Disclosure · Form 10-K · fiscal 2026
NextTrip, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2026
Filed May 29, 2026· period ended February 28, 2026· NTRP· CIK 788611· Updated · filing on sec.gov ↗
NextTrip, Inc.'s Form 10-K for fiscal 2026, filed May 29, 2026, places oversight of cybersecurity risk with the full board; a top security role title is not identified.
What NextTrip's Item 1C says
NextTrip's Form 10-K for fiscal 2026 places oversight responsibility for risk management with the Board of Directors as a whole, assisted by standing committees of the Board of Directors. The filing says the management team is primarily responsible for assessing and managing material risks from cybersecurity threats.
Board and management oversight
The board and its committees engage with management throughout the year to discuss enterprise risks, including cybersecurity. Management oversees the cybersecurity process on a day-to-day basis.
How the company manages cyber risk
The company has implemented access controls for its systems, which it monitors regularly and audits annually.
Third parties and incidents
The company relies on third party providers and outsourced IT services to monitor and address cybersecurity related risks. To date, the company has not encountered cybersecurity challenges, to its knowledge, that have materially impaired its operations or financial standing.
What the section does not state
The section does not name the person who holds the top security role. The section does not say who the top security role reports to. The section does not name a board committee as responsible for cybersecurity oversight. The section does not name a specific security framework or standard.
Read from the Form 10-K filed May 29, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
not identified
Reports to
not identified
Board oversight
Full board
“Instead, our Board of Directors as a whole has oversight responsibility for risk management, which it administers directly as well as with the assistance of standing committees of the Board of Directors that will address risks inherent in their respective areas of oversight.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
not identified
Material incident
The filing states none
“To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing.”
The section
373 words, Form 10-K filed May 29, 2026 for the period ended February 28, 2026
Read by claude-sonnet-5-5 on November 10, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns NextTrip, Inc. standard industrial classification 4700, Transportation services (SEC SIC list). 4 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| GXO Logistics, Inc.FY 2025, filed February 25, 2026 | Chief Information Security Officer | not identified | Audit Committee |
| VERRA MOBILITY CorpFY 2025, filed February 24, 2026 | Vice President of Cybersecurity | Chief Technology Officer | Audit Committee |
| Booking HoldingsFY 2025, filed February 18, 2026 | chief security officer | not identified | Cybersecurity Subcommittee of the Audit Committee |
| XPO, Inc.FY 2025, filed February 5, 2026 | Chief Information Security Officer | not identified | full board |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of NextTrip, Inc.'s Form 10-K as filed with the SEC on May 29, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM
1C. CYBERSECURITY.
Risk
Management and Strategy
Due
to the size of our company, we have not yet developed robust policies and processes for assessing, identifying, and managing material
risk from cybersecurity threats. We have implemented access controls with respect to our systems, which we monitor regularly and audit
annually. We currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems,
including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely
on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software
for threat protection and malware. Such third-party providers are tasked with notifying management of any material risks or cybersecurity
concerns that they identify, which management then assesses and may bring to our Board of Directors to discuss if deemed necessary or
appropriate. Based on the results of our risk assessments, if deemed necessary or appropriate, we take steps to re-design, implement,
and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly
monitor the effectiveness of our safeguards.
We
intend to work with outside counsel and third-party service providers to further develop our expertise, processes and procedures with
respect to cybersecurity protection and our response plan.
To
date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing.
For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Report.
Governance
Our
management team is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity
threats, with assistance from third-party service providers. Management oversees our cybersecurity process on a day-to-day basis, including
those described in "Risk Management and Strategy" above.
Our
Board of Directors does not have a standing risk management committee. Instead, our Board of Directors as a whole has oversight responsibility
for risk management, which it administers directly as well as with the assistance of standing committees of the Board of Directors that
will address risks inherent in their respective areas of oversight. Throughout the year, the board and its committees engage with management
to discuss a wide range of enterprise risks, including cybersecurity.
Earlier filings on record
Fiscal 2025 Form 10-K, filed May 29, 2025 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
Full board
“Instead, our Board of Directors as a whole has oversight responsibility for risk management, which it administers directly as well as with the assistance of standing committees of the Board of Directors that will address risks inherent in their respective areas of oversight .”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing.”
Read by claude-sonnet-5-5 on November 10, 2026; every quote verified in the stored text by code.
ITEM
1C. CYBERSECURITY.
Risk
Management and Strategy
Due
to the size of our company, we have not yet developed robust policies and processes for assessing, identifying, and managing material
risk from cybersecurity threats. We have implemented access controls with respect to our systems, which we monitor regularly and audit
annually. We currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems,
including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions . We rely
on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software
for threat protection and malware . Such third-party providers are tasked with notifying management of any material risks or cybersecurity
concerns that they identify, which management then assesses and may bring to our Board of Directors to discuss if deemed necessary or
appropriate. Based on the results of our risk assessments, if deemed necessary or appropriate, we take steps to re-design, implement,
and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly
monitor the effectiveness of our safeguards.
We
intend to work with outside counsel and third-party service providers to further develop our expertise, processes and procedures with
respect to cybersecurity protection and our response plan.
To
date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing.
For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Report.
Governance
Our
management team is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity
threats, with assistance from third-party service providers. Management oversees our cybersecurity process on a day-to-day basis, including
those described in "Risk Management and Strategy" above .
Our
Board of Directors does not have a standing risk management committee. Instead, our Board of Directors as a whole has oversight responsibility
for risk management, which it administers directly as well as with the assistance of standing committees of the Board of Directors that
will address risks inherent in their respective areas of oversight . Throughout the year, the board and its committees engage with management
to discuss a wide range of enterprise risks, including cybersecurity.
Fiscal 2024 Form 10-K, filed September 4, 2024 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
Full board
“Our Board of Directors does not have a standing risk management committee, but rather administers this oversight function directly through the Board of Directors as a whole, as well as through standing committees of the Board of Directors that will address risks inherent in their respective areas of oversight.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing.”
Read by claude-sonnet-5-5 on November 10, 2026; every quote verified in the stored text by code.
ITEM
1C. CYBERSECURITY.
Risk
management and strategy
Due
to the size of our company, we have not yet developed robust policies and processes for assessing, identifying, and managing material
risk from cybersecurity threats. We have implemented access controls with respect to our systems, which we monitor regularly and audit
annually. We currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems,
including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely
on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software
for threat protection and malware. Such third party providers are tasked with notifying management of any material risks or cybersecurity
concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or
appropriate. Based on the results of our risk assessments, if deemed necessary or appropriate, we take steps to re-design, implement,
and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly
monitor the effectiveness of our safeguards.
We
intend to work with outside counsel and third party service providers in the near term to further develop our expertise, processes and
procedures with respect to cybersecurity protection and our response plan.
To
date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing.
For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Report.
Governance
Our
management team is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity
threats, with assistance from third-party service providers. Management oversees our cybersecurity process on a day-to-day basis, including
those described in "Risk Management and Strategy" above. Our Board of Directors does not have a standing risk management
committee, but rather administers this oversight function directly through the Board of Directors as a whole, as well as through standing
committees of the Board of Directors that will address risks inherent in their respective areas of oversight.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.