Item 1C Examples From Real 10-K Filings, Grouped by What They Disclose

TL;DR: Real Item 1C sections in 10-K filings disclose four things required by Regulation S-K Item 106: processes for managing material cyber risk, material effects of risks and past incidents, board oversight, and management's role and expertise. Filers such as BancPlus, Victory Capital, Duluth Holdings and Forte Biosciences answer in very different words. Some describe a chief information security officer. Others rely on a sponsor, a services agreement or outside consultants.

What SEC cybersecurity disclosures look like in a real 10-K

Item 1C is the cybersecurity section of the annual Form 10-K. The Securities and Exchange Commission (SEC) adopted the rule behind it on July 26, 2023. The content requirements sit in Regulation S-K Item 106, and companies have owed them beginning with annual reports for fiscal years ending on or after December 15, 2023.

In practice, Item 1C is a few pages of prose. It describes how a company handles cyber risk and who answers for it. It is not an incident report. Material incidents go to a separate Form 8-K item.

Two real openings

Filers open the section in different ways. A bank holding company starts with a statement of priority: "BancPlus recognizes the critical importance of assessing, identifying, and managing material risks from cybersecurity threats" (BancPlus 10-K).

An asset manager starts with a committee. Its Information Security Committee "oversees and implements a cybersecurity program that seeks to assess, identify and protect against cyber security threats" (Victory Capital 10-K).

We think the difference matters to a reader. One filing leads with intent and the other leads with structure. Both go on to cover the same required ground.

The four things filings disclose

The rule asks for four kinds of content. This guide groups its examples by them.

In that last row, CISO stands for Chief Information Security Officer.

Why the sections are easy to find now

The rule also requires these disclosures to be tagged in Inline eXtensible Business Reporting Language ("Inline XBRL"). Before the rule, cyber disclosures were sometimes included with other unrelated disclosures, which makes it more difficult for investors to locate, interpret, and analyze them.

The tagged text is a quick way to compare filings. You can see it in the EDGAR pages linked above. In our reading, the four-part structure is also the right lens for drafting your own section. Check each part against what your board and your auditors would recognize.

For the full rule, including the incident side, see our guide to SEC cybersecurity disclosure rules for CISOs. Filings we track are in /disclosures, and board structures are covered under board cybersecurity oversight.

What Item 1C has to cover under Regulation S-K Item 106

The earlier section set out what Item 106 asks a company to describe. This section covers the mechanics around it: when the rule took effect, how the tagging works, and how the annual Item 1C disclosure relates to incident reporting on Form 8-K.

Effective date and phase-in

The Securities and Exchange Commission (SEC) rule itself took effect on September 5, 2023. Compliance dates differ by form, so the effective date and the first filing date are two separate things.

Item 1C is the annual piece. The incident piece runs on its own clock. Form 8-K incident disclosures became due beginning the later of 90 days after Federal Register publication or December 18, 2023. Smaller reporting companies received an additional 180 days before the Form 8-K requirement applied to them.

Foreign private issuers follow a parallel track. They report risk management, strategy and governance on Form 20-F and material incidents on Form 6-K.

Inline XBRL tagging

The earlier section noted that the disclosures must be machine-readable. The timing came later than the text requirement. Registrants must tag in Inline eXtensible Business Reporting Language (Inline XBRL) beginning one year after initial compliance with the related disclosure requirement. In practice, a company's first Item 1C can appear untagged and a later one tagged. Anyone comparing filings across years should expect that difference.

How Item 1C connects to Form 8-K Item 1.05

Form 8-K Item 1.05 covers a single incident that a company has determined to be material. That filing is generally due four business days after the company makes that determination. Disclosure can be delayed if the United States Attorney General finds that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission in writing.

In our reading, the two items work as a pair. Item 1C describes the standing process each year. Item 1.05 records the moments when that process concluded an incident was material. Our materiality decision guide covers that determination in more detail.

A note on wording

The press release says registrants describe their processes, if any, for handling material cyber risk. We read that phrase as a disclosure requirement rather than a mandate to adopt a particular program. A reader can check how each filer frames its own program against that wording.

In a statement on the vote, Commissioner Mark T. Uyeda argued that the management disclosure amounts to disclosure equivalent to the resumes of the people and committee members involved. In our reading, that helps explain why many Item 1C sections list certifications and years of experience for named roles. See board cybersecurity oversight for the governance side.

How companies describe who runs security day to day

Item 106 asks for management's role and expertise, as the previous section set out. Filers answer in very different words. Four filings show the range, from a named security chief to a fund that points to its sponsor.

Victory Capital: a CISO with a committee

Victory Capital says its CISO and CTO oversee the day-to-day technology and security activities. The CISO chairs the Information Security Committee, whose members come from technology, legal and compliance. The filing also gives tenure: the CISO has been with the firm since 2013 and has over 20 years of IT experience.

In our reading, chairing a cross-functional committee gives the CISO a formal channel to peers outside technology, even though daily oversight is shared with the CTO.

Definitive Healthcare: a CTO and a virtual CISO

Here the CTO oversees the information security function alongside internal teams and third parties, including a virtual Chief Information Security Officer (vCISO). The CTO also approves budgets and cybersecurity processes.

