Skip to content
CISO Spotlights

Reporting-line record

Who does the security function report to?

Every public company's 10-K now includes an Item 1C disclosure describing its cybersecurity risk management and, often, who the security function reports to. This record states that line exactly as each filing describes it, one company at a time, built as this site reads filings rather than pulled from a feed. It carries no view on which structure is better; a reporting line is a structural fact, not a mark of quality.

7 companies on record so far, from this site's own reading of each filing's own words — a growing record, not a survey or a census of all public companies.

  1. BK Technologies CorporationBKTI10-K filed 12 March 2026BK Technologies' 2025 Form 10-K describes its cybersecurity program as run by the CISO and CFO together, with a reporting line to the CEO.
  2. Cytokinetics, IncorporatedCYTK10-K filed 26 February 2026Cytokinetics' 2025 Form 10-K states its Chief Information Security Officer, CEO and CFO together brief the Audit Committee on cybersecurity risk.
  3. Heritage Commerce CorpHTBK10-K filed 9 March 2026Heritage Commerce Corp's 2025 Form 10-K says its CISO reports directly to the COO and regularly to the Board's Audit Committee.
  4. Leonardo DRS, Inc.DRS10-K filed 27 February 2026Leonardo DRS's 2025 Form 10-K states its Chief Information Security Officer regularly briefs the Board's Government Security Committee.
  5. Powell Industries, Inc.POWL10-K filed 19 November 2025Powell Industries' 2025 Form 10-K states its Chief Information Security Officer reports to the Chief Financial Officer.
  6. Urban Outfitters, Inc.URBN10-K filed 1 April 2026Urban Outfitters' fiscal 2026 Form 10-K states its Chief Information Security Officer reports to the Audit Committee at least annually.
  7. Veeco Instruments Inc.VECO10-K filed 25 February 2026Veeco Instruments' 2025 Form 10-K states its Chief Information Security Officer updates the Audit Committee quarterly and the full Board annually.