Disclosure · Form 10-K · fiscal 2025
CVS Health 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 10, 2026· period ended December 31, 2025· CVS· CIK 64803· Updated · filing on sec.gov ↗· company page
CVS Health's Form 10-K for fiscal 2025, filed February 10, 2026, names the Chief Information Security Officer as its top security role, reporting to the Chief Experience and Technology Officer, with oversight by the Audit Committee. On CISO Tribune's record, the SVP and Chief Information Security Officer (CISO) of CVS Health is Alan Rosa (verified September 9, 2026; record).
- CVS Health: who leads security, and the seat's history
- Alan Rosa, SVP and Chief Information Security Officer (CISO) of CVS Health on our record
- How other retail-drug stores and proprietary stores filers describe the seat
What CVS Health's Item 1C says
CVS Health's Form 10-K for fiscal 2025 places oversight of cybersecurity risk with the Audit Committee. The company's CISO leads management's assessment and management of cybersecurity risk.
Board and management oversight
The Audit Committee conducts regular reviews of the company's cybersecurity program, including no fewer than two formal updates each year. The company's CETO and CISO provide the Audit Committee with recurring briefings, at least on a bi-quarterly basis, and update the full Board annually on the company's cybersecurity posture. These updates include assessments of emerging cyber threats, significant cybersecurity incidents and material changes in the company's risk profile. The CISO is a member of the company's Disclosure Committee, and the CPO advises the Disclosure Committee on cybersecurity matters on an as-needed basis.
Who leads security
The CISO reports to the company's Chief Experience and Technology Officer, who reports directly to the company's Chief Executive Officer. The current CETO, CISO and CPO each has more than 10 years of experience managing risks or advising on cybersecurity issues.
How the company manages cyber risk
The company treats cybersecurity as an integrated part of its enterprise risk management strategy. The company has implemented a Cybersecurity Incident Response Plan, which is integrated into its overall crisis management program. The company's information technology systems and processes are regularly assessed internally and by independent third parties for compliance with standards including HIPAA and NIST 800-53. The company annually purchases a cybersecurity risk insurance policy that is expected to help defray the costs associated with a covered cybersecurity incident if it occurred.
Third parties and incidents
The steps the company takes to reduce its vulnerability to cybersecurity incidents include assessing cybersecurity risk profiles of key third parties. The Plan provides protocols for incident evaluation, including the use of third-party service providers and partners. The company did not experience a material cybersecurity incident during the year ended December 31, 2025.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed February 10, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Information Security Officer
Reports to
Chief Experience and Technology Officer
“The CISO reports to the Company's Chief Experience and Technology Officer (the "CETO"), who reports directly to the Company's Chief Executive Officer.”
Board oversight
Audit Committee
“The Board has delegated the responsibility for the oversight of the Company's cybersecurity risks to the Audit Committee.”
How often the board or committee hears about it
Quarterly
“The Company's CETO and CISO provide the Audit Committee with recurring briefings—at least on a bi-quarterly basis—and update the full Board annually on the Company's cybersecurity posture.”
CISO or other person named
not identified
Frameworks and standards named
NIST SP 800-53, SOC 2, PCI DSS
Where the filing names them
- NIST SP 800-53: “NIST 800-53;”
- SOC 2: “SOC 2 Type 2;”
- PCI DSS: “Payment Card Industry Data Security Standards; and the National Association of Insurance Commissioners.”
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“The current CETO, CISO and CPO each has more than 10 years of experience managing risks or advising on cybersecurity issues.”
Material incident
The filing states none
“Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2025, the scope and impact of any future direct or third-party cybersecurity incident cannot be predicted.”
