Disclosure · Form 10-K · fiscal 2025
SPX Technologies, Inc. 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed February 25, 2026· period ended December 31, 2025· SPXC· CIK 88205· Updated · filing on sec.gov ↗
SPX Technologies, Inc.'s Form 10-K for fiscal 2025, filed February 25, 2026, names the chief information security officer as its top security role, with oversight by the Audit Committee.
What SPX Technologies' Item 1C says
SPX Technologies' Form 10-K for fiscal 2025 places oversight of cybersecurity risk with the Board of Directors, in coordination with the Audit Committee. The chief information officer and the chief information security officer have primary responsibility for assessing and managing material cybersecurity risks.
Board and management oversight
The Audit Committee receives regular cybersecurity risk reports from management. The Board receives reports from management, including the CIO and CISO, at least annually about the prevention, detection, mitigation, and remediation of cybersecurity incidents. Quarterly cybersecurity updates are provided to executive leadership to review security key performance indicators, identify security risks, and assess the status of approved security enhancements.
Who leads security
The CISO holds 11 industry security, risk, and/or privacy certifications and has served in various roles in information technology and information security for over 25 years. The CIO has served in various roles in information technology and information security for over 30 years, including as the CIO of three other companies.
How the company manages cyber risk
The company has policies, processes and practices for assessing, identifying, and managing material cybersecurity risks, integrated into its overall risk management program and based on frameworks from NIST and ISO. The company's assessments include third party security penetration testing and independent reviews of its information security control environment and operating effectiveness. The company has incident response and recovery plans to address potential cybersecurity incidents, and the plans are regularly evaluated for their effectiveness.
Third parties and incidents
Key security, risk, and compliance personnel meet regularly and, together with cybersecurity consultants, develop strategies for preserving the confidentiality, integrity and availability of data. Third-party technology service providers are contractually obligated to maintain cybersecurity controls and provide SOC 2 reports, ISO 27001 certifications or complete security questionnaires at onboarding. Management periodically conducts tabletop exercises designed to ensure prompt escalation of material cybersecurity incidents.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed February 25, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
chief information security officer
Reports to
not identified
Board oversight
Audit Committee
“Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk.”
How often the board or committee hears about it
At least annually
“The Audit Committee receives regular cybersecurity risk reports from management and, at least annually, our Board receives reports from management, including our CIO and CISO about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities.”
CISO or other person named
not identified
Frameworks and standards named
ISO/IEC 27001, SOC 2, NIST (publication not named)
Where the filing names them
- ISO/IEC 27001: “In addition, our third-party technology service providers are contractually obligated to maintain cybersecurity controls and provide System and Organization Controls ("SOC") SOC 2 reports, ISO 27001 certifications or complete our security questionnaires at the time of onboarding.”
- SOC 2: “In addition, our third-party technology service providers are contractually obligated to maintain cybersecurity controls and provide System and Organization Controls ("SOC") SOC 2 reports, ISO 27001 certifications or complete our security questionnaires at the time of onboarding.”
- NIST (publication not named): “We have established policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which are integrated into our overall risk management program and based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and other applicable industry standards.”
Outside assessors, consultants or testers
not identified
Experience of the security leadership, as stated
Stated
“Our CISO holds 11 industry security, risk, and/or privacy certifications and has served in various roles in information technology and information security for over 25 years, including serving as the Director, Global Security, Privacy & Data Governance for one of the world's largest privately held transport corporations.”
Material incident
not identified
The section
669 words, Form 10-K filed February 25, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 22, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns SPX Technologies, Inc. standard industrial classification 3540, Metalworkg machinery & equipment (SEC SIC list). One other filer in our library has the same code. Also shown: filers whose codes the SEC assigns to the same review office (Office of Technology).
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| NN, Inc.FY 2025, filed March 4, 2026 | Chief Financial Officer | not identified | Audit Committee of the Board of Directors |
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Tianci International, Inc.FY 2026, filed November 4, 2026 | Corporate Controller | CEO/CFO | Audit Committee |
| Brightline Interactive, Inc.FY 2026, filed September 28, 2026 | Chief Technology Officer | Chief Executive Officer | full board |
| ReposiTrak, Inc.FY 2026, filed September 28, 2026 | not identified | not identified | Audit Committee |
| DONALDSON Co IncFY 2026, filed September 25, 2026 | Chief Information Officer | not identified | audit committee |
| EGAIN CorpFY 2026, filed September 10, 2026 | Chief Information Security Officer | Chief Financial Officer | Audit Committee |
| Palo Alto NetworksFY 2026, filed September 10, 2026 | chief information security officer | not identified | Security Committee |
| Twin Disc IncFY 2026, filed September 4, 2026 | not identified | not identified | Audit Committee of the Board of Directors |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of SPX Technologies, Inc.'s Form 10-K as filed with the SEC on February 25, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. Cybersecurity
All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. We understand the importance of securing our data and information technology systems and networks, as well as the data customers and other stakeholders entrust to us. We have established policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which are integrated into our overall risk management program and based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and other applicable industry standards. Despite this, there can be no guarantee that our policies and procedures will be effective. Refer to " Risk Factors " for additional detail about the material cybersecurity risks that could affect our business strategy, results of operations, or financial condition, including under the heading "If we are unable to protect our information systems and networks against data corruption, cyber-based attacks or network security breaches, our operations could be disrupted". Our cybersecurity program includes the following:
Collaboration, Education, Incident Response and Recovery Planning
Our key security, risk, and compliance personnel meet regularly and, together with our cybersecurity consultants, develop strategies for preserving the confidentiality, integrity and availability of data and our information technology systems and networks. We have established incident response and recovery plans to address potential cybersecurity incidents, including assessing the severity of a cyber incident, which are regularly evaluated for their effectiveness. Management maintains controls and procedures and periodically conducts tabletop exercises that are designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board of Directors (our "Board") in a timely manner. In addition, we regularly educate employees on the importance of maintaining the security of our information technology systems and networks and over handling and protecting customer and employee data, including through regular phishing awareness campaigns, security awareness communications, and recurring privacy and security training.
Risk Assessment and Technical Safeguards
On an ongoing basis, we assess cybersecurity risk, including the review of our policies, standards, processes and practices. These assessments include a variety of activities including third party security penetration testing and independent reviews of our information security control environment and operating effectiveness. The results of these assessment activities are presented to our Board, Audit Committee, and members of management. We regularly assess and deploy technical safeguards based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. In addition, our third-party technology service providers are contractually obligated to maintain cybersecurity controls and provide System and Organization Controls ("SOC") SOC 2 reports, ISO 27001 certifications or complete our security questionnaires at the time of onboarding. On a recurring basis, our material third-party service providers are required to update their responses to our security questionnaires or provide updated reports as noted above.
Board and Management Oversight
Our chief information officer ("CIO") and chief information security officer ("CISO") have primary responsibility for assessing and managing material cybersecurity risks. Quarterly cybersecurity updates are provided to executive leadership to review security key performance indicators, identify security risks, and assess the status of approved security enhancements, and risk mitigation strategies. Our CIO has served in various roles in information technology and information security for over 30 years, including serving as the CIO of three other companies. Our CIO holds an undergraduate degree in computer science. Our CISO holds 11 industry security, risk, and/or privacy certifications and has served in various roles in information technology and information security for over 25 years, including serving as the Director, Global Security, Privacy & Data Governance for one of the world's largest privately held transport corporations. Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. The Audit Committee receives regular cybersecurity risk reports from management and, at least annually, our Board receives reports from management, including our CIO and CISO about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities.
Earlier filings on record
Fiscal 2024 Form 10-K, filed February 26, 2025 sec.gov ↗
Top security role, as the filing names it
chief information security officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our CISO holds 11 industry security, risk, and/or privacy certifications and has served in various roles in information technology and information security for 25 years, including serving as the Director, Global Security, Privacy & Data Governance for one of the world's largest privately held transport corporations.”
Material incident
not identified
Read by claude-sonnet-5-5 on October 22, 2026; every quote verified in the stored text by code.
ITEM 1C. Cybersecurity
All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. We understand the importance of securing our data and information technology systems and networks, as well as the data customers and other stakeholders entrust to us. We have established policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which are integrated into our overall risk management program and based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and other applicable industry standards. Despite this, there can be no guarantee that our policies and procedures will be effective. Refer to " Risk Factors " for additional detail about the material cybersecurity risks we face. Our cybersecurity program includes the following:
Collaboration, Education, Incident Response and Recovery Planning
Our key security, risk, and compliance personnel meet regularly and, together with our cybersecurity consultants, develop strategies for preserving the confidentiality, integrity and availability of data and our information technology systems and networks. We have established incident response and recovery plans to address potential cybersecurity incidents, including assessing the severity of a cyber incident, which are regularly evaluated for their effectiveness. Management maintains controls and procedures and periodically conducts tabletop exercises that are designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board of Directors (our "Board") in a timely manner. In addition, we regularly educate employees on the importance of maintaining the security of our information technology systems and networks and over handling and protecting customer and employee data, including through regular phishing awareness campaigns, security awareness communications, and recurring privacy and security training.
