5 unchanged sentences
Our ISMS includes developing, implementing, and continually improving policies and procedures designed to safeguard information and ensure the availability of critical data and systems.
−Removed: These policies cover areas such as requiring secure coding practices and a secure development lifecycle process, monthly information security awareness training for all employees and enhanced training for specialized personnel, review and assessment by external, independent third parties, who certify and report on our weaknesses and internal response preparedness for the entire Company, and the performance of daily vulnerability scanning of our network infrastructure as well as annual third-party penetration testing.
+Added: These policies cover areas such as requiring secure coding practices and a secure development lifecycle process, monthly information security awareness training for all employees and enhanced training for specialized personnel, review and assessment by external, independent third parties, who certify and report on our weaknesses and internal response preparedness for the entire Company, and the performance of routine and risk-based vulnerability scanning of our network infrastructure as well as annual third-party penetration testing.
Our cybersecurity risk assessment, identification, and management process consists of a dedicated Governance Risk and Compliance ("GRC") team, within our Information Security organization, that implements a repeatable, ISO/IEC 27001-compliant methodology to asses and track cybersecurity risk.
1 unchanged sentence
The GRC team collaborates closely with risk owners throughout the Company, vendors, and suppliers, working with them in an effort to ensure their risks are identified, documented, and mitigated in a timely fashion.
−Removed: In addition to our active ISO/IEC 27001 certification, the Company also assesses itself against the National Institute of Standards and Technology Special Publication 800-171 as required by the Defense Federal Acquisition Regulation Supplement.
+Added: In addition to our active ISO/IEC 27001 certification, the Company assesses itself against the National Institute of Standards and Technology Special Publication 800-171 as required by the Defense Federal Acquisition Regulation Supplement.
+Added: The Company has also achieved Cybersecurity Maturity Model Certification Level 2 ("CMMC L2"), reflecting an independent assessment against applicable DoW cybersecurity requirements.
In accordance with our ISMS, we also actively monitor known threats that could affect our products and services and work with our suppliers to provide us with real-time reports of threats or vulnerabilities that may affect our enterprise-wide systems.
7 unchanged sentences
For additional information regarding potential cybersecurity risks, see relevant business and operational risks under Item 1A, "Risk Factors," of this Annual Report on Form 10-K.
−Removed: In the last three years, we have not experienced a material information security breach incident or any penalties or settlements related to the same, and the expenses we have incurred from information security breach incidents were immaterial.
+Added: In 2025, we did not experience a material information security breach incident or any penalties or settlements related to the same, and the expenses we have incurred from information security breach incidents were immaterial.
Management’s role and expertise in assessing and managing material cybersecurity risks
8 unchanged sentences
The CISO is personally involved in, and responsible for, the risk assessment, identification and management process described above.
−Removed: Board of Director’s oversight of cybersecurity risks
+Added: Board of Directors' oversight of cybersecurity risks
The Board of Directors has oversight responsibility with respect to risk management and reviews matters with management as part of management’s regular Board reporting.
6 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.