The Uptime report

Uptime Report Research · Corporate Disclosure Study

Item 1C Cybersecurity Disclosures: What a Random Sample of 600 10-K Filings Says About Who Oversees Cyber Risk

Item 1C cybersecurity disclosures are the first standardized, mandatory account of how US public companies run cyber risk. We drew a random sample of 600 from all 6,690 Form 10-K filings submitted to the SEC in calendar 2025, extracted each Item 1C section, and coded it for governance, staffing, outside help, and frameworks. Small companies look very different from large ones.

Version 1.0 · Published October 19, 2026 · Data as of SEC EDGAR filings of calendar 2025

Key findings

  1. 27% of companies’ Item 1C disclosures name a Chief Information Security Officer (95% CI 23 to 31): 47% of large accelerated filers but 12% of non-accelerated filers.
  2. The audit committee is the most common board overseer of cyber risk, named in 50% of disclosures; dedicated technology or cybersecurity committees appear in 4%.
  3. 90% say they use outside assessors, consultants, or auditors, while 9% explicitly mention a managed service provider, MSSP, MDR service, or outsourced IT or security function; because disclosures often describe outside help in general terms, treat that figure as a lower bound.
  4. 36% cite at least one security framework; NIST appears in 29% and ISO 27001 in 8%.
  5. 75% state that no cybersecurity incident has materially affected the company.
  6. Of 509 operating companies sampled, 11 (2.2%) filed a 10-K with no Item 1C content or marked it not applicable; 10 of them tag themselves as non-accelerated filers and 1 does not tag a filer status. 91 of the 600 sampled filings were asset-backed trusts, which are exempt.
6,69010-K filings in 2025
600random sample
91asset-backed trusts (exempt)
509operating companies
498with an Item 1C disclosure

What companies disclose

Share of the 498 disclosures with each feature, with 95% confidence intervals, and the split between large accelerated filers (n = 189) and non-accelerated filers (n = 250). The p value tests the difference between those two groups.

Feature Estimate and 95% CI All Large Small p
Names a Chief Information Security Officer
27% (23 to 31) 47% 12% <0.001
States which board body oversees cyber risk
86% (83 to 89) 92% 80% <0.001
Audit committee oversees cyber risk
50% (45 to 54) 60% 42% <0.001
Full board (no committee) oversees
27% (23 to 31) 19% 33% 0.001
Risk committee oversees
9% (6 to 11) 14% 4% <0.001
Technology or cybersecurity committee oversees
4% (2 to 6) 6% 2% 0.030
Board or committee briefed at least quarterly
26% (22 to 30) 40% 12% <0.001
Uses outside assessors, consultants, or auditors
90% (87 to 93) 97% 84% <0.001
Mentions penetration testing
36% (32 to 41) 50% 23% <0.001
Mentions tabletop exercises
21% (17 to 24) 36% 9% <0.001
Mentions cyber insurance
16% (13 to 20) 20% 12% 0.034
Mentions phishing simulations
14% (11 to 17) 20% 9% 0.001
Explicitly mentions an MSP, MSSP, MDR, or outsourced IT or security (lower bound)
9% (6 to 11) 7% 10% 0.318
States no incident has materially affected it
75% (71 to 79) 78% 72% 0.153

Reporting lines and frameworks

Who the CISO reports to (where stated, n = 27)

  • Chief Information Officer9
  • Chief Operating Officer6
  • Chief Executive Officer4
  • Chief Risk Officer3
  • Chief Financial Officer2
  • Chief Administrative Officer2
  • Chief Technology Officer1

108 of the 135 disclosures naming a CISO do not state a reporting line in a form we could code.

Frameworks cited (share of all disclosures)

  • NIST29%
  • ISO 270018%
  • CIS Controls5%
  • SOC 24%
  • PCI DSS4%
  • HITRUST1%
  • COBIT0%

Where security leaders’ qualifications are described, the most cited certifications are CISSP (38), CISM (18), CISA (15), CRISC (9), and the median of the highest years-of-experience figure stated in each disclosure is 25 years (n = 128 disclosures stating one).

What this means for MSPs and MSSPs

Only 12% of non-accelerated filers name a CISO, while 84% say they use outside assessors, consultants, or auditors. That gap is where virtual CISO, managed detection, and compliance services fit, and Item 1C gives providers a public record of how each prospect describes its own program.

