Disclosure · Form 10-K/A · fiscal 2025
CreditRiskMonitor Com Inc 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed August 19, 2026· period ended December 31, 2025· CRMZ· CIK 315958· Updated · filing on sec.gov ↗
CreditRiskMonitor Com Inc's Form 10-K/A for fiscal 2025, filed August 19, 2026, names the Chief Technology Officer as its top security role, with oversight by the Audit Committee.
What CreditRiskMonitor Com's Item 1C says
CreditRiskMonitor's Form 10-K/A for fiscal 2025 places oversight of cybersecurity risk with the Audit Committee of the Board of Directors. The Chief Technology Officer is primarily responsible for assessing and managing material cybersecurity risks in management.
Board and management oversight
The Audit Committee and the full Board of Directors are informed of material cybersecurity risks by the Chief Executive Officer, Chief Financial Officer, or Chief Technology Officer. The Chief Financial Officer and Chief Technology Officer are responsible for overseeing the establishment and effectiveness of controls and other procedures, including those for public disclosure of material cybersecurity matters.
How the company manages cyber risk
The company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the company's overall compliance, risk management, and oversight procedures, overseen by the Board of Directors primarily through its Audit Committee. The company has engaged a third party to provide cybersecurity and awareness training to employees.
Third parties and incidents
The company engaged a third-party consulting firm to evaluate and test its risk management systems on an annual basis. The company may review SOC1 or SOC2 reports of certain third-party providers before engagement and has established monitoring procedures. Cybersecurity threats, including from previous cybersecurity incidents, have not materially affected the company, its business strategy, results of operations, or financial condition.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K/A filed August 19, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Technology Officer
Reports to
not identified
Board oversight
Audit Committee
“The Audit Committee of the Company's Board of Directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats.”
CISO or other person named
not identified
Frameworks and standards named
SOC 2
Where the filing names it
- SOC 2: “The Company may review System and Organization Controls 1 ("SOC1") or System and Organization Controls 2 ("SOC2") reports of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties.”
Outside assessors, consultants or testers
Described
“The Company engaged a third-party consulting firm to evaluate and test the Company's risk management systems and to assess and prevent potential cybersecurity incidents as appropriate on an annual basis.”
Experience of the security leadership, as stated
not identified
Material incident
The filing states none
“To date, cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition.”
The section
577 words, Form 10-K/A filed August 19, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 10, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns CreditRiskMonitor Com Inc standard industrial classification 7320, Services-consumer credit reporting, collection agencies (SEC SIC list). 2 other filers in our library have the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Trade & Services).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| TransUnionFY 2025, filed February 27, 2026 | Chief Information Security Officer | not identified | Risk and Compliance Committee |
| EquifaxFY 2025, filed February 19, 2026 | Chief Information Security Officer | not identified | Technology Committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| VIP Play, Inc.FY 2026, filed September 29, 2026 | Chief Technology Officer | not identified | full board |
| GenFlat Holdings, Inc.FY 2026, filed September 25, 2026 | Chief Executive Officer and Chief Financial Officer | not identified | full board |
| Stitch Fix, Inc.FY 2026, filed September 24, 2026 | Chief Information Security Officer | Chief Product and Technology Officer | Audit Committee |
| H&R BlockFY 2026, filed August 14, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Caro Holdings Inc.FY 2026, filed July 15, 2026 | not identified | not identified | not identified |
| Barnes & Noble Education, Inc.FY 2026, filed July 9, 2026 | Chief Information Security Officer | Chief Information Officer | Audit Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of CreditRiskMonitor Com Inc's Form 10-K/A as filed with the SEC on August 19, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C.
CYBERSECURITY.
Risk Management and Strategy
The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These cybersecurity processes are integrated into the Company's overall compliance, risk management, and oversight procedures as overseen by the Company's Board of Directors, primarily through its Audit Committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company's process allows us to assess, identify and manage information security and cybersecurity threats through risk assessment and prevention measures to facilitate communication, training, awareness, incident response, and disclosure procedures as required by the SEC.
The Company may review System and Organization Controls 1 ("SOC1") or System and Organization Controls 2 ("SOC2") reports of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company engaged a third-party consulting firm to evaluate and test the Company's risk management systems and to assess and prevent potential cybersecurity incidents as appropriate on an annual basis. The Company has engaged a third party to provide cybersecurity and awareness training to our employees to help mitigate the risk of threats posed by bad actors requesting information. The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality, security information event management, automated update/patch-management and access controls which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With help from third-party vendors, the Company has implemented several layers of physical security, digital security, and data backup.
The Company is committed to maintaining high standards of data security and privacy, and that data within our systems remains secure, private, and confidential through enhanced data protection and operational standards. As of January 16, 2026, CreditRiskMonitor.com successfully completed its first System and Organization Controls 2 Type I ("SOC2 Type I") report for cybersecurity. The assessment was conducted by Sensiba LLP, an independent third-party auditor engaged to evaluate the Company's internal controls relevant to security, availability, and confidentiality. The Company received an attestation report indicating that our internal controls were suitably designed as of December 5, 2025 under the American Institute of Certified Public Accountants ("AICPA") Trust Services Criteria.
To date, cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition.
Governance
Board of Directors − The Audit Committee of the Company's Board of Directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee and the full Board of Directors are informed of material risks from cybersecurity threats by the Company's Chief Executive Officer, Chief Financial Officer, or Chief Technology Officer.
Management − Under the oversight of the Audit Committee of the Company's Board of Directors, the Chief Technology Officer is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters. The Company's Chief Financial Officer and Chief Technology Officer are responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. See "Item 1. Risks Related to Information Systems Security" for reference.
