Percentage of 10-Ks that mention a CISO

52% (194 out of 373) of companies disclosing “Item 1C. Cybersecurity” in their 10-K specifically mention a Chief Security or Chief Information Security Officer role. For details on the data and analysis, see the data section at the end for additional details.

Graph showing only 39% of companies mention a CISO in their 10-K Item 1C

You can see the full list of the 10-Ks in the 10-K Cybersecurity Tracker.

Percentage by filer category

It’s helpful to look at how the size of the company (using the filer category as proxy) affected mentioning a CISO. The filer categories are (from largest):

Graph of CISO by filer category

So the good news is large accelerated filers do slightly better than the 52% average across the data set.

Percentage by SIC Division

While Standard Industrial Classification (SIC) Codes were deprecated for NAICS, the SEC still uses it to indicate a company’s type of business. The broadest SIC classification is called a division (read more on Wikipedia) and this analysis groups filers according to those SIC ranges.

Graph of CISO by SIC divisions

At first, “Agriculture, Forestry and Fishing” really standout out but there was only 1 filing so we don’t have enough data yet (but hats off to Corteva for setting the bar!). For Mining companies, there were 11 filings but none indicated a CISO or related executive.

Data

Here are some details on the data:

I excluded 1C items with less than 100 characters as companies with annual reports for fiscal years ending before December 15, 2023 were not required to populated the Item 1C section and state something along the lines of “Not Applicable” (e.g. Apple Inc 10-K).

Also, while I believe this data to be accurate, parsing SEC filings is challenging so there may be slight inconsistencies, notably if we were unable to extract the Item 1C section with automation. Additional, the analysis has not yet been reviewed by another researcher.

If you are a researcher or potential contributor and would like access to the raw data, please use the contact us form or connect and send me a message on LinkedIn.

Page last updated on February 22, 2024