Learn · Explainer

Cybersecurity disclosures (Item 1C)

The 10-K section on cybersecurity risk management, strategy and board oversight, with Procter & Gamble, Johnson & Johnson, Coca-Cola, Starbucks and Microsoft.

The short answer

Item 1C of Form 10-K is the cybersecurity disclosure: how the company identifies and manages material risks from cybersecurity threats, and how the board and management oversee that work. The section was added to Regulation S-K (Item 106) and now appears in annual reports after the risk factors and unresolved staff comments. It describes the program and the oversight structure. It is not a score of how secure the company is, and it sits alongside, rather than instead of, the cybersecurity risk factor in Item 1A.

Where it sits in the 10-K

Form 10-K now has a dedicated Item 1C, Cybersecurity, in Part I. It follows Item 1A (risk factors) and Item 1B (unresolved staff comments). The item is meant to cover two things: risk management and strategy (how the company assesses, identifies and manages material cybersecurity risks, and whether those processes are integrated with its broader risk program) and governance (the board's oversight and management's role). If a cybersecurity incident was material, companies also have a current-report requirement on Form 8-K Item 1.05; the annual section is the standing description of the program.

Procter & Gamble's 10-K for the year ended June 30, 2026 opens the strategy discussion by saying the company employs multiple tools and processes for assessing, identifying and managing material risks from cybersecurity threats, and that a multi-functional enterprise security team reviews and assesses top cybersecurity risks. Johnson & Johnson's 10-K for the year ended December 28, 2025 says it has documented cybersecurity policies and standards, assesses risks from cybersecurity threats, and monitors information systems for potential cybersecurity issues.

Source: Procter & Gamble 10-K for fiscal 2026, filed Aug 4, 2026 · Johnson & Johnson 10-K for fiscal 2025, filed Feb 11, 2026

What companies typically describe

Coca-Cola's 2025 10-K describes a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cybersecurity and information security threats through its cybersecurity risk management program. Starbucks's 10-K for the year ended September 28, 2025 says it has implemented a cybersecurity program that leverages industry-standard cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, to assess, identify, and manage cybersecurity risk, and that the program is integrated with its enterprise risk management framework. Microsoft's 10-K for the year ended June 30, 2026 describes a Cybersecurity Governance Council charged with overseeing initiatives that safeguard its computing environments, products and services.

Source: Coca-Cola 10-K for fiscal 2025, filed Feb 20, 2026 · Starbucks 10-K for fiscal 2025, filed Nov 14, 2025 · Microsoft 10-K for fiscal 2026, filed Jul 29, 2026

The governance subsection usually names the board committee that hears cybersecurity updates (often the audit committee) and the management roles involved, such as a chief information security officer. The section may also say whether the company uses third-party assessors or has a process for risks arising from vendors. Details of specific defenses are often kept general, which is expected: the requirement is to describe the program, not to publish a map of it.

Item 1A still carries the cybersecurity risk factor, which is about what could go wrong. Item 1C is about how the company organizes its response to that risk. Reading both, together with any Item 1.05 8-K filed during the year, is the usual way through the filings. Risk factors and How to read a 10-K place the item in the rest of the report.

Common questions

What is Item 1C?

A section of Form 10-K, added under Regulation S-K Item 106, in which the company describes its cybersecurity risk management and strategy and the board's and management's oversight of cybersecurity risk.

Is this the same as the cybersecurity risk factor?

No. The risk factor in Item 1A describes the threat and its possible effects. Item 1C describes the program and the oversight structure. Most large-company 10-Ks now include both.

Do companies have to disclose every incident?

Material incidents have a current-report path on Form 8-K Item 1.05. Item 1C is the annual description of the program. The annual section may discuss incidents when they were material, but it is not a log of every event.

Where does board oversight usually appear?

In the governance part of Item 1C. Companies often name the audit committee or another board committee, the cadence of updates, and management roles such as a chief information security officer. Microsoft describes a Cybersecurity Governance Council in its 10-K.

Why is the language often general?

The rule asks for a description of processes and oversight, not a technical inventory. Companies also avoid publishing information that would help an attacker. The useful reading is whether a program, a reporting line and board oversight are described, and whether any material incident was filed during the year.

Disclosures

Editor holdings: The editor holds no position in any company named on this page. As of Nov 11, 2026.
Compensation: Nobody paid for this page. No affiliate links on this page.
Sources: Each company's own SEC filings, linked next to each number.
Last updated: Nov 10, 2026

General education, the same for every reader. Not a recommendation to buy, sell or hold any security, and it doesn't consider your situation.

More in Learn and Tools · Methodology & Disclosures explains where every number comes from.