4 unchanged sentences
This program aims to protect the confidentiality, availability and integrity of our information systems from potential threats.
−Removed: Our cybersecurity risk management program includes, among other things, risk assessments designed to identify threats to our critical systems and information services, and a team comprising IT Security, IT Infrastructure and IT Compliance personnel that administer the program with oversight by senior management.
+Added: Our cybersecurity risk management program includes, among other things, risk assessments designed to identify threats to our critical systems and information services, and a team comprising IT Security, IT Infrastructure and IT Compliance personnel that administers the program with oversight by senior management.
We have incorporated cybersecurity risk into our extensive risk management framework by aligning it with our overall risk strategy.
1 unchanged sentence
These governance processes apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, ensuring that cybersecurity risks are managed effectively and are in line with the organization's risk tolerance and business objectives.
−Removed: Our security program generally incorporates the guidelines of the widely utilized National Institute of Standards and Technology Cybersecurity Framework, though this does not imply we meet any particular technical standards, specifications or requirements.
−Removed: As part of our enterprise-wide risk management strategy and commitment to continuous improvement, we are
−Removed: actively pursuing ISO/IEC 27001 certification, the internationally recognized standard for information security management systems.
−Removed: We have initiated the formal implementation process, including a comprehensive gap assessment and roadmap development.
−Removed: Progress toward certification is regularly reviewed by the IT Steering Committee and reported to the Board of Directors.
−Removed: All employees participate in multiple information security training programs.
+Added: Our cybersecurity program incorporates the principles of the National Institute of Standards and Technology (NIST) Cybersecurity Framework and is supported by an Information Security Management System (ISMS) certified to ISO/IEC 27001:2022.
+Added: The certification scope includes Matrix's engineering, fabrication, construction, and maintenance services, together with the employees, administrative personnel, IT systems, policies, procedures, standards, tools, utilities, client deliverables, and data used in providing those services.
+Added: All administrative employees participate in cybersecurity training programs.
Employees receive training on how to identify and report cyber risks and events through our cybersecurity awareness program.
−Removed: Additionally, we hold cybersecurity risk insurance.
We also engage external experts to evaluate our cybersecurity programs.
−Removed: These evaluations include regular audits, threat assessments, simulated attacks, vulnerability scans and advice on information security practices.
−Removed: We routinely conduct incident response exercises with key stakeholders.
+Added: These evaluations include audits, threat assessments, simulated attacks, vulnerability scans and advice on information security practices.
+Added: We conduct incident response exercises with key stakeholders.
+Added: Additionally, we hold cybersecurity risk insurance.
To manage risks associated with third-party service providers, the information security team categorizes suppliers based on factors such as volume and criticality of data handled, potential impact on business operations and level of access to our information systems.
−Removed: We conduct risk assessments to identify potential threats and vulnerabilities associated with each supplier.
+Added: We conduct risk assessments to identify potential threats and vulnerabilities associated with suppliers.
We screen suppliers to ensure they meet proper security standards and compliance requirements.
−Removed: We monitor all supplier activities to ensure compliance with information security policies and conduct regular reviews and audits of supplier relationships to ensure ongoing compliance.
+Added: We monitor supplier activities to ensure compliance with information security policies and conduct regular reviews and audits of supplier relationships to ensure ongoing compliance.
We strive to ensure that our contracts with such vendors require them to maintain security controls in line with industry best practices, applicable laws and our policies.
2 unchanged sentences
Our Board of Directors receives reports as needed, but no less than biannually, from management on various cybersecurity and IT topics, including trends, data security policies and practices, cybersecurity incidents, current and projected threat assessments, regulatory developments and ongoing efforts to protect, detect and respond to critical threats.
−Removed: Our IT Steering Committee, which is responsible for cybersecurity management oversight, includes members of management such as our Chief Executive Officer, our Chief Financial Officer, and our Vice President of Information Technology.
−Removed: The IT Steering Committee periodically reviews and confers with management risk issues associated with cybersecurity and policies and controls intended to alleviate those risks.
+Added: Our IT Steering Committee, which is part of our Risk Management Committee and is responsible for cybersecurity management oversight, includes members of management such as our Chief Executive Officer, our Chief Financial Officer, our General Counsel, and our Senior Vice President of Enterprise Services.
+Added: The IT Steering Committee periodically reviews and confers with management regarding risk issues associated with cybersecurity and policies and controls intended to alleviate those risks.
Our IT Security team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes.
1 unchanged sentence
Our team is led by our Director of IT Infrastructure and Security, who brings over 30 years of experience, which includes implementing and verifying the effectiveness of cybersecurity controls in a Defense Industrial Base environment and defining and executing cybersecurity strategy to enable business delivery while simultaneously protecting intellectual property and privacy.
−Removed: Our Director maintains the following internationally recognized certifications:
+Added: Our Director of IT Infrastructure and Security maintains the following internationally recognized certifications:
Global Information Assurance Certification ("GIAC"), GIAC Certified Enterprise Defender, GIAC Certified Incident Handler Certification, GIAC Certified Windows Security Administrator, and GIAC Critical Controls Certification.
−Removed: Our Director reports to our Vice President of Information Technology, who receives continuous updates regarding the prevention, detection, mitigation and remediation of cybersecurity incidents.
−Removed: Our Vice President of Information Technology has over 20 years of experience in developing and executing strategic initiatives to drive organizational growth and innovation, with responsibilities for IT governance, technology strategy development, and cybersecurity.
−Removed: In additional to a Masters of Business Administration, our Vice President of Information Technology holds a Certified Information Systems Security Professional certification.
−Removed: Our Vice President of Information Technology meets with our IT Steering Committee on a routine basis.
+Added: Our Director of IT Infrastructure and Security previously reported to the Vice President of Information Technology until that individual's departure during the second half of fiscal 2026.
+Added: In connection with organizational changes, the vacant position was subsequently filled with a Senior Director of Information Technology in the first quarter of fiscal 2027.
+Added: During the interim period, the Director of IT Infrastructure and Security reported on a temporary basis to the Senior Vice President of Enterprise Services, who receives continuous updates regarding the prevention, detection, mitigation and remediation of cybersecurity incidents.
+Added: The Senior Vice President of Enterprise Services formerly served as chair of, and currently serves as a member of, our Risk Management Committee and IT Steering Committee, and has experience in cybersecurity incident response, cyber claims, and business continuity matters.
+Added: Our Director of IT Infrastructure and Security meets with our IT Steering Committee on a routine basis.
Regular topics for discussion with the IT Steering Committee include cybersecurity initiatives and strategies, cybersecurity events, emerging threats, regulatory requirements and industry standards.
2 unchanged sentences
This same framework is designed with the goal of enabling the response team to take actions to monitor, mitigate and remediate such incidents promptly.
−Removed: Cybersecurity incidents are reported to our Vice President of Information Technology, and critical events are reported to our CEO and our Chief Legal Counsel .
+Added: Cybersecurity incidents are reported to our Senior Vice President of Enterprise Services, and critical events are reported to our CEO and our General Counsel .
In the event a cybersecurity incident is determined to be potentially material, the incident is reported in a timely manner to our Board of Directors as part of their cybersecurity oversight.
1 unchanged sentence
We describe whether and how risks from identified cybersecurity threats, including as a result of any prior cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial conditions under Item 1A.
−Removed: Risk Factors, Risks Related to our Business and Operations, "A failure or outage in our operations systems or cybersecurity attacks on any of our systems, or those of third parties, may adversely affect our financial results."
+Added: Risk Factors, Risk Factors Related to Our Business and Operations, "A failure or outage in our operational systems, including cybersecurity incidents and disruptions involving third-party software or AI tools, may adversely affect our business and financial results."
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.