Disclosure · Form 10-K · fiscal 2025
The E.W. Scripps Company 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 27, 2026· period ended December 31, 2025· SSP· CIK 832428· Updated · filing on sec.gov ↗· company page
The E.W. Scripps Company's Form 10-K for fiscal 2025, filed February 27, 2026, names the chief information security officer as its top security role, with oversight by the Audit Committee. On CISO Tribune's record, the Chief Information Security Officer of The E.W. Scripps Company is Daniel Parsons (appointment announced on October 20, 2025; record).
- The E.W. Scripps Company: who leads security, and the seat's history
- Daniel Parsons, Chief Information Security Officer of The E.W. Scripps Company on our record
- How other television broadcasting stations filers describe the seat
What The E.W. Scripps Company's Item 1C says
E.W. Scripps's Form 10-K for fiscal 2025 places oversight of cybersecurity and technology risks with the Board of Directors through the Audit Committee. The company employs a chief information security officer to oversee the cybersecurity leadership team.
Board and management oversight
The Audit Committee receives quarterly updates from the CISO, and the Board of Directors oversees cybersecurity and technology risks through that committee. Intermittent updates go to the full Board for educational purposes or when special needs arise. Cybersecurity is a key risk included in risk management discussions on the Governance, Risk and Compliance committee, which meets quarterly before board meetings. The chief privacy officer oversees an enterprise wide privacy program that includes annual training.
Who leads security
The CISO has technology and risk management experience in various industries and holds the boardroom certified technology expert (QTE) designation from the Digital Directors Network. The team manages governance, risk and compliance work, security operations, and identity and access management.
How the company manages cyber risk
Scripps aligns its cybersecurity program with the National Institute of Standards and Technology cybersecurity framework. Scripps scans its systems for vulnerabilities, categorizes them based on severity and, where possible, addresses them to prevent exploitation by threat actors. The Integrated Incident Response Program is reviewed at least annually to ensure alignment with changes in notification laws, company structure and operations, and service providers. Tabletop exercises are conducted periodically to assess the company's readiness for executing the plan. Under the company's process, any actual or suspected security incident is reported to the CISO. Cybersecurity incidents are evaluated under the Integrated Incident Response Program and flow to the Enterprise Response Team according to defined escalation criteria. The company launches separate, annual web-based learning modules on cybersecurity, privacy and security topics such as phishing, password hygiene and data governance to all employees. Employees who fail phishing simulations must complete additional training.
Third parties and incidents
Scripps employs a trained incident response team and a managed security service provider to identify and mitigate incidents that bypass its cybersecurity controls. The filing says no risks from cybersecurity threats, including from previous incidents, have materially affected the business, its strategy, results of operations or financial condition. The Cyber Incident Response Plan includes materiality assessments in accordance with the new U.S. Securities and Exchange Commission cybersecurity rules.
What the section does not state
The section does not name the person who holds the top security role. The section does not say who the top security role reports to.
Read from the Form 10-K filed February 27, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
chief information security officer
Reports to
not identified
Board oversight
Audit Committee
“The Board of Directors oversees cybersecurity and technology risks through the Audit Committee , which receives quarterly updates from the CISO.”
How often the board or committee hears about it
Quarterly
“The Board of Directors oversees cybersecurity and technology risks through the Audit Committee , which receives quarterly updates from the CISO.”
CISO or other person named
not identified
Frameworks and standards named
NIST (publication not named)
Where the filing names it
- NIST (publication not named): “• Align the cybersecurity program with the National Institute of Standards and Technology cybersecurity framework.”
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“Our CISO has extensive technology and risk management experience in various industries and is qualified as a boardroom certified technology expert (QTE) by the Digital Directors Network.”
Material incident
The filing states none
“To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business, our business strategy, our results of operations or financial condition.”
The section
825 words, Form 10-K filed February 27, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 16, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns The E.W. Scripps Company standard industrial classification 4833, Television broadcasting stations (SEC SIC list). Shown: filers whose codes the SEC assigns to the same review office (Office of Technology).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Tianci International, Inc.FY 2026, filed November 4, 2026 | Corporate Controller | CEO/CFO | Audit Committee |
| Brightline Interactive, Inc.FY 2026, filed September 28, 2026 | Chief Technology Officer | Chief Executive Officer | full board |
| ReposiTrak, Inc.FY 2026, filed September 28, 2026 | not identified | not identified | Audit Committee |
| DONALDSON Co IncFY 2026, filed September 25, 2026 | Chief Information Officer | not identified | audit committee |
| EGAIN CorpFY 2026, filed September 10, 2026 | Chief Information Security Officer | Chief Financial Officer | Audit Committee |
| Palo Alto NetworksFY 2026, filed September 10, 2026 | chief information security officer | not identified | Security Committee |
| Twin Disc IncFY 2026, filed September 4, 2026 | not identified | not identified | Audit Committee of the Board of Directors |
| ZscalerFY 2026, filed September 3, 2026 | chief security officer | not identified | audit committee of the board of directors |
More disclosures from filers CISO Tribune files under Telecom & Media: AT&T, Comcast, JetBlue, Lumen Technologies.
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of The E.W. Scripps Company's Form 10-K as filed with the SEC on February 27, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
Item 1C. Cybersecurity
Protecting our systems and data from cyber threats is important for ensuring the continuity of operations and maintaining the trust of our customers and stakeholders. Scripps is committed to the transparent and ethical use of the personal data in its care and complying with applicable privacy-related regulations.
To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business, our business strategy, our results of operations or financial condition. For further information, see "We will continue to face cybersecurity and similar risks, which could result in the disclosure of confidential information, disruption of operations, damage to our brands and reputation, legal exposure and financial losses" in Item 1A, Risk Factors of this Annual Report. In the event an attack or other intrusion were to be successful, we have a trained response team of internal and external resources that are prepared to respond.
Cybersecurity Program
Scripps is committed to having a strong cybersecurity program and employs a chief information security officer ("CISO") to oversee the cybersecurity leadership team. Our CISO has extensive technology and risk management experience in various industries and is qualified as a boardroom certified technology expert (QTE) by the Digital Directors Network. The team manages governance, risk and compliance, security operations and identity and access management. Scripps routinely identifies and considers potential improvements to its cybersecurity program based on the threat landscape. Improvements may include adjustments to staffing, processes or the acquisition of new technology. When such potential improvements are identified, the Company weighs the costs and benefits of such improvements (including against other potential improvements) and, if selected, the improvements are added to a roadmap for possible implementation.
Scripps has implemented certain physical, administrative and technical controls to help secure its enterprise environment and products. Cybersecurity controls include, but are not limited to, the following measures:
• Enforce controls that limit access based on job responsibilities and enforcing authentication measures, including strong password policies and multifactor authentication where appropriate.
• Conduct exercises to ensure the company is prepared to respond to cyber incidents.
• Align the cybersecurity program with the National Institute of Standards and Technology cybersecurity framework.
• Scan our systems for vulnerabilities that may potentially impact our enterprise or products, categorize them based on severity and where possible, proactively address them to prevent exploitation by threat actors.
• Employ a trained incident response team and a managed security service provider to identify and mitigate incidents that bypass our cybersecurity controls to minimize impact to operations.
• Engage in industry collaboration and cyber threat intelligence sharing to strengthen defenses, enhance situational awareness and protect our people, content and technology.
Incident Response Plan
The Integrated Incident Response Program is reviewed at least annually to ensure alignment with any changes in notification laws, company structure and operations, service providers and the risk landscape. The Cyber Incident Response Plan includes materiality assessments in accordance with the new U.S. Securities and Exchange Commission ("SEC") cybersecurity rules. This same process is also used to address materiality as it relates to non-cyber events, should they occur. Tabletop exercises are conducted periodically to assess readiness for plan execution.
Any actual or suspected security incident is reported to the CISO. Cybersecurity incidents are evaluated under the Integrated Incident Response Program and flow to the Enterprise Response Team according to clearly defined escalation criteria.
Oversight
Cybersecurity is a key risk included in risk management discussions on the Governance, Risk and Compliance committee that meets quarterly before board meetings. The Board of Directors oversees cybersecurity and technology risks through the Audit Committee , which receives quarterly updates from the CISO. Intermittent updates are provided to the full Board for educational purposes or when special needs arise. Our Cyber Risk Management program is built on a close partnership between Cybersecurity, Privacy Legal and Audit — aligning expertise to proactively identify, assess and mitigate evolving threats.
Our chief privacy officer oversees an enterprise wide privacy program that includes annual training; a "privacy by design" ethos within development teams; privacy-specific contract reviews; and an enterprise wide privacy platform to manage rights, requests and consent management.