Risk Assessment and Technical Safeguards
On an ongoing basis, we assess cybersecurity risk, including the review of our policies, standards, processes and practices. These assessments include a variety of activities including third party security penetration testing and independent reviews of our information security control environment and operating effectiveness. The results of these assessment activities are presented to our Board, Audit Committee, and members of management. We regularly assess and deploy technical safeguards based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. In addition, our third-party technology service providers are contractually obligated to maintain cybersecurity controls and complete our security questionnaires at the time of onboarding. On a recurring basis, our third-party service providers are required to update their responses to our security questionnaires and, where available, additional information such as System and Organization Controls ("SOC") SOC 1 or SOC 2 reports are provided.
Board and Management Oversight
Our chief information officer ("CIO") and chief information security officer ("CISO") have primary responsibility for assessing and managing material cybersecurity risks. Quarterly cybersecurity updates are provided to executive leadership to review security key performance indicators, identify security risks, and assess the status of approved security enhancements, and risk mitigation strategies. Our CIO has served in various roles in information technology and information security for over 30 years, including serving as the CIO of three other companies. Our CIO holds an undergraduate degree in computer science. Our CISO holds 11 industry security, risk, and/or privacy certifications and has served in various roles in information technology and information security for 25 years, including serving as the Director, Global Security, Privacy & Data Governance for one of the world's largest privately held transport corporations. Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. The Audit Committee receives regular cybersecurity risk reports from management and, at least annually, our Board receives reports from management, including our CIO and CISO about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities.
Fiscal 2023 Form 10-K, filed February 23, 2024 sec.gov ↗
Top security role, as the filing names it
chief information security officer
Reports to, as the filing names it
not identified
Board oversight
Audit Committee
“Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk.”
Person named in the filing
not identified
Experience, as stated
Stated
“Our CISO holds 11 industry security, risk, and/or privacy certifications and has served in various roles in information technology and information security for 25 years, including serving as the Director, Global Security, Privacy & Data Governance for one of the world's largest privately held transport corporations.”
Material incident
not identified
Read by claude-sonnet-5-5 on October 22, 2026; every quote verified in the stored text by code.
ITEM 1C. Cybersecurity
All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. We understand the importance of securing our data and information technology systems and networks, as well as the data customers and other stakeholders entrust to us. We have established policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which are integrated into our overall risk management program and based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and other applicable industry standards. Despite this, there can be no guarantee that our policies and procedures will be effective. Refer to "Risk Factors" for additional detail about the material cybersecurity risks we face. Our cybersecurity program includes the following:
Collaboration, Education, Incident Response and Recovery Planning
Our key security, risk, and compliance personnel meet regularly and, together with our cybersecurity consultants, develop strategies for preserving the confidentiality, integrity and availability of data and our information technology systems and networks. We have established incident response and recovery plans to address potential cybersecurity incidents which are regularly evaluated for their effectiveness. Management maintains controls and procedures and periodically conducts tabletop exercises that are designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board of Directors (our "Board") in a timely manner. In addition, we regularly educate employees on the importance of maintaining the security of our information technology systems and networks and over handling and protecting customer and employee data, including through regular phishing awareness campaigns, security awareness communications, and recurring privacy and security training.
Risk Assessment and Technical Safeguards
On an ongoing basis, we assess cybersecurity risk, including the review of our policies, standards, processes and practices. These assessments include a variety of activities including third party security penetration testing and independent reviews of our information security control environment and operating effectiveness. The results of these assessment activities are presented to our Board, Audit Committee, and members of management. We regularly assess and deploy technical safeguards based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. In addition, our third-party technology service providers are contractually obligated to maintain cybersecurity controls and complete our security questionnaires at the time of onboarding. On a recurring basis, our third-party service providers are required to update their responses to our security questionnaires and, where available, additional information such as System and Organization Controls ("SOC") SOC 1 or SOC 2 reports are provided.
Board and Management Oversight
Our chief information officer ("CIO") and chief information security officer ("CISO") have primary responsibility for assessing and managing material cybersecurity risks. Quarterly cybersecurity updates are provided to executive leadership to review security key performance indicators, identify security risks, and assess the status of approved security enhancements, and risk mitigation strategies. Our CIO has served in various roles in information technology and information security for over 30 years, including serving as the CIO of three other companies. Our CIO holds an undergraduate degree in computer science. Our CISO holds 11 industry security, risk, and/or privacy certifications and has served in various roles in information technology and information security for 25 years, including serving as the Director, Global Security, Privacy & Data Governance for one of the world's largest privately held transport corporations. Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. The Audit Committee receives regular cybersecurity risk reports from management and, at least annually, our Board receives reports from management, including our CIO and CISO about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.