Disclosure · Form 10-K · fiscal 2026
Insteel Industries Inc 10-K cybersecurity disclosure (Item 1C), fiscal 2026
Filed October 29, 2026· period ended October 3, 2026· IIIN· CIK 764401· Updated · filing on sec.gov ↗
Insteel Industries Inc's Form 10-K for fiscal 2026, filed October 29, 2026, names the Chief Information Officer as its top security role, with oversight by the full board.
What the filing says, in plain English
Who leads security (the top role, as the filing names it)
Chief Information Officer
Reports to
not identified
Board oversight
Full board
“The Board of Directors, having ultimate oversight of the company's cybersecurity risk, receives annual and periodic updates on the cybersecurity program, including those related to material risks and incidents, from the Chief Information Officer and participates in discussions regarding cybersecurity risks.”
CISO or other person named
not identified
Frameworks and standards named
NIST (publication not named)
Where the filing names it
- NIST (publication not named): “Our program incorporates applicable industry frameworks and standards, including guidance provided by the National Institute of Standards and Technology and the Information Technology Infrastructure Library, and is comprised of core functions to identify, protect, detect, respond to and recover from cybersecurity threats and events.”
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“The Chief Information Officer holds a master's degree in business administration with a concentration in technology and has decades of professional experience in cybersecurity threat assessments and detection, applicable technologies, incident response and employee training.”
Material incident
The filing states none
“As of the date of this report, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, results of operations, financial condition and cash flows.”
The section
497 words, Form 10-K filed October 29, 2026 for the period ended October 3, 2026
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Insteel Industries Inc standard industrial classification 3310, Steel works, blast furnaces & rolling & finishing mills (SEC SIC list). One other filer in our library has the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Manufacturing).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Gibraltar Industries, Inc.FY 2025, filed February 26, 2026 | head of information and cybersecurity | Chief Digital Information Officer | Audit and Risk Committee |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Penguin Solutions, Inc.FY 2026, filed October 20, 2026 | Chief Information Officer | not identified | not identified |
| Napco Security Technologies, IncFY 2026, filed August 24, 2026 | Vice President of Information Technology | not identified | not identified |
| News CorpFY 2026, filed August 7, 2026 | Chief Information Security Officer | Chief Technology Officer | Audit Committee |
| NikeFY 2026, filed July 15, 2026 | Vice President, Foundational Technology & Services | Chief Technology Officer | Audit & Finance Committee |
| Daktronics IncFY 2026, filed June 24, 2026 | Vice President of Information Technology | not identified | Strategy and Risk Committee |
| Methode Electronics IncFY 2026, filed June 24, 2026 | Chief Information Security Officer | not identified | full board |
| Capri Holdings LtdFY 2026, filed May 27, 2026 | head of Global Cybersecurity and Compliance (Head of Cybersecurity) | our CIO | Audit Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Insteel Industries Inc's Form 10-K as filed with the SEC on October 29, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity.
Risk Management and Strategy
As a component of and integrated into our overall risk management framework, we maintain a cybersecurity risk management program designed to assess, identify and manage material risks from cybersecurity threats and to protect our information systems and data from unauthorized access, use, disclosure, disruption, modification or destruction. Our program incorporates applicable industry frameworks and standards, including guidance provided by the National Institute of Standards and Technology and the Information Technology Infrastructure Library, and is comprised of core functions to identify, protect, detect, respond to and recover from cybersecurity threats and events.
We monitor cybersecurity threats and periodically evaluate the design and effectiveness of our cybersecurity program, including through assessments conducted with the assistance of third-party experts. We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring designed to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments.
As described in "Item 1A. Risk Factors" in this Form 10-K, cybersecurity threats could materially and adversely affect our business and financial results . As of the date of this report, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, results of operations, financial condition and cash flows.
Governance
Our Information Services Department manages our cybersecurity risk management program under the direction of our Chief Information Officer. The Chief Information Officer holds a master's degree in business administration with a concentration in technology and has decades of professional experience in cybersecurity threat assessments and detection, applicable technologies, incident response and employee training. Our Information Services Department includes a team of experienced professionals responsible for maintaining our Incident Response Policy, which is regularly reviewed and updated. The policy establishes the required steps to assess, respond to, limit the impact of and recover from events and details tactical and strategic team membership and points of contact related to the response process. The policy also provides for escalating notifications to senior executives, including the Chairman of the Board and Chief Executive Officer, depending on the severity of the threat.
The Board of Directors, having ultimate oversight of the company's cybersecurity risk, receives annual and periodic updates on the cybersecurity program, including those related to material risks and incidents, from the Chief Information Officer and participates in discussions regarding cybersecurity risks. Cybersecurity information provided to the Board comprises a broad range of topics including, but not limited to, emerging cybersecurity threats, ongoing cybersecurity initiatives, incident reports and compliance with regulatory requirements, industry standards and relevant benchmarking. In addition to Board oversight, we provide mandatory quarterly employee training on how to identify, assess and manage risks from cybersecurity threats.
Earlier filings on record
Fiscal 2025 Form 10-K, filed October 23, 2025 sec.gov ↗
Top security role, as the filing names it
Vice President of Information Services
Reports to, as the filing names it
not identified
Board oversight
Full board
“The Board of Directors, having ultimate oversight of the company's cybersecurity risk, receives annual and periodic updates on the cybersecurity program, including those related to material risks and incidents, from the Vice President of Information Services and participates in discussions regarding cybersecurity risks .”