Frequently asked questions

What is Item 1C in a 10-K?

Item 1C, Cybersecurity, is the 10-K section required by Item 106 of SEC Regulation S-K since fiscal years ending on or after December 15, 2023. Companies must describe their processes for assessing and managing cybersecurity risk, the board’s oversight, and management’s role and expertise.

How many companies have a CISO?

In our random sample of 498 2025 Item 1C disclosures, 27% name a Chief Information Security Officer. Among large accelerated filers the share is 47%.

Who does the CISO report to?

Where the disclosure states it (n = 27), the most common reporting line is to the Chief Information Officer (9 of 27). Most disclosures that name a CISO do not state a reporting line.

Which board committee oversees cybersecurity?

The audit committee in 50% of disclosures, the full board without a named committee in 27%, a risk committee in 9%, and a technology or cybersecurity committee in 4%.

Do public companies use MSSPs?

At least 9% of Item 1C disclosures explicitly mention a managed service provider, MSSP, managed detection and response service, or outsourced IT or security function, and 90% mention outside firms of any kind. Many disclosures describe outside help without naming its type, so the first figure is a lower bound.

Download the data. item-1c-cybersecurity-disclosures-sample-2025.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.
Data dictionary (10 fields)
accession SEC accession number of the 10-K
company / cik Registrant name and Central Index Key
filed EDGAR filing date
sic / sic_description Standard Industrial Classification from SEC submissions data
filer_category dei:EntityFilerCategory from the inline XBRL cover page
status disclosed, omitted, not applicable, or exempt (asset-backed issuer)
words Words in the extracted Item 1C section
feature columns 1 if the coded feature appears in the section; see Methodology for rules
ciso_reports_to Executive the CISO reports to, where stated
frameworks Security frameworks named

Methodology

Population and sample. All filings of form type 10-K (excluding amendments) in the EDGAR full-text indexes for 2025 Q1 to Q4, 6,690 filings. Simple random sample of 600 (Python random.seed(42)). For each, SEC submissions data supplied the primary document, SIC code, and business address; the primary document was downloaded from EDGAR. Retrieved 2026-10-19.

Extraction. The Item 1C section is the shortest span (at least 80 words) from an “Item 1C Cybersecurity” heading to the next “Item 2 Properties”, “Item 1D”, or “Item 3 Legal Proceedings” heading, which excludes table-of-contents lines and cross-references in risk factors. Two filings using a cross-reference index were captured from the “Cybersecurity Risk Management and Strategy” heading. Asset-backed issuers (SIC 6189) are exempt from Item 106 and were excluded from feature estimates.

Coding. Features were coded with fixed regular expressions. Board oversight body is read only from sentences mentioning the board and oversight or responsibility; committee names are matched against a fixed vocabulary (for example Audit, Audit and Risk, Risk and Compliance, Technology and Cybersecurity), and full board means the board is named without a committee or the text says oversight is not delegated. Briefing frequency is read only from sentences about reports to the board or a committee. In a manual check of 20 randomly selected disclosures, the board-oversight code matched the text in 19 (the 20th could not be resolved from the extracted section), and the no-material-incident code matched in all 20 after we corrected one pattern the check exposed.

Statistics. 95% Wilson confidence intervals; Fisher’s exact test for large accelerated versus non-accelerated filers. Estimates describe 2025 10-K filers, weighted equally, not market capitalization.

Limitations. Text coding measures what companies say, not what they do. Absence of a mention is not evidence a practice is absent. Disclosures written in unusual layouts may be partly missed.

Not advice. This is an analysis of public filings, not legal or investment advice.

Cite as:The Uptime Report. "Item 1C Cybersecurity Disclosures: What a Random Sample of 600 10-K Filings Says About Who Oversees Cyber Risk." October 2026. https://theuptimereport.com/item-1c-cybersecurity-disclosures/

References

  1. SEC, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Release No. 33-11216.
  2. 17 CFR 229.106 (Item 106) Cybersecurity.
  3. SEC EDGAR full-text indexes. Accessed October 19, 2026.

Research library

More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

Threats and breaches

Infrastructure and uptime

Regulation and disclosure

Workforce and pay

MSP market and spending

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts