Disclosure · Form 10-K · fiscal 2025
Hallador Energy Co 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 12, 2026· period ended December 31, 2025· HNRG· CIK 788965· Updated · filing on sec.gov ↗
Hallador Energy Co's Form 10-K for fiscal 2025, filed March 12, 2026, places oversight of cybersecurity risk with the Audit Committee; a top security role title is not identified.
What Hallador Energy's Item 1C says
Hallador Energy's Form 10-K for fiscal 2025 places ultimate oversight of cybersecurity risk with the Board, with the Audit Committee and IT Steering Committee each having certain responsibilities.
Board and management oversight
The IT Steering Committee oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations. The IT Steering Committee and/or the full Executive Team receive at least quarterly reports from management on information technology matters, including cybersecurity. The Audit Committee discusses with management the Company's major policies on risk assessment and risk management, including cyber-security, as they relate to accounting and financial reporting integrity.
Who leads security
Responsibility for identifying and assessing risks and recommending system upgrades resides with expert consultants who report to the IT Director.
How the company manages cyber risk
The company has endpoint and other protection systems, and incident response processes, both internally and through third-party consultants, designed to protect its information technology systems. When new threats are identified, personnel are notified with instruction to increase awareness of the threat and how to react if it is encountered.
Third parties and incidents
The company states it has not identified an indication of a substantive cyber security incident that would have a material impact on its business, results of operations or financial statements.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a specific security framework or standard.
Read from the Form 10-K filed March 12, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
not identified
Reports to
not identified
Board oversight
Audit Committee
“Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cyber-security, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirement.”
How often the board or committee hears about it
At least quarterly
“The IT Steering Committee and/or the full Executive Team receive at least quarterly reports from management on information technology matters, including cybersecurity.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
not identified
Material incident
The filing states none
“We have not identified an indication of a substantive cyber security incident that would have a material impact on our business, results of operations or financial statements.”
The section
441 words, Form 10-K filed March 12, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Hallador Energy Co standard industrial classification 4911, Electric services (SEC SIC list). 4 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Talen Energy CorpFY 2025, filed February 26, 2026 | not identified | not identified | Audit Committee |
| NRG Energy, Inc.FY 2025, filed February 24, 2026 | Chief Information Security Officer | not identified | Finance and Risk Management ("FARM") Committee |
| FirstEnergyFY 2025, filed February 18, 2026 | CISO | FirstEnergy's Chief Information Officer | Audit Committee |
| Eversource EnergyFY 2025, filed February 17, 2026 | Chief Information Security Officer | Chief Information Officer | Finance and Risk Management Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Hallador Energy Co's Form 10-K as filed with the SEC on March 12, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. CYBERSECURITY.
Risk Management and Strategy
We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party consultants , designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve issues timely.
As new threats to security may be identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. Responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our expert consultants who report to our IT Director .
Governance
Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into the Company's compliance policies and procedures. With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee and IT Steering Committee each having certain responsibilities relating to risk management of cybersecurity.
Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cyber-security, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirement.
In addition to its other responsibilities, the IT Steering Committee oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations.
The IT Steering Committee and/or the full Executive Team receive at least quarterly reports from management on information technology matters, including cybersecurity. The reports address upgrades to hardware, software, and IT systems throughout the Company, and include the identification of IT and cybersecurity risks. Security scores, risk management, and mitigation measures are routinely presented. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts. As these systems, processes, training, and upgrades are implemented, updates are provided to the Executive Team.
We have not identified an indication of a substantive cyber security incident that would have a material impact on our business, results of operations or financial statements. For additional information regarding risks from cybersecurity threats, please refer to " Item 1A. Risk Factors " above.
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 17, 2025 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee and IT Steering Committee each having certain responsibilities relating to risk management of cybersecurity.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“We have not identified an indication of a substantive cyber security incident that would have a material impact on our business, results of operations or financial statements.”
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY.
Risk Management and Strategy
We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party consultants , designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve issues timely.
As new threats to security may be identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. Responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our expert consultants who report to our IT Director .
Governance
Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into the Company's compliance policies and procedures. With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee and IT Steering Committee each having certain responsibilities relating to risk management of cybersecurity.
Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cyber-security, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirement.
In addition to its other responsibilities, the IT Steering Committee oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations.
The IT Steering Committee and/or the full Executive Team receive at least quarterly reports from management on information technology matters, including cybersecurity. The reports address upgrades to hardware, software, and IT systems throughout the Company, and include the identification of IT and cybersecurity risks. Security scores, risk management, and mitigation measures are routinely presented. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts. As these systems, processes, training, and upgrades are implemented, updates are provided to the Executive Team.
We have not identified an indication of a substantive cyber security incident that would have a material impact on our business, results of operations or financial statements. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, " Risk Factors " above.
Fiscal 2023 Form 10-K, filed March 14, 2024 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cyber-security, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirement.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“We have not identified an indication of a substantive cyber security incident that would have a material impact on our business, results of operations or financial statements.”
Read by claude-sonnet-5-5 on October 31, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY.
Risk Management and Strategy
We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party consultants, designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve issues timely.
As new threats to security may be identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. Responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our expert consultants who report to our IT Director.
Governance
Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into the Company's compliance policies and procedures. With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee and IT Steering Committee each having certain responsibilities relating to risk management of cybersecurity.
Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cyber-security, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirement.
In addition to its other responsibilities, the IT Steering Committee oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations.
The IT Steering Committee and/or the full Executive Team receive at least quarterly reports from management on information technology matters, including cybersecurity. The reports address upgrades to hardware, software, and IT systems throughout the Company, and include the identification of IT and cybersecurity risks. Security scores, risk management, and mitigation measures are routinely presented. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts. As these systems, processes, training, and upgrades are implemented, updates are provided to the Executive Team.
We have not identified an indication of a substantive cyber security incident that would have a material impact on our business, results of operations or financial statements. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," above.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.