Person named in the filing
not identified
Experience, as stated
Stated
“The Vice President of Information Services has a master's degree in business administration with a focus on technology and has decades of professional experience in cybersecurity threat assessments and detection, applicable technologies, incident response and employee training.”
Material incident
The filing states none
“As of the date of this report, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business, results of operations, financial condition and cash flows.”
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity.
Risk Management and Strategy
As a component of and integrated into our overall risk management strategy and system, we maintain a cybersecurity risk management program designed to assess, identify, manage and protect our information systems and data from unauthorized access, use, disclosure, disruption, modification or destruction. Our program is based on applicable industry frameworks and standards, including those provided by the National Institute of Standards and Technology, and is comprised of core functions to identify, protect, detect, respond to and recover from cybersecurity threats and events. We constantly monitor cybersecurity threats and test the performance and effectiveness of our cybersecurity program, with the assistance of third-party experts , on an annual and ongoing basis. We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments.
As described in "Item 1A. Risk Factors" in this Form 10-K, we are subject to risks from cybersecurity threats that could have a material adverse impact on our business and financial results. As of the date of this report, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business, results of operations, financial condition and cash flows.
Governance
Our Information Services Department manages our cybersecurity risk management program which is overseen by the Vice President of Information Services . The Vice President of Information Services has a master's degree in business administration with a focus on technology and has decades of professional experience in cybersecurity threat assessments and detection, applicable technologies, incident response and employee training. Our Information Services Department includes a team of experienced professionals who have developed an Incident Response Policy that is regularly reviewed and updated. The Incident Response Policy establishes the required steps to assess, respond to and limit the impact of an incident, details tactical and strategic team membership and points of contact related to the response process and provides for escalating notifications to senior executives, including the Chairman of the Board and Chief Executive Officer, depending on the severity of the threat.
The Board of Directors, having ultimate oversight of the company's cybersecurity risk, receives annual and periodic updates on the cybersecurity program, including those related to material risks and incidents, from the Vice President of Information Services and participates in discussions regarding cybersecurity risks . Cybersecurity information provided to the Board comprises a broad range of topics including, but not limited to, emerging cybersecurity threats, ongoing cybersecurity initiatives, incident reports and compliance with regulatory requirements, industry standards and relevant benchmarking. In addition to Board oversight, we provide mandatory quarterly employee training on how to identify, assess and manage risks from cybersecurity threats.
Fiscal 2024 Form 10-K, filed October 24, 2024 sec.gov ↗
Top security role, as the filing names it
Vice President of Information Services
Reports to, as the filing names it
not identified
Board oversight
Full board
“The Board of Directors, having ultimate oversight of the company's cybersecurity risk, receives annual and periodic updates on the cybersecurity program, including those related to material risks and incidents, from the Vice President of Information Services and participates in discussions regarding cybersecurity risks.”
Person named in the filing
not identified
Experience, as stated
Stated
“The Vice President of Information Services has a master's degree in business administration with a focus on technology and has decades of professional experience in cybersecurity threat assessments and detection, applicable technologies, incident response and employee training.”
Material incident
The filing states none
“As of the date of this report, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business, results of operations, financial condition and cash flows.”
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
Risk Management and Strategy
As a component of and integrated into our overall risk management strategy and system, we maintain a cybersecurity risk management program designed to assess, identify, manage and protect our information systems and data from unauthorized access, use, disclosure, disruption, modification or destruction. Our program is based on applicable industry frameworks and standards, including those provided by the National Institute of Standards and Technology, and is comprised of core functions to identify, protect, detect, respond to and recover from cybersecurity threats and events. We constantly monitor cybersecurity threats and test the performance and effectiveness of our cybersecurity program, with the assistance of third-party experts, on an annual and ongoing basis. We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments.
As described in "Item 1A. Risk Factors" in this Form 10-K, we are subject to risks from cybersecurity threats that could have a material adverse impact on our business and financial results. As of the date of this report, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business, results of operations, financial condition and cash flows.
Governance
Our Information Services Department manages our cybersecurity risk management program which is overseen by the Vice President of Information Services. The Vice President of Information Services has a master's degree in business administration with a focus on technology and has decades of professional experience in cybersecurity threat assessments and detection, applicable technologies, incident response and employee training. Our Information Services Department includes a team of experienced professionals who have developed an Incident Response Policy that is regularly reviewed and updated. The Incident Response Policy establishes the required steps to assess, respond to and limit the impact of an incident, details tactical and strategic team membership and points of contact related to the response process and provides for escalating notifications to senior executives, including the Chairman of the Board and Chief Executive Officer depending on the severity of the threat.
The Board of Directors, having ultimate oversight of the company's cybersecurity risk, receives annual and periodic updates on the cybersecurity program, including those related to material risks and incidents, from the Vice President of Information Services and participates in discussions regarding cybersecurity risks. Cybersecurity information provided to the Board comprises a broad range of topics including, but not limited to, emerging cybersecurity threats, ongoing cybersecurity initiatives, incident reports and compliance with regulatory requirements, industry standards and relevant benchmarking. In addition to Board oversight, we provide mandatory quarterly employee training on how to identify, assess and manage risks from cybersecurity threats.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.