Cybersecurity Risk Management and Strategy Disclosure |
12 Months Ended |
|---|---|
Dec. 31, 2025 | |
| Cybersecurity Risk Management, Strategy, and Governance [Line Items] | |
| Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Cycurion has established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats. Cycurion has designed and implemented cybersecurity policies and procedures intended to protect its information systems and sensitive information assets. These policies encompass information systems that are owned, operated, maintained, or controlled by Cycurion, as well as external systems and service providers that interact with Company systems. Cycurion’s cybersecurity program includes safeguards designed to protect sensitive information, including Controlled Unclassified Information ("CUI"), where applicable. Our cybersecurity program is a collaborative effort requiring the participation of management, employees, contractors, vendors, and other relevant third parties. Personnel with access to Company systems are responsible for complying with Cycurion's information security policies and for reporting suspected security incidents or vulnerabilities. Cycurion maintains a cybersecurity program designed to align with recognized industry standards and cybersecurity frameworks, including the National Institute of Standards and Technology ("NIST") cybersecurity guidance and of the CMMC framework established by the U.S. Department of Defense for the protection of CUI. Cycurion's cybersecurity policies, procedures, and operational safeguards incorporate security control objectives consistent with NIST and CMMC practices designed to protect sensitive information processed, stored, or transmitted within Company systems. As part of its cybersecurity risk management processes, Cycurion performs periodic cybersecurity risk assessments designed to identify potential threats, vulnerabilities, and risks affecting the confidentiality, integrity, and availability of Company systems and data. Identified risks are evaluated and prioritized based on potential operational and financial impact and are addressed through remediation plans, technical safeguards, or operational controls. Cycurion maintains a vulnerability management program designed to help identify and remediate security weaknesses within its systems and infrastructure. The Company conducts periodic vulnerability scans and security assessments and remediation activities are prioritized based on the severity of the issue and the potential impact to operations of information security. Cycurion also employs continuous monitoring capabilities intended to detect and evaluate potential cybersecurity threats in a timely manner. These monitoring activities may include log monitoring, endpoint detection tools, vulnerability scanning, and the analysis of security events by designated security personnel. To help protect endpoint devices, Cycurion uses endpoint protection technologies designed to detect, prevent, and respond to malicious activity. These tools provide monitoring and alerting capabilities that assist security personnel in identifying and responding to potential cybersecurity incidents. Cycurion has implemented a formal Change Control Board ("CCB") process to review and approve system changes that could affect the security of Company systems. Proposed changes are evaluated by designated personnel prior to implementation to assess potential cybersecurity risks and to help ensure that appropriate safeguards remain in place. The Company also maintains a cybersecurity awareness and training program designed to educate employees and contractors about cybersecurity risks and their responsibilities in protecting Company systems and information. Training topics may include phishing awareness, password security, data protection practices, and incident reporting procedures. In addition, Cycurion may conduct periodic simulated phishing exercises to reinforce awareness and promote secure behavior. Cycurion considers cybersecurity risks associated with third-party vendors, service providers, and contractors as part of its broader cybersecurity risk management efforts. The Company may assess the security posture of key third parties through contractual requirements, security questionnaires, and other risk management measures designed to reduce potential exposure. Company systems and services are hosted in secure cloud environments. To protect these environments, Cycurion employs security controls such as identity and access management, network security protections, encryption technologies, and monitoring capabilities designed to safeguard cloud-based infrastructure and applications. Incident Response Cycurion has implemented an IT Security Incident Response Policy designed to support the preparation for, detection of, and response to cybersecurity incidents. The incident response process generally includes four phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication, and recovery; (iv) post-incident review. Our Chief Information Officer ("CIO") and Information System Security Officer ("ISSO") are responsible for developing, implementing, coordinating, and maintaining Cycurion's cybersecurity policies and procedures, including incident response activities. The CIO and ISSO also serve as leaders of Cycurion's Incident Response Team ("IRT"). These individuals are responsible for overseeing the response to cybersecurity incidents, coordinating remediation efforts, and ensuring that security monitoring and logging capabilities are enabled across applicable systems. Incident response procedures include processes for identifying, classifying, and responding to potential cybersecurity incidents. Security personnel may investigate suspected incidents, collect, and preserve relevant evidence, and coordinate remediation actions designed to restore normal system operations. Cycurion periodically reviews and updates its incident response procedures and may conduct internal exercises or simulations designed to evaluate incident response readiness. Employees and system users are responsible for reporting suspected cybersecurity incidents such as malware infections, phishing attempts, unauthorized access attempts, or other suspicious activities to designated security personnel. If a cybersecurity incident occurs, management evaluates the nature, scope, and potential impact of the incident to determine whether the incident could materially affect Cycurion's business, operations, or financial condition. This evaluation may involve consultation with internal security personnel, senior management, and legal advisors.
|
| Cybersecurity Risk Management Processes Integrated [Flag] | true |
| Cybersecurity Risk Management Processes Integrated [Text Block] | Cybersecurity risk oversight is integrated into Cycurion's broader enterprise risk management processes. Management periodically provides the Board with updates regarding cybersecurity risk management activities and the effectiveness of cybersecurity controls. Our Information Security team, led by our Vice President of Operations, William (Eric) Singleton, is responsible for assessing and managing material cybersecurity risks. Certifications held by the Information Security team members include (ISC)² CISSP, (ISC)² CGRC, ISACA CISM, ISACA CRISC, CompTIA Security+, CompTIA Security X (CASP+), CompTIA PenTest+, CompTIA CNVP, EC-Council CEH, GIAC GWAPT, (ISC)² CAP, FITSI FITSP, CWAPT, IABF, and AWS Solutions Architect Associate. Mr. Singleton's background includes over 25 years of experience in IT and Information Security spanning federal government and commercial sectors, with expertise in cybersecurity strategy, risk management, compliance frameworks, penetration testing, vulnerability assessment, security control assessment, and FISMA/RMF program oversight. His formal education includes a Bachelor of Science in Computer Science from Northeastern University. Certifications held by Mr. Singleton include the (ISC)² Certified Authorization Professional (CAP), with additional specialized training in Incident Response and Threat Hunting, Offensive Operations, Penetration Testing, Red and BlueTeaming, Continuous Diagnostics and Mitigation (CDM), and Cloud Security. Our Vice President of Operations provides reports to the Audit Committee of our Board of Directors on a standing basis at each Audit Committee meeting, and as otherwise requested by the Chair of the Audit Committee or as determined necessary by the VP of Operations or other members of senior management. The VP of Operations is personally involved in, and responsible for, the risk assessment, identification, and management process described above.
|
| Cybersecurity Risk Management Third Party Engaged [Flag] | true |
| Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false |
| Cybersecurity Risk Board of Directors Oversight [Text Block] | Management considers cybersecurity risk as part of Cycurion's overall risk management and oversight processes. Cycurion's management team, including the CIO and ISSO, is responsible for the day-to-day implementation, assessment, and management of Cycurion's cybersecurity risk management processes. The CIO and ISSO oversee Cycurion's cybersecurity program and work with other members of management to implement and maintain cybersecurity policies, procedures, and safeguards designed to protect Company systems and data. The CIO and ISSO supervise internal cybersecurity personnel and may coordinate with external cybersecurity professionals or consultants who assist with security monitoring, risk assessments, and cybersecurity program improvements. The Board of Directors receives periodic updates regarding cybersecurity matters, including information related to cybersecurity risks, threat landscape developments, and cybersecurity program activities. Cybersecurity risk oversight is integrated into Cycurion's broader enterprise risk management processes. Management periodically provides the Board with updates regarding cybersecurity risk management activities and the effectiveness of cybersecurity controls. Our Information Security team, led by our Vice President of Operations, William (Eric) Singleton, is responsible for assessing and managing material cybersecurity risks. Certifications held by the Information Security team members include (ISC)² CISSP, (ISC)² CGRC, ISACA CISM, ISACA CRISC, CompTIA Security+, CompTIA Security X (CASP+), CompTIA PenTest+, CompTIA CNVP, EC-Council CEH, GIAC GWAPT, (ISC)² CAP, FITSI FITSP, CWAPT, IABF, and AWS Solutions Architect Associate. Mr. Singleton's background includes over 25 years of experience in IT and Information Security spanning federal government and commercial sectors, with expertise in cybersecurity strategy, risk management, compliance frameworks, penetration testing, vulnerability assessment, security control assessment, and FISMA/RMF program oversight. His formal education includes a Bachelor of Science in Computer Science from Northeastern University. Certifications held by Mr. Singleton include the (ISC)² Certified Authorization Professional (CAP), with additional specialized training in Incident Response and Threat Hunting, Offensive Operations, Penetration Testing, Red and BlueTeaming, Continuous Diagnostics and Mitigation (CDM), and Cloud Security. Our Vice President of Operations provides reports to the Audit Committee of our Board of Directors on a standing basis at each Audit Committee meeting, and as otherwise requested by the Chair of the Audit Committee or as determined necessary by the VP of Operations or other members of senior management. The VP of Operations is personally involved in, and responsible for, the risk assessment, identification, and management process described above.
|
| Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Management considers cybersecurity risk as part of Cycurion's overall risk management and oversight processes. Cycurion's management team, including the CIO and ISSO, is responsible for the day-to-day implementation, assessment, and management of Cycurion's cybersecurity risk management processes. The CIO and ISSO oversee Cycurion's cybersecurity program and work with other members of management to implement and maintain cybersecurity policies, procedures, and safeguards designed to protect Company systems and data. The CIO and ISSO supervise internal cybersecurity personnel and may coordinate with external cybersecurity professionals or consultants who assist with security monitoring, risk assessments, and cybersecurity program improvements.
|
| Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Board of Directors receives periodic updates regarding cybersecurity matters, including information related to cybersecurity risks, threat landscape developments, and cybersecurity program activities.
|
| Cybersecurity Risk Role of Management [Text Block] | Management considers cybersecurity risk as part of Cycurion's overall risk management and oversight processes. Cycurion's management team, including the CIO and ISSO, is responsible for the day-to-day implementation, assessment, and management of Cycurion's cybersecurity risk management processes. The CIO and ISSO oversee Cycurion's cybersecurity program and work with other members of management to implement and maintain cybersecurity policies, procedures, and safeguards designed to protect Company systems and data. The CIO and ISSO supervise internal cybersecurity personnel and may coordinate with external cybersecurity professionals or consultants who assist with security monitoring, risk assessments, and cybersecurity program improvements. The Board of Directors receives periodic updates regarding cybersecurity matters, including information related to cybersecurity risks, threat landscape developments, and cybersecurity program activities.
|
| Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true |
| Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Our Information Security team, led by our Vice President of Operations, William (Eric) Singleton, is responsible for assessing and managing material cybersecurity risks. |
| Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Certifications held by the Information Security team members include (ISC)² CISSP, (ISC)² CGRC, ISACA CISM, ISACA CRISC, CompTIA Security+, CompTIA Security X (CASP+), CompTIA PenTest+, CompTIA CNVP, EC-Council CEH, GIAC GWAPT, (ISC)² CAP, FITSI FITSP, CWAPT, IABF, and AWS Solutions Architect Associate. Mr. Singleton's background includes over 25 years of experience in IT and Information Security spanning federal government and commercial sectors, with expertise in cybersecurity strategy, risk management, compliance frameworks, penetration testing, vulnerability assessment, security control assessment, and FISMA/RMF program oversight. His formal education includes a Bachelor of Science in Computer Science from Northeastern University. Certifications held by Mr. Singleton include the (ISC)² Certified Authorization Professional (CAP), with additional specialized training in Incident Response and Threat Hunting, Offensive Operations, Penetration Testing, Red and BlueTeaming, Continuous Diagnostics and Mitigation (CDM), and Cloud Security. |
| Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Our Vice President of Operations provides reports to the Audit Committee of our Board of Directors on a standing basis at each Audit Committee meeting, and as otherwise requested by the Chair of the Audit Committee or as determined necessary by the VP of Operations or other members of senior management. |
| Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true |