The section
671 words, Form 10-K filed February 10, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 17, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns CVS Health standard industrial classification 5912, Retail-drug stores and proprietary stores (SEC SIC list). One other filer in our library has the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Trade & Services).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Guardian Pharmacy Services, Inc.FY 2025, filed March 11, 2026 | SVP of Technology & Senior Security Officer | not identified | audit committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| VIP Play, Inc.FY 2026, filed September 29, 2026 | Chief Technology Officer | not identified | full board |
| GenFlat Holdings, Inc.FY 2026, filed September 25, 2026 | Chief Executive Officer and Chief Financial Officer | not identified | full board |
| Stitch Fix, Inc.FY 2026, filed September 24, 2026 | Chief Information Security Officer | Chief Product and Technology Officer | Audit Committee |
| CreditRiskMonitor Com IncFY 2025, filed August 19, 2026 | Chief Technology Officer | not identified | Audit Committee |
| H&R BlockFY 2026, filed August 14, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| Caro Holdings Inc.FY 2026, filed July 15, 2026 | not identified | not identified | not identified |
| Barnes & Noble Education, Inc.FY 2026, filed July 9, 2026 | Chief Information Security Officer | Chief Information Officer | Audit Committee |
More disclosures from filers CISO Tribune files under Healthcare: Merck, Omnicell, UnitedHealth Group, Boston Scientific.
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of CVS Health's Form 10-K as filed with the SEC on February 10, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity.
Cybersecurity Risk Management
Cybersecurity is an important and integrated part of the Company's enterprise risk management strategy. Safeguarding the Company's business information, intellectual property, customer, patient and employee data and technology systems is essential for the continuity of its businesses, meeting applicable regulatory requirements and maintaining the trust of its stakeholders.
To help protect the Company from a major cybersecurity incident that could have a material impact on operations or the Company's financial results, the Company has implemented a robust information security program and has made technology investments that focus on cybersecurity incident prevention, detection and mitigation. The steps the Company takes to reduce its vulnerability and to mitigate the impacts from cybersecurity incidents include, but are not limited to: comprehensive information security policies and standards, implementing logical and technical controls through processes and technologies, monitoring its information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third
parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices. The Company is currently in material compliance with applicable information privacy and cybersecurity standards.
The Company has implemented a Cybersecurity Incident Response Plan (the "Plan"), which is integrated into its overall crisis management program. The Plan provides a framework for responding to cybersecurity incidents. The Plan identifies applicable requirements for incident disclosure and reporting as well as provides protocols for incident evaluation, including the use of third-party service providers and partners, processes for notification and internal escalation of information to the Company's senior management, the disclosure committee, the Board and appropriate Board committees. The Plan also addresses requirements for the Company's external reporting obligations. The Plan is reviewed and updated, as necessary, under the leadership of the Company's Chief Information Security Officer ("CISO") and Chief Privacy Officer ("CPO").
The Company's information technology systems and processes are regularly assessed internally as well as by independent third parties for compliance with the following standards: HIPAA; NIST 800-53; System and Organization Controls ("SOC") 1; SOC 2 Type 2; HI-TRUST; Payment Card Industry Data Security Standards; and the National Association of Insurance Commissioners. The Company annually purchases a cybersecurity risk insurance policy that is expected to help defray the costs associated with a covered cybersecurity incident if it occurred.
Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2025, the scope and impact of any future direct or third-party cybersecurity incident cannot be predicted. See "Item 1A. Risk Factors" for more information on the Company's cybersecurity-related risks.
Governance
Management has responsibility to manage risk and bring to the Board's attention the most material near-term and long-term risks to the Company. The Company's CISO leads management's assessment and management of cybersecurity risk. The CISO reports to the Company's Chief Experience and Technology Officer (the "CETO"), who reports directly to the Company's Chief Executive Officer. The CETO, CISO and the CPO, regularly review cybersecurity matters with management. The current CETO, CISO and CPO each has more than 10 years of experience managing risks or advising on cybersecurity issues.
The Board is actively engaged in overseeing and reviewing the Company's strategic direction and objectives, taking into account, among other considerations, the Company's risk profile and related exposures. As part of this oversight, the Board has delegated certain of these responsibilities to committees of the Board. The Board has delegated the responsibility for the oversight of the Company's cybersecurity risks to the Audit Committee. As part of its risk oversight responsibilities, the Audit Committee conducts regular reviews of the Company's cybersecurity program, including no fewer than two formal updates each year. The Company's CETO and CISO provide the Audit Committee with recurring briefings—at least on a bi-quarterly basis—and update the full Board annually on the Company's cybersecurity posture. These updates include assessments of emerging cyber threats, significant cybersecurity incidents and material changes in the Company's risk profile. The CISO is a member of the Company's Disclosure Committee, and the CPO advises the Disclosure Committee on cybersecurity matters on an as-needed basis.
Earlier filings on record
Fiscal 2024 Form 10-K, filed February 12, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
Chief Digital, Data, Analytics & Technology Officer
“The CISO reports to the Company's Chief Digital, Data, Analytics & Technology Officer (the "CDDATO"), who reports directly to the Company's Chief Executive Officer.”
Board oversight
Audit Committee
“The Board has delegated the responsibility for the oversight of the Company's cybersecurity risks to the Audit Committee.”
Person named in the filing
not identified
Experience, as stated
Stated
“The current CDDATO, CISO and CPO each has more than 10 years of experience managing risks or advising on cybersecurity issues.”
Material incident
The filing states none
“Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2024, it did experience previously-disclosed impacts from the Change Healthcare cybersecurity incident in February 2024.”
Read by claude-sonnet-5-5 on October 17, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
Cybersecurity Risk Management
Cybersecurity is an important and integrated part of the Company's enterprise risk management strategy. Safeguarding the Company's business information, intellectual property, customer, patient and employee data and technology systems is essential for the continuity of its businesses, meeting applicable regulatory requirements and maintaining the trust of its stakeholders.
To help protect the Company from a major cybersecurity incident that could have a material impact on operations or the Company's financial results, the Company has implemented a robust information security program and has made technology investments that focus on cybersecurity incident prevention, detection and mitigation. The steps the Company takes to reduce its vulnerability and to mitigate the impacts from cybersecurity incidents include, but are not limited to: comprehensive information security policies and standards, implementing logical and technical controls through processes and technologies, monitoring its information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information
and best practices. The Company is currently in material compliance with applicable information privacy and cybersecurity standards.
The Company has implemented a Cybersecurity Incident Response Plan (the "Plan"), which is integrated into its overall crisis management program. The Plan provides a framework for responding to cybersecurity incidents. The Plan identifies applicable requirements for incident disclosure and reporting as well as provides protocols for incident evaluation, including the use of third-party service providers and partners, processes for notification and internal escalation of information to the Company's senior management, the disclosure committee, the Board and appropriate Board committees. The Plan also addresses requirements for the Company's external reporting obligations. The Plan is reviewed and updated, as necessary, under the leadership of the Company's Chief Information Security Officer ("CISO") and Chief Privacy Officer ("CPO").
The Company's information technology systems and processes are regularly assessed internally as well as by independent third parties for compliance with the following standards: HIPAA; NIST 800-53; System and Organization Controls ("SOC") 1; SOC 2 Type 2; HI-TRUST; Payment Card Industry Data Security Standards; and the National Association of Insurance Commissioners. The Company annually purchases a cybersecurity risk insurance policy that is expected to help defray the costs associated with a covered cybersecurity incident if it occurred.
Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2024, it did experience previously-disclosed impacts from the Change Healthcare cybersecurity incident in February 2024. See the Company's Form 10-Q for the three months ended March 31, 2024 for more information. The scope and impact of any future direct or third-party cybersecurity incident cannot be predicted. See "Item 1A. Risk Factors" for more information on the Company's cybersecurity-related risks.
Governance
Management has responsibility to manage risk and bring to the Board's attention the most material near-term and long-term risks to the Company. The Company's CISO leads management's assessment and management of cybersecurity risk. The CISO reports to the Company's Chief Digital, Data, Analytics & Technology Officer (the "CDDATO"), who reports directly to the Company's Chief Executive Officer. The CDDATO, CISO and the CPO, regularly review cybersecurity matters with management. The current CDDATO, CISO and CPO each has more than 10 years of experience managing risks or advising on cybersecurity issues.
The Board is actively engaged in overseeing and reviewing the Company's strategic direction and objectives, taking into account, among other considerations, the Company's risk profile and related exposures. As part of this oversight the Board has delegated certain of these responsibilities to committees of the Board. The Board has delegated the responsibility for the oversight of the Company's cybersecurity risks to the Audit Committee. As part of this oversight, the Audit Committee reviews the Company's cybersecurity program periodically, and at least annually. The Company's CDDATO and CISO update the Audit Committee periodically, and at least annually, and the full Board as needed, on the Company's cybersecurity program, including particular cybersecurity threats, incidents and new developments in the Company's risk profile. The CISO is a member of the Company's Disclosure Committee, and the CPO advises the Disclosure Committee on cybersecurity matters on an as-needed basis.
Fiscal 2023 Form 10-K, filed February 7, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
Chief Digital, Data, Analytics & Technology Officer
“The CISO reports to the Company's Chief Digital, Data, Analytics & Technology Officer (the "CDDATO"), who reports directly to the Company's Chief Executive Officer.”
Board oversight
Nominating and Corporate Governance Committee
“The Board has delegated the responsibility for the oversight of the Company's cybersecurity risks program to the Nominating and Corporate Governance Committee.”
Person named in the filing
not identified
Experience, as stated
Stated
“The current CDDATO, CISO and CPO each has more than 10 years of experience managing risks or advising on cybersecurity issues.”
Material incident
The filing states none
“Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted.”
Read by claude-sonnet-5-5 on October 17, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
Cybersecurity Risk Management
Securing the Company's business information, intellectual property, customer, patient and employee data and technology systems is essential for the continuity of its businesses, meeting applicable regulatory requirements and maintaining the trust of its stakeholders. Cybersecurity is an important and integrated part of the Company's enterprise risk management function that identifies, monitors and mitigates business, operational and legal risks.
To help protect the Company from a major cybersecurity incident that could have a material impact on operations or the Company's financial results, the Company has implemented policies, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps the Company takes to reduce its vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to: establishing information security policies and standards, implementing information protection processes and technologies, monitoring its information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices. The Company is currently in material compliance with applicable information privacy and cybersecurity standards.
The Company has implemented a Cybersecurity Incident Response Plan (the "Plan"), which is integrated into its overall crisis management program. The Plan provides a framework for responding to cybersecurity incidents. The Plan identifies applicable requirements for incident disclosure and reporting as well as provides protocols for incident evaluation, including the use of third-party service providers and partners, processes for notification and internal escalation of information to the Company's senior management, the disclosure committee, the Board and appropriate Board committees. The Plan also addresses requirements for the Company's external reporting obligations. The Plan is reviewed and updated, as necessary, under the leadership of the Company's Chief Information Security Officer ("CISO") and Chief Privacy Officer ("CPO").
The Company's information technology systems and processes are assessed by independent third parties, as appropriate to their business requirements, for compliance with the following standards: HIPAA; NIST 800-53; System and Organization Controls ("SOC") 1; SOC 2 Type 2; HI-TRUST; Payment Card Industry Data Security Standards; and the National Association of Insurance Commissioners. The Company annually purchases a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.
Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on the Company's cybersecurity-related risks.
Governance
Management has responsibility to manage risk and bring to the Board's attention the most material near-term and long-term risks to the Company. The Company's CISO leads management's assessment and management of cybersecurity risk. The CISO reports to the Company's Chief Digital, Data, Analytics & Technology Officer (the "CDDATO"), who reports directly to the Company's Chief Executive Officer. The CDDATO, CISO and the CPO, regularly review cybersecurity matters with management. The current CDDATO, CISO and CPO each has more than 10 years of experience managing risks or advising on cybersecurity issues.
The Board is actively engaged in overseeing and reviewing the Company's strategic direction and objectives, taking into account, among other considerations, the Company's risk profile and related exposures, as part of this oversight the Board has delegated certain of these responsibilities to committees of the Board. The Board has delegated the responsibility for the oversight of the Company's cybersecurity risks program to the Nominating and Corporate Governance Committee. As part of this oversight, the Nominating and Corporate Governance Committee reviews the Company's cybersecurity program periodically, and at least annually. The Company's CDDATO and CISO update the Nominating and Corporate Governance Committee periodically, and at least annually, and the full Board as needed, on the Company's cybersecurity program, including with respect to particular cybersecurity threats, incidents or new developments in the Company's risk profile. The CISO is a member of the Company's disclosure committee, and the CPO advises the disclosure committee on cybersecurity matters on an as-needed basis. During 2023, the Board conducted a review of its overall committee structure, membership and responsibilities in an effort to enhance its oversight. As part of this review, the Board has determined that it will shift the delegation of the oversight of the Company's cybersecurity risks program to the Audit Committee effective March 2024.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.