Disclosure · Form 10-K · fiscal 2025
Merck 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 24, 2026· period ended December 31, 2025· MRK· CIK 310158· Updated · filing on sec.gov ↗· company page
Merck's Form 10-K for fiscal 2025, filed February 24, 2026, names the Chief Information Security Officer as its top security role, with oversight by the Audit Committee. On CISO Tribune's record, the Senior Vice President, IT Risk Management & Security and Chief Information Security Officer of Merck is Tim McKnight (appointment announced in May 2026; record).
- Merck: who leads security, and the seat's history
- Tim McKnight, Senior Vice President, IT Risk Management & Security and Chief Information Security Officer of Merck on our record
- How other pharmaceutical preparations filers describe the seat
What Merck's Item 1C says
Merck's Form 10-K for fiscal 2025 places oversight responsibility for cybersecurity risks with the Audit Committee, which is comprised entirely of independent directors. The company's information security program is managed by a Chief Information Security Officer.
Board and management oversight
The CISO provides periodic reports to the Audit Committee of the Board of Directors, the full Board, and the Chief Executive Officer and other senior management, as appropriate. If warranted, senior management notifies the Audit Committee or the full Board, as appropriate.
Who leads security
The company's interim CISO has over 22 years of experience in cybersecurity and national security, including service in the U.S. Army and the National Security Agency.
How the company manages cyber risk
Oversight of the information security program is integrated into the company's overall enterprise risk management framework. The company conducts periodic tabletop and red-teaming exercises to assess its cybersecurity incident response processes and defenses. The company's information security group monitors the company's information systems to prevent, detect, mitigate, and remediate cybersecurity incidents. In the event of a cybersecurity incident, members of the information security group alert the CISO, and the CISO alerts appropriate levels of management, including an incident assessment team and the legal and finance departments.
Third parties and incidents
The company maintains vendor management diligence and oversight processes to identify and monitor potential risks from cybersecurity threats tied to its use of third-party service providers. The information security program is regularly evaluated by internal and external consultants and auditors. To date, the risks posed by cybersecurity threats have not materially affected the company and its business strategy, results of operations and financial condition.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a specific security framework or standard.
Read from the Form 10-K filed February 24, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Information Security Officer
Reports to
not identified
Board oversight
Audit Committee
“The information security program is regularly evaluated by internal and external consultants and auditors with the results of those reviews reported to senior management and the Audit Committee, which is comprised entirely of independent directors and has oversight responsibility for these risks.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“The Company's interim CISO has over 22 years of experience in cybersecurity and national security, including distinguished service in the U.S. Army and the National Security Agency.”
Material incident
The filing states none
“To date, the risks posed by such cybersecurity threats have not materially affected the Company and its business strategy, results of operations and financial condition, and as of the date of this report, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so, but there can be no assurance that the Company will not be materially affected by such risks in the future.”
The section
610 words, Form 10-K filed February 24, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 15, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Merck standard industrial classification 2834, Pharmaceutical preparations (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Nanoviricides, Inc.FY 2026, filed September 28, 2026 | not identified | not identified | audit committee |
| Phibro Animal Health CorpFY 2026, filed August 26, 2026 | Chief Technology and Digital Innovation Officer | not identified | full board |
| Protagenic Therapeutics, Inc.\newFY 2026, filed August 14, 2026 | not identified | not identified | audit committee |
| Earth Science Tech, Inc.FY 2026, filed June 18, 2026 | not identified | not identified | not identified |
| GeoVax Labs, Inc.FY 2025, filed April 15, 2026 | Chief Financial Officer | not identified | Nominating and Governance Committee |
| KALA BIO, Inc.FY 2025, filed April 15, 2026 | Chief Business Officer | not identified | Audit Committee |
| Oncotelic Therapeutics, Inc.FY 2025, filed April 15, 2026 | not identified | not identified | full board |
| Sunshine Biopharma Inc.FY 2025, filed April 3, 2026 | not identified | not identified | not identified |
More disclosures from filers CISO Tribune files under Healthcare: Omnicell, UnitedHealth Group, Boston Scientific, CVS Health.
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Merck's Form 10-K as filed with the SEC on February 24, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity.
The Company's cybersecurity measures are primarily focused on ensuring the security and protection of its IT systems and data. The Company's information security program is managed by a dedicated Chief Information Security Officer (CISO) , whose group is responsible for leading enterprise-wide cybersecurity risk management, strategy, policy, standards, architecture, and processes. The Company's interim CISO has over 22 years of experience in cybersecurity and national security, including distinguished service in the U.S. Army and the National Security Agency. He holds a Master's degree in Cyber Intelligence Studies and a Bachelor's degree in Mathematical Physics, and maintains the Certified Information Systems Security Professional (CISSP) credential. Oversight of the information security program remains fully integrated into the Company's overall enterprise risk management framework .
