Disclosure · Form 10-K · fiscal 2025
Universal Token 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 31, 2026· period ended December 31, 2025· UTKN· CIK 1919182· Updated · filing on sec.gov ↗
Universal Token's Form 10-K for fiscal 2025, filed March 31, 2026, carries an Item 1C cybersecurity section; a top security role title is not identified.
What Universal Token's Item 1C says
Universal Token's Form 10-K for fiscal 2025 refers to the board of directors as involved in cybersecurity governance.
Board and management oversight
The company states that all employees of the company have a duty to manage cybersecurity.
How the company manages cyber risk
The company identifies security threats through internal audits of its systems. The company conducts regular searches for threats and suspicious activities, and it monitors passwords and changes passwords within industry expectations.
Third parties and incidents
The company requires any service providers to provide System and Organizational Control type reports to ensure that data is secure. As of the date of the report, the company has not experienced or become aware of any cybersecurity incidents resulting in a material impact to it.
What the section does not state
The section does not name the person who holds the top security role. The section does not say who the top security role reports to. The section does not name a board committee as responsible for cybersecurity oversight. The section does not say how often the board or its committee is briefed on cybersecurity.
Read from the Form 10-K filed March 31, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
not identified
Reports to
not identified
Board oversight
not identified
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
not identified
Material incident
The filing states none
“As of the date of this report we have not experienced or aware of any cybersecurity incidents resulting, or reasonably likely to result in, a material impact to us, including to our business, financial condition, and results of operations.”
The section
473 words, Form 10-K filed March 31, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 5, 2026; every quote verified in the stored text by code; 1 proposed field not found in the text and left empty.
How peers in the same industry describe the seat
The SEC assigns Universal Token standard industrial classification 6199, Finance services (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| IREN LimitedFY 2026, filed August 27, 2026 | Chief Information Security Officer | not identified | Audit and Risk Committee |
| BeneficientFY 2026, filed June 30, 2026 | Chief Technology Officer | our Board | full board |
| HIVE Digital Technologies Ltd.FY 2026, filed June 2, 2026 | Chief Information Officer | not identified | audit committee of the Board |
| FORUM MARKETS IncFY 2025, filed April 1, 2026 | Chief Financial Officer | not identified | Audit Committee |
| Bitfarms LtdFY 2025, filed March 31, 2026 | Vice President, Global Corporate IT | executive management | audit committee of the Board |
| Greenidge Generation Holdings Inc.FY 2025, filed March 31, 2026 | not identified | not identified | Audit Committee |
| Mawson Infrastructure Group Inc.FY 2025, filed March 31, 2026 | not identified | not identified | Audit Committee |
| Bit Digital, IncFY 2025, filed March 27, 2026 | Head of IT | not identified | full board |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Universal Token's Form 10-K as filed with the SEC on March 31, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity
Risks
Material Effects from
Cybersecurity Incidents
Our business is subject
to risk from cybersecurity threats and incidents, including attempts to gain unauthorized access to our systems or networks, or those
of our managers, employees, and third-party vendors and service providers, to disrupt operations, corrupt data or steal confidential
or personal information and other cybersecurity breaches. We consider cybersecurity risk a serious threat to our assets and our people
and have put processes in place designed to mitigate the risk and impact of any such cybersecurity threat or incident.
Our operations rely on
the secure, accurate and timely receipt, storage, transmission, use, disclosure, and other processing of confidential and other information
(including personal information) in our systems and networks. We also rely on the secure, accurate and timely receipt, storage, transmission,
use, disclosure, and other processing of confidential and other information in the systems and networks of our customers and third parties,
including suppliers, sellers and servicers, financial market utilities, and other third parties. Cybersecurity risks for companies like
ours continue to increase. Like many companies and government entities, from time to time we have been, and expect to continue to be,
the target of attempted cybersecurity incidents and other information security threats, including those from nation-state and nation-state
supported actors.
As of the date of this
report we have not experienced or aware of any cybersecurity incidents resulting, or reasonably likely to result in, a material impact
to us, including to our business, financial condition, and results of operations. There is no assurance that our cybersecurity risk management
program will prevent cybersecurity incidents from having such impacts in the future.
Additionally, insider
threats also remain a risk given our workforce diversification to include contractors, remote workers, part-time employees, and full-time
employees. As referenced above, our third-party vendors and service providers and their supply chain connections remain a potential source
of risk.
Cybersecurity Risk
Management and Strategy
Our cybersecurity program
is built upon industry standards and we have deployed sophisticated software both from internal and external sources to mitigate cybersecurity
threats. We identify security threats through internal audits of our systems. We also require any service providers to provide System
and Organizational Control ("SOC") type reports to ensure that data is secure and our duty to protect information is fulfilled.
Cybersecurity Governance
We believe that all employees
of the company have a duty to manage cybersecurity. We have implemented industry standard guidelines that help ensure that cybersecurity
governance is a priority. Our BOD is also very involved in the cybersecurity governance. We conduct regular searches for threats and
suspicious activities, and we monitor passwords and change passwords within industry expectations. Due to the technical aspects, we have
a lot of individuals that are very capable and are able to quickly act if we are to find any issues with our cybersecurity.
Earlier filings on record
Fiscal 2024 Form 10-K, filed April 9, 2025 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
not identified
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“As of the date of this report we have not experienced or aware of any cybersecurity incidents resulting, or reasonably likely to result in, a material impact to us, including to our business, financial condition, and results of operations.”
Read by claude-sonnet-5-5 on November 5, 2026; every quote verified in the stored text by code; 1 proposed field not found in the text and left empty.
Item 1C. Cybersecurity Risks
Material Effects from Cybersecurity Incidents
Our business is subject to risk from cybersecurity threats
and incidents, including attempts to gain unauthorized access to our systems or networks, or those of our managers, employees, and third-party
vendors and service providers, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity
breaches. We consider cybersecurity risk a serious threat to our assets and our people and have put processes in place designed to mitigate
the risk and impact of any such cybersecurity threat or incident.
Our operations rely on the secure, accurate and timely receipt,
storage, transmission, use, disclosure, and other processing of confidential and other information (including personal information) in
our systems and networks. We also rely on the secure, accurate and timely receipt, storage, transmission, use, disclosure, and other processing
of confidential and other information in the systems and networks of our customers and third parties, including suppliers, sellers and
servicers, financial market utilities, and other third parties. Cybersecurity risks for companies like ours continue to increase. Like
many companies and government entities, from time to time we have been, and expect to continue to be, the target of attempted cybersecurity
incidents and other information security threats, including those from nation-state and nation-state supported actors.
As of the date of this report we have not experienced or aware
of any cybersecurity incidents resulting, or reasonably likely to result in, a material impact to us, including to our business, financial
condition, and results of operations. There is no assurance that our cybersecurity risk management program will prevent cybersecurity
incidents from having such impacts in the future.
Additionally, insider threats also remain a risk given our
workforce diversification to include contractors, remote workers, part-time employees, and full-time employees. As referenced above, our
third-party vendors and service providers and their supply chain connections remain a potential source of risk.
Cybersecurity Risk Management and Strategy
Our cybersecurity program is built upon industry standards
and we have deployed sophisticated software both from internal and external sources to mitigate cybersecurity threats. We identify security
threats through internal audits of our systems. We also require any service providers to provide System and Organizational Control ("SOC")
type reports to ensure that data is secure and our duty to protect information is fulfilled.
Cybersecurity Governance
We believe that all employees of the company have a duty to
manage cybersecurity. We have implemented industry standard guidelines that help ensure that cybersecurity governance is a priority. Our
BOD is also very involved in the cybersecurity governance. We conduct regular searches for threats and suspicious activities, and we monitor
passwords and change passwords within industry expectations. Due to the technical aspects, we have a lot of individuals that are very
capable and are able to quickly act if we are to find any issues with our cybersecurity.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.