What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-19 compared with 2025-03-31 · 37 added, 36 removed, 5 unchanged (94% of the section changed)

3 unchanged sentences

Cybersecurity Risk Management and Strategy

We recognize the need to continually monitor and assess material risks associated with cybersecurity threats as such term is defined in Item 106(a) of Regulation S-K.

Additionally, we maintain a comprehensive risk management framework designed to respond quickly to perceived threats and mitigate the impact of a cybersecurity incident.

Some of the cybersecurity risks we face include - but are not limited to - unauthorized access of sensitive information, breach of critical systems resulting in loss of constellation control, and denial of service of critical systems.

Cybersecurity risk management forms part of our overall risk management framework, which is regularly reviewed by our Chief Transformation Officer (“CTO”), our senior management team and our Board of Directors.

We retain an ISO 27001:2013 certification related to our information security management system (“ISMS”) that supports the assets, technologies, personnel, and processes used by our corporate IT environment, as well as the satellite command and control, data uplink and downlink pipelines, and ground stations utilized by our radio frequency collection and data products.

Cybersecurity incident response procedures are enumerated in internal policies and procedures with remediation plans reflective of the scope and severity of the incident.

This remediation typically involves incident analysis, incident isolation and eradication, and post-incident response.

In the event a cybersecurity incident is detected, the IT Security Team reports the event to our legal and compliance teams.

These Legal and Compliance professionals then advise on any additional notification or reporting requirements.

We regularly assess risks related to regulatory compliance , technical operations, business operations, and product and contract deliverables.

Risks are managed, documented, and tracked as part of operating the ISMS and other processes.

Risks are internally assessed and categorized based on perceived likelihood and impact to system confidentiality, integrity, and availability as described by the ISO 27005 Information Security Risk Management international standard.

We also engage third party penetration testers, assessors, vendors, and auditors to assist with external network vulnerability scanning, penetration testing, internal audits, external audits, threat intelligence, and employee training activities.

Additionally, we utilize a variety of self-hosted and SaaS tools to assist with vulnerability identification, mitigation, and remediation.

Identified risks and vulnerabilities are ranked and prioritized for mitigation based upon the aforementioned factors.

Some risk mitigation and minimization activities include:

regular software patches and updates;

permitting only required connections to sensitive and critical systems;

reactive response to newly identified and discovered exploitable vulnerabilities;

implementation of additional auditing and monitoring controls;

and cadence-driven system security assessments for critical systems.

We assess the cybersecurity posture of third-party service providers , vendors and suppliers at least annually and whenever the vendor implements significant product or operational changes.

We maintain consistent communications via email, chat services, ticketing systems, and regular meetings with these partners to promptly address and remediate any perceived vulnerabilities.

Additionally, we also provide mandatory training to our employees to help identify, avoid and mitigate cybersecurity threats.

These trainings cover a wide range of cybersecurity topics such as insider threats, phishing, spoofing, and the like.

As of the date of this Annual Report on Form 10-K, we have not experienced a cybersecurity threat or incident that materially affected or is reasonably like to materially affect our business or operations, but there can be no guarantee that we will not experience such an incident in the future.

We aim to incorporate industry best practices throughout our cybersecurity program and continue to invest in additional controls designed to ensure the resiliency of our networks and prevention of cybersecurity incidents.

We describe how cybersecurity threats are likely to materially affect us, including our business strategy, results of operations, and financial condition, in the section titled “Risk Factors” in this Annual Report on Form 10-K.

We recognize the importance of continuously monitoring and assessing material risks from cybersecurity threats, as defined in Item 106(a) of Regulation S-K.

To address these risks, we maintain a comprehensive risk management framework designed to enable rapid response to identified threats and to mitigate the potential impact of cybersecurity incidents.

Among the cybersecurity risks we face are unauthorized access to sensitive information, breaches of critical systems that could result in loss of constellation control, and denial-of-service attacks on critical systems, although these examples are not exhaustive.

Cybersecurity risk management is integrated into our broader enterprise risk management framework, which undergoes regular review by our Chief Technology Officer (“CTO”), senior management team, and Board of Directors.

We hold an ISO 27001:2013 certification related to our information security management system (“ISMS”), which encompasses the assets, technologies, personnel, and processes supporting our corporate IT environment, as well as the satellite command and control systems, data uplink and downlink pipelines, and ground stations used in our radio frequency collection and data products.

Our cybersecurity incident response procedures are detailed in internal policies and include remediation plans tailored to the scope and severity of each incident.

Remediation generally involves incident analysis, isolation and eradication of the threat, and post-incident review.