Privacy
Scripps is committed to data governance and protection. We recognize the importance of safeguarding personal information in today's digital landscape. Our comprehensive Privacy Policy provides a clear definition of "personal data" and outlines where and how the policy applies. The policy details our methods for collecting and storing personal data, explains users' rights and addresses additional privacy-related matters. We maintain transparency by keeping our Privacy Policy updated and making it available across all relevant digital platforms.
Employee Training Programs
We launch separate, annual web-based learning modules on cybersecurity, privacy and various security topics such as phishing, password hygiene and data governance to all employees. The annual security awareness training is reinforced through regular phishing simulations across the enterprise to provide employees with practical exposure to phishing campaigns. Employees who fail phishing simulations must complete additional training.
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 12, 2025 sec.gov ↗
Top security role, as the filing names it
chief information security officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“The Board of Directors oversees cybersecurity and technology risks through the Audit Committee , which receives quarterly updates from the CISO.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business, our business strategy, our results of operations or financial condition.”
Read by claude-sonnet-5-5 on October 16, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
Protecting our systems and data from cyber threats is important for ensuring the continuity of operations and maintaining the trust of our customers and stakeholders. Scripps is committed to the transparent and ethical use of the personal data in its care and complying with applicable privacy-related regulations.
To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business, our business strategy, our results of operations or financial condition. For further information, see "We will continue to face cybersecurity and similar risks, which could result in the disclosure of confidential information, disruption of operations, damage to our brands and reputation, legal exposure and financial losses" in Item 1A, Risk Factors of this Annual Report. In the event an attack or other intrusion were to be successful, we have a trained response team of internal and external resources that are prepared to respond.
Cybersecurity Program
Scripps is committed to having a strong cybersecurity program and employs a chief information security officer ("CISO") to oversee the cybersecurity leadership team. The team manages governance, risk and compliance, security operations, and identity and access management. Scripps routinely identifies and considers potential improvements to its cybersecurity program based on the threat landscape. Improvements may include adjustments to staffing, processes or the acquisition of new technology. When such potential improvements are identified, the Company weighs the costs and benefits of such improvements (including against other potential improvements) and, if selected, the improvements are added to a roadmap for possible implementation.
Scripps has implemented certain physical, administrative and technical controls to help secure its enterprise environment and products. Cybersecurity controls include, but are not limited to, the following measures:
• Enforce controls that limit access based on job responsibilities and enforcing authentication measures, including strong password policies and multifactor authentication where appropriate.
• Conduct exercises to ensure the company is prepared to respond to cyber incidents.
• Align the cybersecurity program with the National Institute of Standards and Technology cybersecurity framework.
• Scan our systems for vulnerabilities that may potentially impact our enterprise or products, categorize them based on severity and where possible, proactively address them to prevent exploitation by threat actors.
• Employ a trained incident response team and a managed security service provider to identify and mitigate incidents that bypass our cybersecurity controls to minimize impact to operations.
Incident Response Plan
The Integrated Incident Response Program is reviewed at least annually to ensure alignment with any changes in notification laws, company structure and operations, service providers and the risk landscape. The Cyber Incident Response Plan includes materiality assessments in accordance with the new U.S. Securities and Exchange Commission ("SEC") cybersecurity rules. This same process is also used to address materiality as it relates to non-cyber events, should they occur. Tabletop exercises are conducted periodically to assess readiness for plan execution.
Any actual or suspected security incident is reported to the CISO. Cybersecurity incidents are evaluated under the Integrated Incident Response Program and flow to the Enterprise Response Team according to clearly defined escalation criteria.
Oversight
Cybersecurity is a key risk included in risk management discussions on the Governance, Risk and Compliance committee that meets quarterly before board meetings. The Board of Directors oversees cybersecurity and technology risks through the Audit Committee , which receives quarterly updates from the CISO. Intermittent updates are provided to the full Board for educational purposes or when special needs arise.
Our chief privacy officer oversees an enterprise wide privacy program that includes annual training; a "privacy by design" ethos within development teams; privacy-specific contract reviews; and an enterprise wide privacy platform to manage rights, requests and consent management.
Privacy
Scripps is committed to data governance and protection. We recognize the importance of safeguarding personal information in today's digital landscape. Our comprehensive Privacy Policy provides a clear definition of "personal data" and outlines where and how the policy applies. The policy details our methods for collecting and storing personal data, explains users' rights and addresses additional privacy-related matters. We maintain transparency by keeping our Privacy Policy updated and making it available across all relevant digital platforms.
