We address cybersecurity challenges and enhance our overall risk management efforts by adopting and working to integrate recognized best practices, standards, and controls such as the CIS 18 Critical Security Controls and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).
Our cybersecurity program includes some key aspects such as (i) a Cybersecurity Leader who oversees our day-to-day program and who is a long-standing member of both the ISC2 and ISACA organizations, which specialize in cybersecurity and governance, (ii) a cybersecurity council comprised of a cross-section of management with oversight over our program, (iii) incident response, and (iv) ongoing security awareness training.
At Nextracker, we maintain a practical approach to cybersecurity. Our cybersecurity risk management program (an integral part of our overall Enterprise Risk Management Program) is designed to incorporate established best practices and industry standards, drawing guidance from both CIS 18 and NIST CSF. Within our program, we conduct internal and external security-based activities, including reviews and assessments of our third-party service providers and vendors .
Some of our activities include:
1. Information Security Assessments : We collaborate with internal and external partners to evaluate our security.
2. Vulnerability Scanning and Penetration Testing : Engaging third-party service providers to assess external and internal vulnerabilities and potential threats.
3. Cyber Risk Register Reviews : Regularly review our internal risk register to stay vigilant against potential and identified risks.
4. Risk Prioritization : We prioritize and address risks through our dedicated cybersecurity risk management program and the cybersecurity council.
We monitor the threat environment for potential risks, employing various methods, including automated detection tools, environment scans, and investigations of potential threats and reports. We also use threat intelligence feeds and vulnerability databases to monitor our systems, and have incident response processes designed to ensure swift action.
As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably expected to materially affect our business. However, we acknowledge the evolving nature of cybersecurity threats and remain committed to enhancing our protective measures as needed.
For more detailed information about our company's specific cybersecurity risks, please refer to the risk factor titled "Cybersecurity or other data security incidents could harm our business, expose us to liability and cause reputational damage" in Item 1A. Risk Factors of this Annual Report on Form 10-K.
Governance
Our Board of Directors has oversight responsibility for our overall enterprise risk management, and has delegated cybersecurity risk management oversight to the Audit Committee of our Board of Directors. The Audit Committee of our Board of Directors is responsible for reviewing internal risk assessments with respect to cybersecurity, including assessments of the overall threat landscape and related strategies and investments.
Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Cybersecurity Leader . Our Cybersecurity Leader reports regularly to the cybersecurity council, management and the Audit Committee concerning our significant cybersecurity threats and risks, the processes we have implemented to address them, and various reports, summaries, or presentations on cybersecurity threats, risks, and mitigation. The Audit Committee also reports to our Board of Directors on cybersecurity matters as needed.
Fiscal 2024 Form 10-K, filed May 28, 2024 sec.gov ↗
Top security role, as the filing names it
Security Leader
Reports to, as the filing names it
the cybersecurity council, management and the Audit Committee
“Our Security Leader reports regularly to the cybersecurity council, management and the Audit Committee concerning our significant cybersecurity threats and risks, the processes we have implemented to address them, and various reports, summaries, or presentations on cybersecurity threats, risks, and mitigation.”
Board oversight
Audit Committee of our Board of Directors
“Our Board of Directors has oversight responsibility for our overall enterprise risk management, and has delegated cybersecurity risk management oversight to the Audit Committee of our Board of Directors.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our cybersecurity program includes some key aspects such as (i) a Cybersecurity Leader who oversees our day-to-day program and who is a long-term member of both ISC2 and ISACA organizations, which specialize in cybersecurity and governance, (ii) a cybersecurity council comprised of a cross-section of management with oversight over our program, (iii) incident response, and (iv) ongoing security awareness training.”
Material incident
The filing states none
“As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably expected to materially affect our business.”
Read by claude-sonnet-5-5 on October 21, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
Risk management and strategy
Nextracker places emphasis on addressing cybersecurity threats and effectively managing associated risks. Our cybersecurity program is designed to identify, assess, and proactively manage material risks.
Our approach to cybersecurity is not a one-time effort but an ongoing process. We engage in monitoring, risk assessments, and robust security measures designed to ensure the confidentiality, integrity, and availability of our information systems, including critical computer networks, hosted services, communication systems, hardware, and software and to protect critical data, including our employees' and customers' data, intellectual property, confidential and proprietary data, and strategic competitive information. We address cybersecurity challenges and enhance our overall risk management efforts by adopting and working to integrate recognized best practices, standards, and controls such as the CIS 18 Critical Security Controls and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).
Our cybersecurity program includes some key aspects such as (i) a Cybersecurity Leader who oversees our day-to-day program and who is a long-term member of both ISC2 and ISACA organizations, which specialize in cybersecurity and governance, (ii) a cybersecurity council comprised of a cross-section of management with oversight over our program, (iii) incident response, and (iv) ongoing security awareness training.
At Nextracker, we maintain a practical approach to cybersecurity. Our cybersecurity risk management program (an integral part of our overall Enterprise Risk Management Program) is designed to incorporate established best practices and industry standards, drawing guidance from both CIS 18 and NIST CSF. Within our program, we conduct internal and external security-based activities, including reviews and assessments of our third-party service providers and vendors.
Some of our activities include:
1. Information Security Assessments : We collaborate with internal and external partners to evaluate our security.
2. Vulnerability Scanning and Penetration Testing : Engaging third-party service providers to assess external and internal vulnerabilities and potential threats.
3. Cyber Risk Register Reviews : Regularly review our internal risk register to stay vigilant against potential and identified risks.
4. Risk Prioritization : We prioritize and address risks through our dedicated cybersecurity risk management program and the cybersecurity council.
We monitor the threat environment for potential risks, employing various methods, including automated detection tools, environment scans, and investigations of potential threats and reports. We also use threat intelligence feeds and vulnerability databases to monitor our systems, and have incident response processes designed to ensure swift action.
As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably expected to materially affect our business. However, we acknowledge the evolving nature of cybersecurity threats and remain committed to enhancing our protective measures as needed.
For more detailed information about our company's specific cybersecurity risks, please refer to the risk factor titled "Cybersecurity or other data security incidents could harm our business, expose us to liability and cause reputational damage" in Item IA. Risk Factors of this Form 10-K.
Governance
Our Board of Directors has oversight responsibility for our overall enterprise risk management, and has delegated cybersecurity risk management oversight to the Audit Committee of our Board of Directors. The Audit Committee of our Board of Directors is responsible for reviewing internal risk assessments with respect to cybersecurity, including assessments of the overall threat landscape and related strategies and investments.
Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Security Leader. Our Security Leader reports regularly to the cybersecurity council, management and the Audit Committee concerning our significant cybersecurity threats and risks, the processes we have implemented to address them, and various reports, summaries, or presentations on cybersecurity threats, risks, and mitigation. The Audit Committee also reports to our Board of Directors on cybersecurity matters as needed.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.