The CISO provides periodic reports to the Audit Committee (Audit Committee) of the Board of Directors (Board), the full Board, as well as to the Company's Chief Executive Officer and other members of senior management, as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of projects intended to strengthen its information security systems, assessments of the information security program (including remediation, mitigation, and management of identified vulnerabilities), and the emerging threat landscape. The information security program is regularly evaluated by internal and external consultants and auditors with the results of those reviews reported to senior management and the Audit Committee, which is comprised entirely of independent directors and has oversight responsibility for these risks.
The Company's information security group monitors the Company's information systems to prevent, detect, mitigate, and remediate cybersecurity incidents. The Company uses tools and techniques to continually assess and monitor, manage and mitigate cybersecurity threats to its IT systems in a manner consistent with industry practice. The Company engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to obtain current threat intelligence, collaborate on security enhancements, and evaluate and improve the effectiveness of its information security program. As part of this program, the Company conducts periodic tabletop and red-teaming exercises to assess its cybersecurity incident response processes and defenses. The Company also maintains vendor management diligence and oversight processes to identify and monitor potential risks from cybersecurity threats attendant to its use of third-party service providers. Additionally, the Company monitors cybersecurity threat intelligence received from key third-party service providers associated with the Company.
In the event of a cybersecurity incident, the Company has a process in place whereby members of the information security group will alert the CISO and the CISO will alert the appropriate levels of management, including an incident assessment team, as well as the legal and finance departments so that the materiality of any such event can be assessed in furtherance of fulfilling any reporting requirements. If warranted, senior management will notify the Audit Committee or the full Board, as appropriate.
The Company has been and continues to be the target of cyber-attacks and network disruptions. To date, the risks posed by such cybersecurity threats have not materially affected the Company and its business strategy, results of operations and financial condition, and as of the date of this report, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so, but there can be no assurance that the Company will not be materially affected by such risks in the future. For further information, see Item 1A. "Risk Factors — The Company is increasingly dependent on sophisticated software applications and computing infrastructure. The Company continues to be a target of cyber-attacks that could lead to a disruption of its worldwide operations, including manufacturing, research and sales operations."
Earlier filings on record
Fiscal 2024 Form 10-K, filed February 25, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“The information security program is regularly evaluated by internal and external consultants and auditors with the results of those reviews reported to senior management and the Audit Committee, which is comprised entirely of independent directors and has oversight responsibility for these risks.”
Person named in the filing
not identified
Experience, as stated
Stated
“The CISO has worked in the cybersecurity and national security fields for more than 30 years.”
Material incident
The filing states none
“To date, the risks posed by such cybersecurity threats have not materially affected the Company and its business strategy, results of operations and financial condition, and as of the date of this report, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so, but there can be no assurance that the Company will not be materially affected by such risks in the future.”
Read by claude-sonnet-5-5 on October 15, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
The Company's cybersecurity measures are primarily focused on ensuring the security and protection of its IT systems and data. The Company's information security program is managed by a dedicated Chief Information Security Officer (CISO) , whose group is responsible for leading enterprise-wide cybersecurity risk management, strategy, policy, standards, architecture, and processes. The CISO has worked in the cybersecurity and national security fields for more than 30 years. He has a Master of Science in Telecommunications and Computers. He has served as a board member of the Health Information Sharing and Analysis Center for 10 years. Oversight of the information security program has been integrated into the Company's overall enterprise risk management program.
The CISO provides periodic reports to the Audit Committee (Audit Committee) of the Board of Directors (Board), the full Board, as well as to the Company's Chief Executive Officer and other members of senior management, as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of projects intended to strengthen its information security systems, assessments of the information security program (including remediation, mitigation, and management of identified vulnerabilities), and the emerging threat landscape. The information security program is regularly evaluated by internal and external consultants and auditors with the results of those reviews reported to senior management and the Audit Committee, which is comprised entirely of independent directors and has oversight responsibility for these risks.
The Company's information security group monitors the Company's information systems to prevent, detect, mitigate, and remediate cybersecurity incidents. The Company uses tools and techniques to continually assess and monitor, manage and mitigate cybersecurity threats to its IT systems in a manner consistent with industry practice. The Company engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to obtain current threat intelligence, collaborate on security enhancements, and evaluate and improve the effectiveness of its information security program. As part of this program, the Company conducts periodic tabletop and red-teaming exercises to assess its cybersecurity incident response processes and defenses. The Company also maintains vendor management diligence and oversight processes to identify and monitor potential risks from cybersecurity threats attendant to its use of third-party service providers. Additionally, the Company monitors cybersecurity threat intelligence received from key third-party service providers associated with the Company.
In the event of a cybersecurity incident, the Company has a process in place whereby members of the information security group will alert the CISO and the CISO will alert the appropriate levels of management, including an incident assessment team, as well as the legal and finance departments so that the materiality of any such event can be assessed in furtherance of fulfilling any reporting requirements. If warranted, senior management will notify the Audit Committee or the full Board, as appropriate.
The Company has been and continues to be the target of cyber-attacks and network disruptions. To date, the risks posed by such cybersecurity threats have not materially affected the Company and its business strategy, results of operations and financial condition, and as of the date of this report, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so, but there can be no assurance that the Company will not be materially affected by such risks in the future. For further information, see Item 1A. "Risk Factors — The Company is increasingly dependent on sophisticated software applications and computing infrastructure. The Company continues to be a target of cyber-attacks that could lead to a disruption of its worldwide operations, including manufacturing, research and sales operations."
Fiscal 2023 Form 10-K, filed February 26, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“The CISO provides periodic reports to the Audit Committee (Audit Committee) of the Board of Directors (Board), the full Board, as well as to the Company's Chief Executive Officer and other members of senior management, as appropriate.”
Person named in the filing
not identified
Experience, as stated
Stated
“The CISO has worked in the cybersecurity and national security fields for more than 30 years.”
Material incident
The filing states none
“To date, the risks posed by such cybersecurity threats have not materially affected the Company and its business strategy, results of operations and financial condition, and as of the date of this report, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so, but there can be no assurance that the Company will not be materially affected by such risks in the future.”
Read by claude-sonnet-5-5 on October 15, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
The Company's cybersecurity measures are primarily focused on ensuring the security and protection of its information technology systems and data. The Company's information security program is managed by a dedicated Chief Information Security Officer (CISO), whose group is responsible for leading enterprise-wide cybersecurity risk management, strategy, policy, standards, architecture, and processes. The CISO has worked in the cybersecurity and national security fields for more than 30 years. He has a Master of Science in Telecommunications and Computers. He has served as a board member of the Health Information Sharing and Analysis Center for 10 years. Oversight of the information security program has been integrated into the Company's overall enterprise risk management program.
The CISO provides periodic reports to the Audit Committee (Audit Committee) of the Board of Directors (Board), the full Board, as well as to the Company's Chief Executive Officer and other members of senior management, as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of projects intended to strengthen its information security systems, assessments of the information security program (including remediation, mitigation, and management of identified vulnerabilities), and the emerging threat landscape. The information security program is regularly evaluated by internal and external consultants and auditors
Table of C o ntent s
with the results of those reviews reported to senior management and the Audit Committee, which is comprised entirely of independent directors and has oversight responsibility for these risks.
The Company's information security group monitors the Company's information systems to prevent, detect, mitigate, and remediate cybersecurity incidents. The Company uses tools and techniques to continually assess and monitor, manage and mitigate cybersecurity threats to its IT systems in a manner consistent with industry practice. The Company engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to obtain current threat intelligence, collaborate on security enhancements, and evaluate and improve the effectiveness of its information security program. As part of this program, the Company conducts periodic tabletop exercises to assess its cybersecurity incident response processes. The Company also maintains vendor management diligence and oversight processes to identify and monitor potential risks from cybersecurity threats attendant to its use of third-party service providers. Additionally, the Company monitors cybersecurity threat intelligence received from key third-party service providers associated with the Company.
In the event of a cybersecurity incident, the Company has a process in place whereby members of the security group will alert the CISO and the CISO will alert the appropriate levels of management, including an incident assessment team, as well as the legal and finance departments so that the materiality of any such event can be assessed in furtherance of fulfilling any reporting requirements. If warranted, senior management will notify the Audit Committee or the full Board, as appropriate.
The Company has been and continues to be the target of cyber-attacks and network disruptions. To date, the risks posed by such cybersecurity threats have not materially affected the Company and its business strategy, results of operations and financial condition, and as of the date of this report, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so, but there can be no assurance that the Company will not be materially affected by such risks in the future. For further information, see Item 1A. "Risk Factors — The Company is increasingly dependent on sophisticated software applications and computing infrastructure. The Company continues to be a target of cyber-attacks that could lead to a disruption of its worldwide operations, including manufacturing, research and sales operations."
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.