We think that wording puts spending decisions with technology leadership. The virtual CISO appears as a service provider, not as a line executive.

Forte Biosciences: outside consultants

Forte names no security executive. Its information technology consultants help identify, assess and manage cyber risk. The Audit Committee receives updates from the Chief Financial Officer (CFO) and other senior leaders.

Our reading is that the board's line runs through finance, while the technical work is held outside the company.

Blackstone fund: reliance on a sponsor

The fund states that it is reliant on Blackstone for assessing, identifying and managing material cyber risk. Blackstone's CSO reports periodically to the fund's board or Audit Committee.

In our reading, the person who answers to this board works for a different entity than the one filing the report.

What to check in a peer's filing

Three questions sort most of these disclosures:

• Who chairs or leads the security function by name or title.
• Who approves the security budget.
• Who briefs the board or its committee.

In our reading, when the answers point to three different people, the reporting line is usually more layered than the title suggests. Our guide to CISO reporting lines in 10-K filings covers the patterns in more depth.

How companies describe board and committee oversight

Three filings show three ways a board can hold cyber risk. In our reading, the useful differences sit less in which committee holds the title and more in who sees the detail first and how often the full board hears about it.

Duluth: one committee with a formal charge

Duluth Holdings puts the duty in one place. Its audit committee "is formally charged with oversight of cybersecurity risk" (Duluth 10-K).

The briefing rhythm is layered. A quarterly cyber risk assessment, run by the information technology team and its vice president of information technology, goes to the audit committee (Duluth 10-K). Internal audit runs an annual risk assessment that covers cyber and technology risk, and the full board sees the results at a regular meeting (Duluth 10-K). The audit committee chair then reports significant cyber updates to the full board in executive sessions of its quarterly meetings (Duluth 10-K).

The filing also sets an escalation floor. Incidents with a moderate or higher business impact go to the audit committee even when they are immaterial to the company (Duluth 10-K).

Badger Meter: the full board, inside enterprise risk management

Badger Meter treats cyber as one part of a board-level enterprise risk management (ERM) program. The board oversees an enterprise-wide approach to risk (Badger Meter 10-K), and the filing calls cybersecurity "a critical component" of that program (Badger Meter 10-K).

The board receives annual updates from senior management. Its Audit and Compliance Committee adds an annual review of management's approach to cyber risk (Badger Meter 10-K). Both receive prompt information on any incident that meets set reporting thresholds (Badger Meter 10-K). Below the board, management meets monthly in a cybersecurity steering committee (Badger Meter 10-K).

BancPlus: a risk committee in a bank's framework

BancPlus routes oversight through the Risk Committee of its board. That committee oversees both the enterprise-wide risk framework and the cybersecurity program (BancPlus 10-K). It receives regular reports from the management Cybersecurity Committee covered in the previous section (BancPlus 10-K). Findings from external assessments go to management and the Risk Committee (BancPlus 10-K).

The full board reviews the program at least annually (BancPlus 10-K). As a regulated bank, its cyber practices are also subject to oversight by the federal banking agencies (BancPlus 10-K).

What to read for

We think the briefing path tells a reader more than the committee name. In any filing, check three things: which body sees material first, how often the full board is briefed, and who does the briefing. Some filings give a frequency for the committee but not for the board. In our reading, that leaves a gap a director may want to close.

For more on these structures, see board cybersecurity oversight and our board committee oversight report.

How companies describe the expertise of the people in charge

The rules require periodic disclosure of management's role in assessing and managing material cybersecurity risks. They also require the section to be tagged in Inline eXtensible Business Reporting Language (Inline XBRL). The tagging is useful for a reader. Victory Capital's filing places its people paragraph under a field labeled Cybersecurity Risk Management Expertise of Management Responsible, so you can see what a company itself counts as expertise.

Across the filings in this guide, expertise is described in one of three ways.

A role with credentials

Victory Capital ties expertise to its chief information security officer (CISO). The CISO holds a Certified Chief Information Security Officer credential from the Carnegie Mellon University executive education program, plus the Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP) certifications. The filing gives the chief technology officer (CTO) a separate line: the CTO joined in 2020 with 30 years of IT experience, including over 20 years at executive level in asset management. Neither person is named.

A function with titled staff

Definitive Healthcare, whose CTO-led structure was covered earlier, attaches experience to the staff below the CTO. Its processes are run by its Vice President of Information technology and Director of Information Security, each with over 20 years' experience managing large scale enterprise information technology and security systems. The CTO is responsible for hiring appropriate personnel. In that sentence, expertise is presented as something the CTO's hiring secures.

A contractor

Forte, which relies on outside consultants as noted earlier, describes what the consultants do and not who they are. They use methods such as malware scans and vulnerability testing. The filing gives no years of experience and no certifications.

Reading a filing that names no one

In our reading, a filing that names no individual still tells you something. It shows where the company thinks accountability rests, and whether it treats expertise as a hire, a team or a service it buys.

It does not tell you several things:

• whether the qualified person is still in post
• how much of their time goes to security
• what an outside firm is contracted to deliver

We think the practical check is a comparison over time. Read the same field in two consecutive 10-K filings on /disclosures, then check /moves for leadership changes in the period between them. If the credentials stay the same but the holder has changed, put a follow-up question to investor relations. A contractor-only description warrants a closer read of the third-party oversight language elsewhere in the section. For background on the role, see /glossary/ciso and /guides/ciso-tenure.

How companies describe third parties and shared services

Some registrants do not run their own security program. They borrow one from a parent, a sponsor or a contractor, and Item 1C then describes someone else's people and controls. The wording falls into three patterns.

A services agreement with a related company

Mink Therapeutics lists its controls, vendor-risk processes and continuity planning, then adds that some or all of this work is done through its services agreement with Agenus. The person in charge is not a Mink employee. Its team is led by Agenus' Chief Information Officer (CIO), who has over 20 years of experience in cybersecurity in regulated industries, and that same CIO provides Mink's Audit Committee and board periodic reports under the agreement.

A sponsor's program described on the fund's behalf

Blackstone Private Equity Strategies Fund states plainly that it is reliant on Blackstone for assessing, identifying and managing material risks. The rest of the section is, by its own account, detail that Blackstone has provided. The fund appears in Blackstone's vendor process as one of the companies sponsored by Blackstone. Its Audit Committee is charged with evaluating the adequacy of the Sponsor's IT security program, not only the fund's own.

Consultants, assessors and a virtual CISO

Forte Biosciences says its information technology consultants help identify, assess and manage its cyber risks, while the Audit Committee hears from the Chief Financial Officer. Definitive Healthcare names a virtual Chief Information Security Officer (vCISO) among the third parties overseeing its function. The glossary entry on the vCISO model covers how these arrangements usually work.

What the dependence tells an investor

In our reading, a borrowed program moves the risk rather than removing it. The registrant's security depends on a contract, a parent's budget or a sponsor's priorities, and none of those sit under its own board's direct control. The useful question is who can change the program, and the filing often answers it only by implication.

We think a reader should look for three things: whether the outside party reports to the registrant's board directly, whether any attestation covers the registrant or only the provider, and what the risk factors say about losing the arrangement. Filings that name the agreement and the reporting line give an investor something to track from year to year. Comparable language across issuers is searchable in our disclosures records.

Side by side, what each disclosure choice tells a reader

The bank pairs NIST with its examiners' guidance. In our reading, the software and data companies cite SOC 2 or ISO, the standards their customers ask for.

For more on committee choices, see board committee oversight. For the filings themselves, see disclosures.

How a sitting security leader can check their own Item 1C

This section is our own view of how to audit a filing you already own. The yardstick is the rule text. The Securities and Exchange Commission (SEC) rule took effect on a stated date: "Effective date: The amendments are effective September 5, 2023." Most leaders now have at least one Item 1C on file. Pull the last one, print it, and mark it up.

Six checks against the last filing

1. Read it against Item 106, line by line. The rule calls for periodic disclosures about a registrant's processes to assess, identify, and manage material cybersecurity risks, management's role, and the board's oversight. Mark each paragraph of your Item 1C with the element it answers. A paragraph that answers none is padding. An element with no paragraph is a gap.
2. Confirm the named role and reporting line. If the filing names a chief information security officer (CISO) reporting to the chief information officer, check that the org chart says the same today. Our guide on reporting structure covers the usual variants.
3. Check the committee charter wording. Open the charter of the committee the filing names. If Item 1C says the audit committee oversees cyber risk, the charter should say so in close to the same words. A mismatch is easy for an outside reader to spot. See board cybersecurity oversight.
4. List every third party the filing names. Write down each assessor, managed service, framework and certification mentioned. Then confirm each contract is live, each audit report is current, and nothing named has been replaced.
5. Line up the board briefing cadence. If the filing says the committee is briefed quarterly, pull the minutes and count the briefings that actually happened. A skipped quarter is a fact the filing then misstates.
6. Test the materiality sentence. In our reading, most filings include a line saying no incident has materially affected the company. Set that line next to your incident log and any Form 8-K filed for the year. The SEC also adopted rules to require current disclosure about material cybersecurity incidents, so the annual sentence and the current reports should tell one story. In our reading, consistency across your own filings is the part you control.

When to run it, and who signs

We think the CISO should own this review, with the general counsel's office and the disclosure committee as reviewers. Start it at least six weeks before the first 10-K draft circulates, so fixes to the charter, the org chart or the board calendar can land before the text is frozen. Record sign-off in the disclosure committee minutes, with the marked-up copy attached as the working paper.

This is a reading exercise, not legal advice. Counsel decides what goes in the filing. Compare your result with peers in our disclosures tracker.

What this guide does not cover

This guide does not cover the Form 8-K Item 1.05 materiality determination in depth, the Form 20-F and Form 6-K track for foreign private issuers, or the full text of the rule. It does not rank or recommend any vendor or consultant named in a filing. It describes what the rule and the filings say and is not legal advice. Counsel decides what goes in a filing. For the rules and the record behind it, see How Long Do CISOs Stay? Average CISO Tenure and What the Record Shows.