Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
None.
Item 1C. Cybersecurity
Risk Management and Strategy
We have implemented a cybersecurity program to assess, identify and manage risk from cybersecurity threats. This program aims to protect the confidentiality, availability and integrity of our information systems from potential threats. Our cybersecurity risk management program includes, among other things, risk assessments designed to identify threats to our critical systems and information services, and a team comprising IT Security, IT Infrastructure and IT Compliance personnel that administers the program with oversight by senior management.
We have incorporated cybersecurity risk into our extensive risk management framework by aligning it with our overall risk strategy. This involves identifying potential cybersecurity threats, assessing their impact and developing mitigation strategies. These governance processes apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, ensuring that cybersecurity risks are managed effectively and are in line with the organization's risk tolerance and business objectives.
Our cybersecurity program incorporates the principles of the National Institute of Standards and Technology (NIST) Cybersecurity Framework and is supported by an Information Security Management System (ISMS) certified to ISO/IEC 27001:2022. The certification scope includes Matrix's engineering, fabrication, construction, and maintenance services, together with the employees, administrative personnel, IT systems, policies, procedures, standards, tools, utilities, client deliverables, and data used in providing those services.
All administrative employees participate in cybersecurity training programs. Employees receive training on how to identify and report cyber risks and events through our cybersecurity awareness program.
We also engage external experts to evaluate our cybersecurity programs. These evaluations include audits, threat assessments, simulated attacks, vulnerability scans and advice on information security practices. We conduct incident response exercises with key stakeholders. Additionally, we hold cybersecurity risk insurance.
To manage risks associated with third-party service providers, the information security team categorizes suppliers based on factors such as volume and criticality of data handled, potential impact on business operations and level of access to our information systems. We conduct risk assessments to identify potential threats and vulnerabilities associated with suppliers. We screen suppliers to ensure they meet proper security standards and compliance requirements. We monitor supplier activities to ensure compliance with information security policies and conduct regular reviews and audits of supplier relationships to ensure ongoing compliance. We strive to ensure that our contracts with such vendors require them to maintain security controls in line with industry best practices, applicable laws and our policies. We rely on vendors to alert us promptly of material cybersecurity incidents by virtue of the documents governing their relationship with us or applicable law.
Governance
20
Table of Contents
Our Board of Directors , with assistance from the IT Steering Committee, oversees cybersecurity. Our Board of Directors receives reports as needed, but no less than biannually, from management on various cybersecurity and IT topics, including trends, data security policies and practices, cybersecurity incidents, current and projected threat assessments, regulatory developments and ongoing efforts to protect, detect and respond to critical threats. Our IT Steering Committee, which is part of our Risk Management Committee and is responsible for cybersecurity management oversight, includes members of management such as our Chief Executive Officer, our Chief Financial Officer, our General Counsel, and our Senior Vice President of Enterprise Services. The IT Steering Committee periodically reviews and confers with management regarding risk issues associated with cybersecurity and policies and controls intended to alleviate those risks.
Our IT Security team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes. Team members are afforded opportunities to attend external training, conferences and other events to remain on top of most recent cybersecurity trends. Our team is led by our Director of IT Infrastructure and Security, who brings over 30 years of experience, which includes implementing and verifying the effectiveness of cybersecurity controls in a Defense Industrial Base environment and defining and executing cybersecurity strategy to enable business delivery while simultaneously protecting intellectual property and privacy. Our Director of IT Infrastructure and Security maintains the following internationally recognized certifications: Global Information Assurance Certification ("GIAC"), GIAC Certified Enterprise Defender, GIAC Certified Incident Handler Certification, GIAC Certified Windows Security Administrator, and GIAC Critical Controls Certification. Our Director of IT Infrastructure and Security previously reported to the Vice President of Information Technology until that individual's departure during the second half of fiscal 2026. In connection with organizational changes, the vacant position was subsequently filled with a Senior Director of Information Technology in the first quarter of fiscal 2027. During the interim period, the Director of IT Infrastructure and Security reported on a temporary basis to the Senior Vice President of Enterprise Services, who receives continuous updates regarding the prevention, detection, mitigation and remediation of cybersecurity incidents. The Senior Vice President of Enterprise Services formerly served as chair of, and currently serves as a member of, our Risk Management Committee and IT Steering Committee, and has experience in cybersecurity incident response, cyber claims, and business continuity matters.
Our Director of IT Infrastructure and Security meets with our IT Steering Committee on a routine basis. Regular topics for discussion with the IT Steering Committee include cybersecurity initiatives and strategies, cybersecurity events, emerging threats, regulatory requirements and industry standards.
We use a combination of technology controls and human oversight to actively monitor and protect our network and systems. In the event of a cybersecurity incident, we have an incident response plan which sets forth a framework for reporting and documenting such incidents by our cybersecurity incident response team. This same framework is designed with the goal of enabling the response team to take actions to monitor, mitigate and remediate such incidents promptly. Cybersecurity incidents are reported to our Senior Vice President of Enterprise Services, and critical events are reported to our CEO and our General Counsel . In the event a cybersecurity incident is determined to be potentially material, the incident is reported in a timely manner to our Board of Directors as part of their cybersecurity oversight.
Cybersecurity Risks, Threats and Material Incidents
We describe whether and how risks from identified cybersecurity threats, including as a result of any prior cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial conditions under Item 1A. Risk Factors, Risk Factors Related to Our Business and Operations, "A failure or outage in our operational systems, including cybersecurity incidents and disruptions involving third-party software or AI tools, may adversely affect our business and financial results."
21
Table of Contents