Employee Training Programs
We launch separate, annual web-based learning modules on cybersecurity, privacy and various security topics such as phishing, password hygiene and data governance to all employees. The annual security awareness training is reinforced through regular phishing simulations across the enterprise to provide employees with practical exposure to phishing campaigns. Employees who fail phishing simulations must complete additional training.
Fiscal 2023 Form 10-K, filed February 23, 2024 sec.gov ↗
Top security role, as the filing names it
chief information security officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“The Board of Directors oversees cybersecurity and technology risks through the Audit Committee, which receives quarterly updates from the CISO.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business, our business strategy, our results of operations or financial condition.”
Read by claude-sonnet-5-5 on October 16, 2026; every quote verified in the stored text by code.
Item 1C. Cybersecurity
Protecting our systems and data from cyberthreats is important for ensuring the continuity of operations and maintaining the trust of our customers and stakeholders. Scripps is committed to respecting the privacy of the personal data in its care and complying with applicable privacy-related regulations.
To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business, our business strategy, our results of operations or financial condition. For further information, see "We will continue to face cybersecurity and similar risks, which could result in the disclosure of confidential information, disruption of operations, damage to our brands and reputation, legal exposure and financial losses" in Item 1A, Risk Factors of this Annual Report. In the event an attack or other intrusion were to be successful, we have a trained response team of internal and external resources that are prepared to respond.
Cybersecurity Program
Scripps is committed to having a strong cybersecurity program and employs a chief information security officer ("CISO") to oversee the cybersecurity leadership team. The team manages governance, risk and compliance, security operations, and identity and access management. Scripps routinely identifies and considers potential improvements to its cybersecurity program based on the threat landscape. Improvements may include adjustments to staffing or processes or the acquisition of new technology. When such potential improvements are identified, the Company weighs the costs and benefits of such improvements (including against other potential improvements) and, if selected, the improvements are added to a roadmap for possible implementation.
Scripps has implemented certain physical, administrative and technical controls to help secure its enterprise environment and products. Cybersecurity controls include, but are not limited to, the following measures:
• Enforce controls that limit access based on job responsibilities and enforcing authentication measures, including strong password policies and multifactor authentication where appropriate.
• Conduct exercises to ensure the company is prepared to respond to cyber incidents.
• Align the cybersecurity program with NIST cybersecurity framework.
• Scan our systems for vulnerabilities that may potentially impact our enterprise or products, categorize them based on severity and where possible, proactively address them to prevent exploitation by threat actors.
• Employ a trained incident response team and a managed security service provider to identify and mitigate incidents that bypass our cybersecurity controls to minimize impact to operations.
Incident Response Plan
The Integrated Incident Response Program is reviewed at least annually to ensure alignment with any changes in notification laws, company structure and operations, service providers and the risk landscape. Most recently, we updated the Cyber Incident Response Plan to include materiality assessments in accordance with the new U.S. Securities and Exchange Commission ("SEC") cybersecurity rules. Tabletop exercises are conducted to assess readiness for plan execution.
Any actual or suspected security incident is reported to the CISO. Cybersecurity incidents are evaluated under the Integrated Incident Response Program and flow to the Enterprise Response Team according to clearly defined escalation criteria.
Oversight
Cybersecurity is a key risk included in risk management discussions on the Governance, Risk and Compliance committee that meets quarterly before board meetings. The Board of Directors oversees cybersecurity and technology risks through the Audit Committee, which receives quarterly updates from the CISO. Intermittent updates are provided to the full Board for educational purposes or when special needs arise.
Our chief privacy officer oversees an enterprise wide privacy program that includes annual training; a "privacy by design" ethos within development teams; privacy-specific contract reviews; and an enterprise wide privacy platform to manage rights, requests and consent management.
Privacy
We understand the importance of protecting data. Our Privacy Policy defines "personal data" and, among other things, explains its coverage, how personal data is collected and stored, and a user's rights to restrict its usage or opt out. Our privacy policies are updated annually and are conspicuously displayed on all applicable digital properties. For more information, please see the Privacy Policy on our website.
Employee Training Programs
We launch separate, annual web-based learning modules on cybersecurity, privacy, and various security topics such as phishing, password hygiene and data governance to all employees. The annual security awareness training is reinforced through regular phishing simulations across the enterprise to provide employees with practical exposure to phishing campaigns. Employees who fail phishing simulations must complete additional training.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.