Disclosure · Form 10-K · fiscal 2025
Blue Dolphin Energy Co 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 31, 2026· period ended December 31, 2025· BDCO· CIK 793306· Updated · filing on sec.gov ↗
Blue Dolphin Energy Co's Form 10-K for fiscal 2025, filed March 31, 2026, names the chief executive officer as its top security role, with oversight by the full board.
What Blue Dolphin Energy's Item 1C says
Blue Dolphin Energy's Form 10-K for fiscal 2025 places responsibility for cybersecurity risk management initiatives with the entire Board. At the management level, the chief executive officer leads the company's cybersecurity risk management activities.
How the company manages cyber risk
The company completed an initial inventory of its critical assets, information assets, and data repositories to identify potential areas of exposure to cybersecurity threats. Management recently implemented a program to conduct periodic phishing tests that give personnel feedback and instruction.
Third parties and incidents
The company did not experience a significant cybersecurity breach or associated expenses, penalties, or settlements for the twelve months ended December 31, 2025 and 2024.
What the section does not state
The section does not name the person who holds the top security role. The section does not name a board committee as responsible for cybersecurity oversight.
Read from the Form 10-K filed March 31, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
chief executive officer
Reports to
not identified
Board oversight
Full board
“The Board oversees our risks, and risk management initiatives, including those related to cybersecurity risk are the responsibility of the entire Board.”
CISO or other person named
not identified
Frameworks and standards named
not identified
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
not identified
Material incident
The filing states none
“We did not experience a significant cybersecurity breach or associated expenses, penalties, or settlements for the twelve months ended December 31, 2025 and 2024.”
The section
237 words, Form 10-K filed March 31, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on November 5, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns Blue Dolphin Energy Co standard industrial classification 1311, Crude petroleum & natural gas (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| EON Resources Inc.FY 2025, filed October 13, 2026 | not identified | not identified | full board |
| Royale Energy, Inc.FY 2025, filed July 13, 2026 | not identified | not identified | audit committee |
| Norris Industries, Inc.FY 2026, filed May 29, 2026 | Chief Executive Officer | not identified | not identified |
| W&T Offshore IncFY 2025, filed March 16, 2026 | CIO & CISO | not identified | Audit Committee of the board of directors |
| Empire Petroleum CorpFY 2025, filed March 13, 2026 | Vice President of IT | Chief Executive Officer | Audit Committee |
| Us Energy CorpFY 2025, filed March 13, 2026 | Director of IT | not identified | Audit Committee |
| APA CorpFY 2025, filed February 26, 2026 | Executive Vice President, Administration | Chief Executive Officer | Cybersecurity Committee |
| Chord Energy CorpFY 2025, filed February 26, 2026 | Vice President, Information Technology | not identified | Audit and Reserves Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of Blue Dolphin Energy Co's Form 10-K as filed with the SEC on March 31, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. CYBERSECURITY
We depend on information technology and systems for various operations (including refinery processes and refined product loading) and for capturing accounting, technical, and regulatory data for reporting, analysis, and archiving. These systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. We completed an initial inventory of our critical assets, information assets, and data repositories to identify potential areas of exposure to cybersecurity threats, and we are developing a periodic assessment program. Until such a plan is implemented, we rely on ad-hoc assessments and monitoring of our information technology infrastructure. There can be no assurance that our current, ad-hoc assessments will detect all potential vulnerabilities in a timely manner, which could expose us to material risk.
The Board oversees our risks, and risk management initiatives, including those related to cybersecurity risk are the responsibility of the entire Board. At the management level, our cybersecurity risk management activities are led by our chief executive officer. Management utilizes certain tools and controls to detect, monitor, prevent, mitigate, and remediate cybersecurity threats to our systems, networks, applications, and data management. Management also recently implemented a program to conduct periodic phishing tests, which provide contemporaneous feedback and instruction to personnel and seeks to strengthen our defenses against cyber threats.
We did not experience a significant cybersecurity breach or associated expenses, penalties, or settlements for the twelve months ended December 31, 2025 and 2024.
Earlier filings on record
Fiscal 2024 Form 10-K, filed April 1, 2025 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
not identified
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“We did not experience a significant cybersecurity breach or associated expenses, penalties, or settlements for the twelve months ended December 31, 2024 and 2023.”
Read by claude-sonnet-5-5 on November 5, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
We depend on information technology and systems for various operations (including refinery processes and refined product loading) and for capturing accounting, technical, and regulatory data for reporting, analysis, and archiving. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. As of the filing date of this report, our risk monitoring process related to cybersecurity includes conducting periodic vulnerability assessments using a combination of internal and third-party capabilities to perform technical assessments, vulnerability scanning, and incident and event monitoring. We are working to: (i) identify and assess threats and (ii) establish a thorough, risk-based cybersecurity program, including the potential adoption of a formal cybersecurity policy if deemed necessary by the Board, aimed at safeguarding our data, along with the data of our customers and partners. We anticipate that such a program will follow well-organized cybersecurity frameworks and be managed by a central control figure with Board oversight.
We did not experience a significant cybersecurity breach or associated expenses, penalties, or settlements for the twelve months ended December 31, 2024 and 2023.
Fiscal 2023 Form 10-K, filed April 1, 2024 sec.gov ↗
Top security role, as the filing names it
not identified
Reports to, as the filing names it
not identified
Board oversight
not identified
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“We did not experience a significant cybersecurity breach or associated expenses, penalties, or settlements for the twelve months ended December 31, 2023 and 2022 .”
Read by claude-sonnet-5-5 on November 5, 2026; every quote verified in the stored text by code.
ITEM 1C. CYBERSECURITY
We depend on information technology and systems for various operations (including refinery processes and refined product loading) and for capturing accounting, technical and regulatory data for reporting, analysis, and archiving. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. As of the filing date of this report, our risk assessment process related to cybersecurity includes conducting vulnerability assessments using a combination of internal and third-party capabilities to perform technical assessments, vulnerability scanning, and incident and event monitoring. We are working to establish a thorough, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners, and we anticipate that such a program will follow well-organized cybersecurity frameworks under a central control figure.
We did not experience a significant cybersecurity breach or associated expenses, penalties, or settlements for the twelve months ended December 31, 2023 and 2022 .
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.