Computed report · from SEC 10-K filings
Who does the top security role report to?
Item 1C of a Form 10-K asks a company to describe management's role in cybersecurity. Some filings say who the top security role reports to; most do not. This report counts what the filings on our record state, overall and by sector, one filing per company, its latest. Every group shows its n; a group under 5 filings shows no breakdown.
Basis: 19 filers with Item 1C on record, 19 read · computed October 14, 2026 · free to cite with attribution
Filers on record
19
State a reporting line
9
47% of filers
Most stated line
4
Another executive
Sectors with 5 or more
1
All filers
All filers on record
Chief Information Officer 2 · Chief Technology Officer 1 · Chief Financial Officer 1 · General Counsel or Chief Legal Officer 1 · Another executive 4
n = 19 · 9 state a line
By sector
Technology
Chief Technology Officer 1 · Chief Financial Officer 1 · General Counsel or Chief Legal Officer 1 · Another executive 1
n = 6 · 4 state a line
Financial Services
too few to report (fewer than 5)
n = 4 · 3 state a line
Healthcare
too few to report (fewer than 5)
n = 2 · 1 state a line
Professional Services
too few to report (fewer than 5)
n = 2 · 0 state a line
Cybersecurity Vendors
too few to report (fewer than 5)
n = 1 · 0 state a line
Retail & Consumer
too few to report (fewer than 5)
n = 1 · 0 state a line
Not yet classified by sector
too few to report (fewer than 5)
n = 3 · 1 state a line
Filers not yet on our seat record have no sector in our classification; they are counted here and in "All filers".
Method
What counts. One filing per company: its latest Form 10-K or 10-K/A with an Item 1C on record (the disclosure library). A filing "states a line" when its Item 1C contains a sentence saying who the top security role reports to, quoted word for word and verified in the stored text by code. The line is sorted into a category by the words of that phrase alone (a "Chief Information Officer" is the CIO row; a "Senior Vice President of Software Engineering" is "another executive").
What does not count. A filing that describes the role without naming a reporting line adds to n and to nothing else; we never infer a line from an org chart or a press release. Sectors come from our own classification of companies on the seat record (content/company-meta.json); a filer we have not classified is counted apart. Groups under 5 filings show their n only.
Limits. The record grows daily and is not a sample of all filers: companies on our seat record are read first, then the largest filers by market value. Read by software, verified by code; corrections through /corrections. For what 22 filings said when we first read them by hand, see the guide. Cite as "CISO Tribune, CISO reporting lines from SEC 10-K filings" with a link.