Disclosure · Form 10-K · fiscal 2025
Birchtech Corp. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 31, 2026· period ended December 31, 2025· BCHT· CIK 728385· Updated · filing on sec.gov ↗
Birchtech Corp.'s Form 10-K for fiscal 2025, filed March 31, 2026, names the Vice President of Operations as its top security role, reporting to the Board of Directors, with oversight by the full board.
What Birchtech's Item 1C says
Birchtech's Form 10-K for fiscal 2025 states that the Board of Directors has oversight of management to eliminate cybersecurity risks. The Vice President of Operations oversees risks of cybersecurity threats at the company.
Board and management oversight
The Vice President of Operations reports to the Board of Directors as necessary, including promptly reporting any cybersecurity incidents that may pose a significant risk. The Vice President of Operations has not had to report any cybersecurity incidents to the Board.
Who leads security
The Vice President of Operations has over 25 years of experience in the industry and has overseen the day-to-day operations of the company for over 10 years.
How the company manages cyber risk
Employees and consultants use end point security tools, such as firewalls and anti-virus protection, to protect data. The company's tactics include deploying updates and patches as they are available and maintaining the current versions of major software to reduce the exposure to vulnerabilities.
Third parties and incidents
The company has not engaged any assessors, consultants, auditors or other third parties in connection with its risk management system or processes. The company has certain processes in place to oversee and identify cybersecurity risks from threats and incidents in connection with its use of third-party services providers. The company is not aware of having experienced any material cybersecurity incidents.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a board committee as responsible for cybersecurity oversight. The section does not name a specific security framework or standard. The section does not say how often the board or its committee is briefed on cybersecurity.
Read from the Form 10-K filed March 31, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Vice President of Operations
Reports to
Board of Directors
“Our Vice President of Operations oversees risks of cybersecurity threats and will report, as necessary, to the Board of Directors, including promptly reporting any cybersecurity incidents that may pose a significant risk to us.”
Board oversight
Full board
“Our Board of Directors has oversight of management to eliminate cybersecurity risks.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
Described
“To date, we have not engaged any assessors, consultants, auditors or other third parties in connection with our risk management system or processes, and believe that, given our size, our current approach to manage cybersecurity risks is adequate.”
Experience of the security leadership, as stated
Stated
“Our Vice President of Operations has over 25 years of experience in the industry and has overseen the day-to-day operations of the Company for over 10 years.”
Material incident
The filing states none
“We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.”
The section
441 words, Form 10-K filed March 31, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 9, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Birchtech Corp. standard industrial classification 3829, Measuring & controlling devices, nec (SEC SIC list). 3 other filers in our library have the same code. Also shown: filers whose codes the SEC assigns to the same review office (Industrial Applications and Services).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| 908 Devices Inc.FY 2025, filed March 9, 2026 | Senior Director of Information Technology | not identified | audit committee |
| Owlet, Inc.FY 2025, filed March 9, 2026 | Chief Technology Officer | not identified | Audit Committee |
| Rockwell AutomationFY 2025, filed November 12, 2025 | Chief Information Security Officer | Chief Information Officer (CIO) | Audit Committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Advanced Biomed Inc.FY 2026, filed October 13, 2026 | Chief Executive Officer | not identified | not identified |
| Bion Environmental Technologies IncFY 2026, filed September 29, 2026 | not identified | not identified | full board |
| Bloomia Holdings, Inc.FY 2026, filed September 21, 2026 | not identified | not identified | Audit Committee |
| Karbon-X Corp.FY 2026, filed September 15, 2026 | Chief Executive Officer | not identified | full board |
| Aehr Test SystemsFY 2026, filed July 27, 2026 | Chief Operating Officer | not identified | Audit Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Birchtech Corp.'s Form 10-K as filed with the SEC on March 31, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity.
Cybersecurity Risk Management and Strategy
We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. Based on our small size and limited number of employees and consultants, we rely extensively on information technology systems managed by third party major service providers to securely process, store and transmit our data to conduct business. Our employees and consultants utilize end point security tools, such as firewalls and anti-virus protection, to protect our data. To date, we have not engaged any assessors, consultants, auditors or other third parties in connection with our risk management system or processes, and believe that, given our size, our current approach to manage cybersecurity risks is adequate.
In connection with our use of third-party services providers, we have certain processes in place to oversee and identify cybersecurity risks from threats and incidents. We are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, there could be cybersecurity threats or incidents in the future that may adversely affect our business. For more information, please refer to Part I, Item 1A. "Risk Factors" in this Annual Report on Form 10-K.
Our overall strategy in combatting known cybersecurity risks includes a variety of individual tactics, including:
·
the use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data intrusions.
·
the deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure to vulnerabilities.
·
the review of the security procedures used by third parties that may host or otherwise have access to the Company's data.
·
if necessary, the use of third-party security experts if and when an incident is detected.
Governance
Our Vice President of Operations oversees risks of cybersecurity threats and will report, as necessary, to the Board of Directors, including promptly reporting any cybersecurity incidents that may pose a significant risk to us. To date, our Vice President of Operations has not had to report any cybersecurity incidents to the Board. Our Vice President of Operations has over 25 years of experience in the industry and has overseen the day-to-day operations of the Company for over 10 years. Among other things, he has been responsible for day-to-day access management, network security and data protection solutions. Our Board of Directors has oversight of management to eliminate cybersecurity risks.
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 31, 2025 sec.gov ↗
Top security role, as the filing names it
Executive Vice President of Operations
Reports to, as the filing names it
Board of Directors
“Our Executive Vice President of Operations oversees risks of cybersecurity threats and will report, as necessary, to the Board of Directors, including promptly reporting any cybersecurity incidents that may pose a significant risk to us.”
Board oversight
Full board
“Our Board of Directors has oversight of management to eliminate cybersecurity risks.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our Executive Vice President of Operations has over 25 years of experience in the industry and has overseen the day-to-day operations of the Company for over 10 years.”
Material incident
The filing states none
“We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.”
Read by claude-sonnet-5-5 on November 9, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
Cybersecurity Risk Management and Strategy
We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. Based on our small size and limited number of employees and consultants, we rely extensively on information technology systems managed by third party major service providers to securely process, store and transmit our data to conduct business. Our employees and consultants utilize end point security tools, such as firewalls and anti-virus protection, to protect our data. To date, we have not engaged any assessors, consultants, auditors or other third parties in connection with our risk management system or processes, and believe that, given our size, our current approach to manage cybersecurity risks is adequate.
In connection with our use of third-party services providers , we have certain processes in place to oversee and identify cybersecurity risks from threats and incidents. We are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, there could be cybersecurity threats or incidents in the future that may adversely affect our business. For more information, please refer to Part I, Item 1A. "Risk Factors" in this Annual Report on Form 10-K.
Our overall strategy in combatting known cybersecurity risks includes a variety of individual tactics, including:
·
the use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data intrusions.
·
the deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure to vulnerabilities.
·
the review of the security procedures used by third parties that may host or otherwise have access to the Company's data.
·
if necessary, the use of third-party security experts if and when an incident is detected.
Governance
Our Executive Vice President of Operations oversees risks of cybersecurity threats and will report, as necessary, to the Board of Directors, including promptly reporting any cybersecurity incidents that may pose a significant risk to us. To date, our Executive Vice President of Operations has not had to report any cybersecurity incidents to the Board. Our Executive Vice President of Operations has over 25 years of experience in the industry and has overseen the day-to-day operations of the Company for over 10 years. Among other things, he has been responsible for day-to-day access management, network security and data protection solutions. Our Board of Directors has oversight of management to eliminate cybersecurity risks.
Fiscal 2023 Form 10-K, filed April 16, 2024 sec.gov ↗
Top security role, as the filing names it
Vice President of Operations
Reports to, as the filing names it
Board of Directors
“Our Vice President of Operations oversees risks of cybersecurity threats and will report, as necessary, to the Board of Directors, including promptly reporting any cybersecurity incidents that may pose a significant risk to us.”
Board oversight
Full board
“Our Board of Directors has oversight of management to eliminate cybersecurity risks.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our Vice President of Operations has over 25 years of experience in the industry and has overseen the day-to-day operations of the Company for over 10 years.”
Material incident
The filing states none
“We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.”
Read by claude-sonnet-5-5 on November 9, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
Cybersecurity Risk Management and Strategy
We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. Based on our small size and limited number of employees and consultants, we rely extensively on information technology systems managed by third party major service providers to securely process, store and transmit our data to conduct business. Our employees and consultants utilize end point security tools, such as firewalls and anti-virus protection, to protect our data. To date, we have not engaged any assessors, consultants, auditors or other third parties in connection with our risk management system or processes.
In connection with our use of third-party services providers, we have certain processes in place to oversee and identify cybersecurity risks from threats and incidents. We are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, there could be cybersecurity threats or incidents in the future that may adversely affect our business. For more information, please refer to Part I, Item 1A. "Risk Factors" in this Annual Report on Form 10-K.
Our overall strategy in combatting known cybersecurity risks includes a variety of individual tactics, including:
·
the use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data intrusions.
·
the deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure to vulnerabilities.
·
the review of the security procedures used by third parties that may host or otherwise have access to the Company's data.
·
if necessary, the use of third-party security experts if and when an incident is detected.
Governance
Our Vice President of Operations oversees risks of cybersecurity threats and will report, as necessary, to the Board of Directors, including promptly reporting any cybersecurity incidents that may pose a significant risk to us. To date, our Vice President of Operations has not had to report any cybersecurity incidents to the Board. Our Vice President of Operations has over 25 years of experience in the industry and has overseen the day-to-day operations of the Company for over 10 years. Among other things, he has been responsible for day-to-day access management, network security and data protection solutions. Our Board of Directors has oversight of management to eliminate cybersecurity risks.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.