Does the CISO Report to the CIO? What 22 SEC 10-K Filings Actually Say

TL;DR: Every U.S. public company has to describe its cybersecurity governance once a year, in Item 1C of its Form 10-K. CISO Tribune fetched the most recent Item 1C disclosure from 22 companies this week and read what each one actually says about its CISO. Only one, Meta, named its CISO, and that filing was already stale by the time the person left the job. Three filings state a specific reporting line, and the three do not agree with each other. Two large companies disclose more than one CISO. Two disclose no security-officer title at all. The rule sets a floor on what a company must say about cybersecurity governance; it does not require the company to say who runs it.

The question this answers

A 10-K is a primary source: a company's own, legally binding statement about itself, filed with the SEC under penalty of civil liability for getting it wrong. That makes Item 1C, the annual cybersecurity governance section required since fiscal year 2023, look like an obvious place to verify who holds a company's top security seat. It mostly is not, and the gap between what the rule requires and what a reader might assume it requires is the actual finding here.

Methodology

CISO Tribune built a keyless SEC EDGAR research tool this week that looks up each company's CIK from the SEC's own public ticker file, searches the EDGAR full-text search API for "Chief Information Security Officer" and "Chief Security Officer" within that company's Form 10-K filings, and fetches the most recent match. The 22 companies are drawn mostly from CISO Tribune's own roster-verification queue (large, well-known public companies whose current CISO is not yet sourced on our roster) plus a handful of additional large, well-known companies added for contrast. This is not a random sample and not a full S&P 500 census; it is a first read of a genuinely new, keyless source, with the actual filing text behind every claim below. A broader pass across more companies is the obvious next step, and CISO Tribune's growth backlog already lists it.

Two search-tool limitations surfaced while reading these filings, both worth naming so the counts below are read correctly. First, EDGAR's full-text search matches an exact phrase, so a plural-only mention, "Chief Information Security Officers," as Comcast's filing uses throughout, does not match a singular-phrase query; Comcast's disclosure was found only by reading the filing directly after the phrase search came back empty. Second, a company can satisfy Item 1C without using either phrase at all, describing cybersecurity governance entirely through teams and committees, which is exactly what two of the 22 filings below do.

Finding one: naming the person is rare, and the one example went stale fast

Of 22 Item 1C disclosures read for this piece, exactly one names the sitting CISO: Meta's Form 10-K, filed January 29, 2026, says "Meta's Chief Information Security Officer (CISO), Guy Rosen, leads our cybersecurity program." That sentence was accurate when filed. Rosen announced his departure from Meta in June 2026, and Meta named Assaf Keren as his successor in July 2026, both moves CISO Tribune's Wire recorded as they happened. A reader pulling Meta's 10-K today without checking its filing date would be citing a person who no longer holds the job. The lesson generalizes beyond Meta: a 10-K is filed once a year, on a schedule driven by the fiscal calendar, not by personnel changes, so even the rare filing that names a name carries an expiration date the filing itself never states.

Finding two: reporting lines are stated rarely, and inconsistently when they are

The conventional wisdom, covered in CISO Tribune's guide to what a CISO does, is that the CISO traditionally reported to the CIO, and increasingly does not. These 22 filings mostly do not settle the question either way, because most do not say. Three do:

• Chevron: "Chevron's Chief Information Security Officer (CISO) reports to the CIO."
• Humana: "Our Chief Information Security Officer reports to our Chief Information Officer."
• Nvidia: the filing states Nvidia has "designated a Chief Security Officer, reporting to our Senior Vice President of Software Engineering," a title that is neither CIO nor CISO, and a reporting line that runs through engineering rather than IT.

A fourth, Costco, describes its CISO as part of the Chief Information and Digital Officer's "executive team," which reads as a reporting relationship without using the words "reports to." The remaining 18 filings mention a CISO's existence, scope and sometimes tenure without stating a reporting line at all, which means a claim like "most CISOs report to the CIO" cannot be verified from these filings themselves, however common it may be in practice or in survey data from firms that ask the question directly.

Finding three: some large companies disclose more than one CISO

Two of the 22 companies do not have a single, company-wide CISO to report a line for in the first place. Berkshire Hathaway's filing describes cybersecurity governance at the level of its individual Business Groups: "Each Business Group's Chief Information Security Officer ('CISO') on at least an annual basis is to provide a report to the Business Group's senior management." Comcast's filing is explicit that it has more than one: "our primary businesses' Chief Information Security Officers ('CISOs')," naming a dedicated CISO for its Connectivity & Platforms business and another for its Content & Experiences business. Both are large, decentralized companies whose separately run operating businesses each warrant their own security leadership, which is exactly the kind of structure that makes "who is the CISO of Comcast" an unanswerable question as asked, and part of why some entries on CISO Tribune's own roster are marked unknown rather than forced into a single name.

Finding four: two filings name no security-officer title at all

Tesla's Item 1C disclosure describes incident response as overseen by "leaders from our Information Security, Product Security, Compliance and Legal teams," never naming a Chief Information Security Officer or Chief Security Officer. Valero Energy's disclosure goes further into committee structure, an "Infosec Committee," an "Infosec Oversight Committee" and an "Executive Steering Committee," run by "the heads of our information services and internal audit teams," again with no officer title anywhere in the section. Item 106 requires a description of risk management processes and oversight; it does not require that description to center on a named role, and these two filings show a company can comply without one.

What the 22 filings say, company by company

What this means if you are trying to verify a CISO

A 10-K is still a genuine primary source, strong enough to confirm that a named person held a title as of a specific filing date, which is exactly how this piece caught Meta's filing going stale. It is a poor tool for finding out who holds a job today, since it updates once a year on the company's fiscal calendar rather than when the job changes hands, and most companies do not name the person in it at all. It is a reasonably good tool for a narrower, better question: what does the company say, in a legally binding filing, about how it governs cybersecurity and who is accountable to the board for it. That distinction, between confirming a structure and confirming a name, is the one this sample keeps landing on.

What this guide does not cover

This is a snapshot of 22 companies' most recent Form 10-K filings as read this week, not a complete or statistically representative survey of the S&P 500, and not an update every time one of these 22 companies changes CISOs or refiles. CISO Tribune's guide to the SEC's cybersecurity disclosure rules covers what Item 1C and Item 1.05 require in full; this piece is about what companies actually wrote once those rules applied to them.