How public companies disclose their CISO and security governance to investors

Three documents, three different questions

Investor-facing material about security comes in several forms, and each one answers a different question. This guide reads three of them:

• A 2024 annual report shows where security sits among everything else a company tells shareholders.
• An investor-relations security page lays out the governance chain: who holds the CISO title, which board body oversees the work, and how often each layer reports.
• A Form 8-K records the terms of one CISO appointment.

The first two documents come from TSMC. The third is a current report filed by Avant Technologies. Read together, they show how much detail each format carries, and what each one leaves out.

What the annual report puts first

An annual report covers the whole company, so security competes for space with revenue, capacity and strategy. The TSMC report's shareholder letter, signed by C.C. Wei as Chairman and Chief Executive Officer, opens with the year's financial results. It reports that TSMC's revenue increased 30% year-over-year in US dollar terms.

The letter's attention stays on technology nodes, overseas fabs and customer demand. For a reader looking for the security leader, this part of the report gives context but not the reporting line. The governance detail sits on a separate page of the company's investor site.

Where the security page sits, and what it opens with

Placement on an investor site shows how a company files the subject. TSMC places its information security page under Corporate Governance and then Risk Management in its investor navigation.

That placement treats security as a governance and risk topic rather than a product or operations topic. The page opens by stating that the company has a named security executive and a dedicated team. It says TSMC assigned a Chief Information Security Officer and set up a dedicated information security organization.

The reporting chain from CISO to board

The most useful part of the page for anyone studying the CISO role is how it traces responsibility upward. It assigns board-level oversight to a specific committee. The page states that TSMC's Board of Directors authorized the Audit and Risk Committee to supervise and manage corporate information security.

The page also speaks to the committee chair's expertise. It names Sir Peter Bonfield as chairman of that committee and says he has a background in information security.

The CISO is identified by name and by title. The page says TSMC assigned Cliff Hou, Senior Vice President and Deputy Co-COO of the Co-COO Office, as CISO, leading the Global Security Management (GSM) organization. At this company, then, the CISO title is held by an executive who also carries an operating title. Readers comparing CISO profiles across companies will find that detail on the investor page, not in the security section of a careers or press site.

The page gives the reporting interval to the board committee. It says that every six months the GSM organization's executives report risk management measures to the Audit and Risk Committee.

The chain then continues to the full board. According to the page, the committee chairman reports on the effectiveness of information security supervision and risk control measures to the Board of Directors.

Put together, these statements give a traceable line:

1. The security organization reports to the CISO.
2. The CISO's organization reports to a named board committee on a stated schedule.
3. The committee chair reports to the full board.

Committees and meeting rhythm below the board

Beneath the board, the page describes two management committees, both chaired by the CISO. The first is cross-functional. The page lists the members of the PIP (Proprietary Information Protection) & Risk Committee as the vice presidents of Legal, Human Resources, R&D and Operations, plus GSM's most senior supervisor.

That committee works on a quarterly cycle. The page says it reviews guidelines and policies each quarter against information security goals.

The second committee, the IT Security Committee, draws on the information technology leadership and meets more often. The page says it holds monthly meetings to review information security policies and assess information security risks.

The result is three layers on three schedules: monthly within IT, quarterly across business functions, and every six months to the board committee. The page's own wording ties each layer to a named chair, so a reader can see who is accountable at each level.

Certifications and incident handling

The security page also states the external standards the company holds itself to. It reports a long-running certification history. The page says TSMC has held ISO 27001 certification since 2008 and has kept it continuously.

On incidents, the page describes procedures that link security events to business consequences. The page says the incident notification procedures assign specific personnel to handle major incidents, evaluate losses, and assess the possible impact on finances and operations.

For an investor audience, that link between an incident and its financial and operating impact is the point of the disclosure. It is also the language that connects the security function to the risk management heading under which the page sits.

What an 8-K adds: one appointment, in detail

A Form 8-K is narrower than either TSMC document. It reports a specific event, and in this case the event is a CISO hire. The Avant Technologies filing reports the hire under the item for officer appointments and compensatory arrangements.

The filing gives the date of the agreement in its body. It says that on July 27, 2023, the company and Danny Rittman entered into an employment agreement that retained him as CISO.

The exhibit list, however, carries a different date. It describes the employment agreement between the company and Rittman as dated July 24, 2023. A reader citing the hire date should note that the filing contains both dates.

The filing is most specific on pay, which is detail an investor-relations page does not usually carry. It sets an annual base salary of $300,000, paid in company stock rather than cash.

That figure is tied to a future corporate event. The filing says the salary rises to $600,000 if the company moves its listing up to a national exchange.

The 8-K also supplies a career history, which is the raw material for a CISO profile. It says that from 2014 to the time of filing, Rittman served as Chief Technology Officer and a director of GBT Technologies.

The filing lists his security education separately from his earlier engineering degrees. It says he completed a master's degree in information and cybersecurity, naming the school as Berkeley University.

Reading the formats side by side

Each format answers a different question about a company's security leadership:

• The annual report shows how much weight security carries in the company's overall account of itself.
• The investor-relations security page shows structure: the named CISO, the named board committee and chair, the management committees and their schedules, the certifications and the incident procedure.
• The 8-K shows a single appointment: the date, the compensation and the career path behind the hire.

None of the three formats covers everything. The TSMC page names its CISO and maps the reporting chain, but it says nothing about pay. The Avant filing sets out pay and background, but it does not describe a board committee or a reporting schedule for security.

Someone building a full picture of a security leader's position therefore has to combine formats. That means reading the governance page for structure and a filing for the terms of the appointment, and noting where the documents differ, as they do on the Avant agreement date.