Index
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 20, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Technology Officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“The Audit Committee of the Company's Board of Directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats.”
Person named in the filing
not identified
Experience, as stated
Stated
“Under the oversight of the Audit Committee of the Company's Board of Directors, the Chief Technology Officer, with over 20 years of experience in this field, is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters.”
Material incident
The filing states none
“The incident did not have a material impact on the Company, including its business strategy, results of operations, or financial condition.”
Read by claude-sonnet-5-5 on November 10, 2026; every quote verified in the stored text by code.
ITEM 1C.
CYBERSECURITY
Risk Management and Strategy
The Company has processes for assessing, identifying, and managing material risks from
cybersecurity threats. These cybersecurity processes are integrated into the Company's overall compliance, risk management, and oversight procedures as overseen by the Company's Board of Directors, primarily through its Audit Committee. These processes also include overseeing and
identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company's process allows us to assess, identify and manage information security and cybersecurity threats through risk assessment and
prevention measures to facilitate communication, training, awareness, incident response, and disclosure procedures as required by the SEC.
The Company may review System and Organization Controls 1 ("SOC1") or System and Organization Controls 2 ("SOC2") reports of certain third-party
providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company engaged a third-party consulting firm to evaluate and test the Company's risk management systems and to assess and prevent potential cybersecurity incidents as appropriate on an annual basis. The Company has engaged a third party to provide cybersecurity and awareness training to our employees to help mitigate the risk of threats posed by bad actors requesting information. The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality, security information event management, automated update/patch-management and access controls which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With the help of our third-party vendors, the Company has implemented several layers of physical security, digital security, and data backup.
On July 19, 2024, CreditRiskMonitor.com detected unauthorized occurrences within its computer network. Upon detection, the
Company immediately activated its incident response plan and took steps to contain, assess and remediate the incident. The incident did not have a material impact on the Company, including its business strategy, results of operations, or financial condition.
Governance
Board of Directors -- The Audit Committee of the Company's Board of Directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from
cybersecurity threats. The Audit Committee and the full Board of Directors are informed of material risks from cybersecurity threats by the Company's Chief Executive Officer, Chief Financial Officer, or Chief Technology Officer.
Management -- Under the oversight of the Audit Committee of the Company's Board of Directors, the Chief Technology Officer, with over 20 years of
experience in this field, is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters. The Company's Chief Financial Officer and Chief Technology Officer are responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. See "Item 1. Risks Related to Information Systems Security - As the threat landscape is everchanging, the Company must make
continuous mitigation efforts, including risk-prioritized controls to protect against known and emerging threats; tools to provide automated monitoring and alerting; frequent employee training; and backup and recovery systems to restore systems and
return to normal operations . However, there can be no assurance that the Company's ability to monitor or mitigate cybersecurity risks will
be fully effective, and the Company may fail to identify cybersecurity breaches or discover them in a timely way."
Index
Fiscal 2023 Form 10-K, filed March 21, 2024 sec.gov ↗
Top security role, as the filing names it
Senior Vice President of Information Technology
Reports to, as the filing names it
not identified
Board oversight
audit committee
“The audit committee of the Company's board of directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats.”
Person named in the filing
not identified
Experience, as stated
Stated
“Under the oversight of the audit committee of the Company's board of directors, the Senior Vice President of Information Technology, with over 20 years of experience in this field, is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters.”
Material incident
not identified
Read by claude-sonnet-5-5 on November 10, 2026; every quote verified in the stored text by code.
ITEM 1C.
CYBERSECURITY
Risk Management and Strategy
The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These cybersecurity processes are
integrated into the Company's overall compliance, risk management, and oversight procedures as overseen by the Company's board of directors, primarily through its audit committee. These processes also include overseeing and identifying risks
from cybersecurity threats associated with the use of third-party service providers. The Company's process allows us to assess, identify and manage information security and cybersecurity threats through risk assessment and prevention measures
to facilitate communication, training, awareness, incident response, and disclosure procedures as required by the SEC.
The Company may review SOC1 or SOC2 reports of certain third-party providers before engagement and has established monitoring procedures in its
effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company engaged a third-party consulting firm to evaluate and test the Company's risk management systems and to assess and prevent
potential cybersecurity incidents as appropriate on an annual basis. The Company has engaged a third party to provide cyber security and awareness training to our employees to help mitigate the risk of threats posed by bad actor requesting
information. The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods,
anti-malware functionality, security information event management, automated update/patch-management and access controls which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With
the help of our third-party vendors, the Company has implemented several layers of physical security, digital security, and data backup.
Governance
Board of Directors -- The audit committee of the
Company's board of directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee and the
board of directors are informed of material risks from cybersecurity threats by the Company's Chief Executive Officer, Chief Financial Officer, or the Senior Vice President of Information Technology.
Management -- Under the oversight of the audit
committee of the Company's board of directors, the Senior Vice President of Information Technology, with over 20 years of experience in this field, is primarily responsible for the assessment and management of material cybersecurity risks and
establishing and maintaining adequate and effective internal controls covering cybersecurity matters. The Company's Chief Financial Officer and Senior Vice President of Information Technology, are responsible for overseeing the establishment
and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. See "Item 1. Risks Related to Information Systems Security - As the threat landscape is
ever-changing, the Company must make continuous mitigation efforts, including risk-prioritized controls to protect against known and emerging threats; tools to provide automated monitoring and alerting; frequent employee training; and backup
and recovery systems to restore systems and return to normal operations. However, there can be no assurance that the Company's ability to monitor for or mitigate cybersecurity risks will be fully effective, and the Company may fail to identify
cybersecurity breaches or discover them in a timely way."
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.