Upon detection of a cybersecurity incident, our IT Security Team reports the event to our legal and compliance teams, which then provide guidance on any required notifications or reporting obligations.

We conduct regular risk assessments across regulatory compliance , technical operations, business operations, and product/contract deliverables.

These risks are managed, documented, and tracked through our ISMS and related processes.

Risks are internally evaluated and categorized according to their perceived likelihood and potential impact on the confidentiality, integrity, and availability of our systems, consistent with the ISO 27005 international standard for information security risk management.

We also engage third-party penetration testers, assessors, vendors, and auditors to support external network vulnerability scanning, penetration testing, internal and external audits, threat intelligence, and employee training.

In addition, we employ a range of self-hosted and SaaS-based tools to aid in vulnerability identification, mitigation, and remediation.

We rank and prioritize identified risks and vulnerabilities for mitigation based on the factors described above.

Risk mitigation and minimization efforts include regular software patching and updates;

restricting connections to sensitive and critical systems to only those that are necessary;

prompt response to newly discovered exploitable vulnerabilities;

implementation of enhanced auditing and monitoring controls;

and periodic security assessments of critical systems.

We evaluate the cybersecurity posture of third-party service providers , vendors, and suppliers at least annually, as well as whenever such parties implement significant changes to products or operations.

We maintain ongoing communications with these partners through email, chat services, ticketing systems, and regular meetings to identify and remediate any identified vulnerabilities promptly.

We also require all employees to complete mandatory cybersecurity training designed to help them identify, avoid, and mitigate cybersecurity threats.

These trainings address a broad array of topics, including insider threats, phishing, spoofing, and related risks.

As of the date of this Annual Report on Form 10-K, we have not experienced any cybersecurity threat or incident that has materially affected, or is reasonably likely to materially affect , our business strategy, results of operations, or financial condition.

However, there can be no assurance that we will not experience such an incident in the future.

We seek to incorporate industry best practices into our cybersecurity program and continue to invest in additional controls to enhance the resiliency of our networks and prevent cybersecurity incidents.

For a discussion of how cybersecurity threats could materially affect us, including potential impacts on our business strategy, results of operations, and financial condition, please refer to the section titled “Risk Factors” in this Annual Report on Form 10-K.

Cybersecurity Governance

Our cybersecurity program is overseen by the Company’s CTO in close collaboration with the CEO and our legal and compliance teams.

O ur CTO has a technical background and is well informed about cyberse curity risk management best practices, as well as our Company’s risk management framework.

Our legal and compliance teams supporting the Company’s cybersecurity efforts bring a wealth of experience from prior positions, as well as participation in ongoing training sessions and industry events.

Our CTO regularly briefs the full Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of all material cybersecurity incidents and the results of any third-party assessments.

Additionally, our Board has designated a single Board member, who has experience in assessing and managing cybersecurity risk, to lead the Board-level oversight of cybersecurity risk matters, including staying abreast of cybersecurity best practices and briefing the full Board when significant industry developments occur.

Daily risk management and oversight of the Company’s cybersecurity posture is the responsibility of the Director of IT and Security, who directly reports to the CTO, and the cybersecurity professionals on his team.

All of these team members have extensive experience in networking, cloud and on-premise infrastructure, software development, corporate IT, intelligence, Linux system administration, and data center operations.

These individuals are responsible for approving and implementing security operations, security program development, and governance, risk and compliance related to cyber matters.

Our cybersecurity program is overseen by the Company’s CTO, working in close collaboration with the CEO and our legal and compliance teams.

The CTO possesses a strong technical background and maintains current knowledge of cybersecurity risk management best practices and our Company’s risk management framework.

Our legal and compliance teams, which support cybersecurity efforts, draw on extensive prior experience as well as ongoing participation in training sessions and industry events.

The CTO provides regular briefings to the full Board of Directors on our cybersecurity and information security posture.

The Board of Directors is also informed of all material cybersecurity incidents and the outcomes of any third-party assessments.

In addition, the Board of Directors has designated one member—with experience in assessing and managing cybersecurity risk—to lead Board-level oversight of cybersecurity matters.

This includes monitoring cybersecurity best practices and briefing the full Board of Directors on significant industry developments.

Day-to-day risk management and oversight of the Company’s cybersecurity posture fall to the Director of Information Security and IT, who reports directly to the CTO, along with the cybersecurity professionals on that team.

These individuals possess extensive experience in networking, cloud and on-premise infrastructure, software development, corporate IT, threat intelligence, Linux system administration, and data center operations.

They are responsible for approving and implementing security operations, developing the security program, and managing governance, risk, and compliance matters related to cybersecurity.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments