What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-31 compared with 2025-03-31 · 63 added, 61 removed, 8 unchanged (94% of the section changed)

STAFF COMMENTS

CYBERSECURITY

UNRESOLVED STAFF COMMENTS

CYBERSECURITY

1 unchanged sentence

risk management is an important part of our overall risk management efforts.

We maintain a cybersecurity program that is comprised

of policies, procedures, controls and plans whose objective is to help us prevent and effectively respond to cybersecurity threats

or incidents.

Through our cybersecurity risk management process, we continuously monitor cybersecurity vulnerabilities and potential

attack vectors to company systems.

We maintain various measures to safeguard against cybersecurity threats such as monitoring

systems, security controls, policy enforcement, data encryption, employee training, tools and services from third-party providers

and management oversight to assess, identify and mitigate risks from cybersecurity threats.

We conduct regular testing of these

controls and systems including vulnerability scanning, penetration testing and simulating the execution of parts of our disaster

recovery plan.

All employees are required to pass a mandatory cybersecurity training course on an annual basis and we regularly

conduct phishing simulations to train our employees on how to recognize phishing attempts.

We maintain a cybersecurity program that is comprised of

policies, procedures, controls and plans whose objective is to help us prevent and effectively respond to cybersecurity threats or incidents.

Through our cybersecurity risk management process, we continuously monitor cybersecurity vulnerabilities and potential attack vectors

to company systems.

We maintain various measures to safeguard against cybersecurity threats such as monitoring systems, security controls,

policy enforcement, data encryption, employee training, tools and services from third-party providers and management oversight to assess,

identify and mitigate risks from cybersecurity threats.

We conduct regular testing of these controls and systems including vulnerability

scanning, penetration testing and simulating the execution of parts of our disaster recovery plan.

All employees are required to pass

a mandatory cybersecurity training course on a regular basis and we regularly conduct phishing simulations to train our employees on

how to recognize phishing attempts.

have implemented cybersecurity frameworks, policies and practices which incorporate industry-standards and contractual requirements.

We also contractually flow cybersecurity regulatory requirements to our subcontractors as required by the Defense Federal Acquisition

Regulation Supplement and other government agency specific requirements.

These contractual flow downs include the requirement

that our subcontractors implement certain information security controls.

Additionally, we gather information and review the SOC-2

reports of certain third-parties who integrate with our systems, such as our payroll processor, managed solutions provider and

software as a service providers on an annual basis to identify and manage risk.

We continuously evaluate and seek to improve and

mature our cybersecurity processes.

We apply lessons learned from our defense and monitoring efforts to help prevent future attacks

and utilize data analytics to detect anomalies and search for cyber threats.

Additionally, our Internal Audit function regularly

assesses our program effectiveness through audits of systems and processes to help maintain compliance with policies.

We gather information and review the SOC-2 reports of certain third parties who integrate with our systems, such as our payroll processor,

managed solutions provider and software as a service provider on an annual basis to identify and manage risk.

We continuously evaluate

and seek to improve and mature our cybersecurity processes.

We apply lessons learned from our defense and monitoring efforts to help

prevent future attacks and utilize data analytics to detect anomalies and search for cyber threats.

Additionally, our Internal Audit

function regularly assesses our program effectiveness through audits of systems and processes to help maintain compliance with policies.

Cybersecurity

threats of all types, such as attacks from computer hackers, cyber criminals, nation-state actors, social engineering and other

malicious internet-based activities, continue to increase.

We believe that our current preventative actions and response planning

provide adequate measures of protection against cybersecurity risks.

While we have implemented measures to safeguard our information

technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always

be effective.

In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to

materially affect our business strategy, results of operations, or financial condition.

However, despite our efforts, we cannot

eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

For additional information about these risks, see Part I, Item 1A, “Risk Factors” in this Annual Report on Form 10-K.

board of directors has oversight of our strategic and business risk management and oversees management’s execution of our

cybersecurity risk management program.

threats of all types, such as attacks from computer hackers, cyber criminals, nation-state actors, social engineering and other malicious

internet-based activities, continue to increase.

We believe that our current preventative actions and response planning provide adequate

measures of protection against cybersecurity risks.

While we have implemented measures to safeguard our information technology systems,

the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective.

did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy,

results of operations, or financial condition.

However, despite our efforts, we cannot eliminate all risks from cybersecurity threats,

or provide assurances that we have not experienced undetected cybersecurity incidents.

For additional information about these risks,

see Part I, Item 1A, “Risk Factors” in this Annual Report on Form 10-K.

board of directors has oversight of our strategic and business risk management and oversees management’s execution of our cybersecurity

risk management program.

The board receives regular updates from management on our cybersecurity risks.

management updates the board as necessary, regarding any material cybersecurity incidents, as well as incidents with lesser impact

Management is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis, establishing

processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures,

maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors.

In the event of an

incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation,

recovery and notification, including notifying functional areas (e.g.

legal), as well as senior leadership and the board, as appropriate.

In addition, management updates

the board as necessary, regarding any material cybersecurity incidents, as well as incidents with lesser impact potential.

is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis, establishing processes to ensure that

such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity

policies and procedures, and providing regular reports to our board of directors.

In the event of an incident, we intend to follow our

incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including

notifying functional areas, as well as senior leadership and the board, as appropriate.

Director of Information Technology leads our cybersecurity program and is responsible for our overall information security strategy,

policy, security engineering, operations and cyber threat detection and response.

The Director of Information Technology manages

a team of information technology professionals with broad experience, including in cybersecurity threat assessments and detection,

mitigation technologies, incident response, insider threats and regulatory compliance.

Our Director of Information Technology

brings extensive experience in cybersecurity, including conducting DIBCAC (Defense Industrial Base Cybersecurity Assessment Center)

audit and overseeing NIST (National Institute of Standards and Technology) internal audits.

This expertise ensures our organization

aligns with strict industry standards and maintains robust compliance measures.

cybersecurity program is regularly assessed through management self-evaluation and ongoing monitoring procedures to evaluate our

program effectiveness, including assessments associated with internal controls over financial reporting as well as vulnerability

management through active discovery and testing to validate patching and configuration.

The Director of Information Technology manages a team

of information technology professionals with broad experience, including in cybersecurity threat assessments and detection, mitigation

technologies, incident response, insider threats and regulatory compliance.

Our Director of Information Technology brings extensive experience

in cybersecurity, including conducting DIBCAC (Defense Industrial Base Cybersecurity Assessment Center) audits and overseeing NIST (National

Institute of Standards and Technology) internal audits.

This expertise ensures our organization aligns with strict industry standards

and maintains robust compliance measures.

cybersecurity program is aligned with NIST SP 800-171 and the requirements of the Cybersecurity Maturity Model Certification (CMMC) applicable

to our Department of Defense (DOD) contracts and when flowed down through prime contractors.

We are currently in the process of achieving

CMMC Level 2.0 certification.

Our program includes policies, procedures and controls design to safeguard controlled unclassified information

and to detect, respond to, and recover from cybersecurity incidents.

We continue to invest in cybersecurity capabilities and third-party

assessments to support ongoing compliance.

We also contractually flow CMMC requirements to our subcontractors as required by the Defense

Federal Acquisition Regulation Supplement.

Failure to achieve or maintain these requirements could adversely affect our ability to perform

on or compete for certain government contracts.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments