3 unchanged sentences
Our cybersecurity program (the “ Cybersecurity Program ”) includes processes to identify, assess, and manage material risks from cybersecurity threats.
−Removed: The Cybersecurity Program processes utilize a risk-based approach and include written cybersecurity and information technology policies and procedures, including a cybersecurity incident response plan.
+Added: The Cybersecurity Program processes utilize a risk-based approach and
+Added: include written cybersecurity and information technology policies and procedures, including a cybersecurity incident response plan.
The Cybersecurity Program is informed, in part, by the guidelines of the National Institute of Standards and Technology Cybersecurity Framework to define material risks and establish controls designed to protect, detect, respond to, and recover from cybersecurity incidents.
14 unchanged sentences
• reviewing and assessing our information technology disaster recovery capabilities;
−Removed: • reviewing our assessment of cybersecurity threats and risk associated with our supply chain and actions we are taking to address such threats and risks.
+Added: • reviewing our assessment of cybersecurity threats and risks associated with our supply chain and actions we are taking to address such threats and risks.
The Cybersecurity Committee receives reports and updates at committee meetings from our Chief Information Officer (“CIO”), Chief Information Security Officer (“CISO”), and other executives and cybersecurity specialists.
8 unchanged sentences
Our CISO executes the Cybersecurity Program with the support of the Cybersecurity Management Team, which has extensive cybersecurity expertise to protect and defend our networks, physical systems, infrastructure, and data from cybersecurity risks.
−Removed: Our CISO has 33 years of experience in cybersecurity and information technology, over 20 years working with NAVSEA 08Y, approval authority of HII’s unclassified Naval Nuclear Propulsion Information networks, and holds a Master’s degree in Cybersecurity.
+Added: Our CISO has more than 25 years of experience with HII and over 20 years of experience in cybersecurity and information technology.
He has specific experience in the following cybersecurity areas:
5 unchanged sentences
incident response and remediation;
−Removed: supply chain cyber risk management;
+Added: supply chain cyber risk
cybersecurity awareness training;
M&A cyber risk management;
−Removed: cloud security;
−Removed: identity management;
+Added: identity and access management;
disaster recovery;
−Removed: cybersecurity regulation compliance;
−Removed: and cybersecurity damage assessment.
+Added: and cybersecurity regulation compliance.
Our cybersecurity incident response framework is governed by a corporate Cybersecurity Incident Response Plan (the “IRP”), which sets out our approach for categorizing, responding to, and mitigating cybersecurity incidents.
11 unchanged sentences
As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.
−Removed: However, as discussed under Item 1A.
−Removed: "Risk Factors," specifically the risks titled "We could be negatively impacted
−Removed: by security threats, including cyber security threats, and related disruptions" and "Our earnings and profitability depend, in part, upon subcontractor performance and raw material and component availability and pricing," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient.
+Added: However, as discussed in Item 1A.
+Added: Risk Factors, specifically the risks titled "We could be negatively impacted by security threats, including cybersecurity threats, and related disruptions" and "Our earnings and profitability depend, in part, upon subcontractor performance and raw material and component availability and pricing," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient.
Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.