medium match confidence
Sentence-level differences:
- Reworded sentence: "As an aerospace and defense company, we face a multitude of security threats, including cybersecurity threats ranging from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized adversaries, including nation state actors, which target the defense industrial base and other critical infrastructure sectors."
- Reworded sentence: "Given the persistence, sophistication, volume and novelty of threats we face, we may not be successful in preventing or mitigating an attack that could have a material adverse effect on us and the costs related to cyber or other security threats or disruptions may not be fully insured or indemnified by other means."
- Reworded sentence: "Our customers, suppliers, subcontractors, joint venture partners and acquired entities face similar security threats and an incident at one of these entities could adversely impact our business."
Current (2024):
As an aerospace and defense company, we face a multitude of security threats, including cybersecurity threats ranging from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized adversaries,…
Read full text
As an aerospace and defense company, we face a multitude of security threats, including cybersecurity threats ranging from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized adversaries, including nation state actors, which target the defense industrial base and other critical infrastructure sectors. The sophistication of the threats continue to evolve and grow, including the risk associated with the use of emerging technologies, such as artificial intelligence and quantum computing, for nefarious purposes. In addition to cybersecurity threats, we face threats to the security of our facilities and employees from terrorist acts, sabotage or other disruptions, any of which could adversely affect our business. The improper conduct of our employees or others working on behalf of us who have access to export controlled, classified or other sensitive information could also adversely affect our business and reputation. Our customers (including sites that we operate and manage for our customers), suppliers, subcontractors and joint venture partners, experience similar security threats. If we are unable to protect sensitive information, including complying with evolving information security, data protection and privacy regulations, our customers or governmental authorities could investigate the adequacy of our threat mitigation and detection processes and procedures; and could bring actions against us for noncompliance with applicable laws and regulations. Moreover, depending on the severity of an incident, our customers’ data, our employees’ data, our intellectual property (including trade secrets and research, development and engineering know-how), and other third-party data (such as subcontractors, suppliers and vendors) could be compromised, which could adversely affect our business. Products and services we provide to customers also carry cybersecurity risks, including risks that they could be breached or fail to detect, prevent or combat attacks, which could result in losses to our customers and claims against us, and could harm our relationships with our customers and financial results. Given the persistence, sophistication, volume and novelty of threats we face, we may not be successful in preventing or mitigating an attack that could have a material adverse effect on us and the costs related to cyber or other security threats or disruptions may not be fully insured or indemnified by other means. The national security aspects of our business and much of the data we protect increase and create different risks relative to other industries. National security considerations may also preclude us from publicly disclosing a cybersecurity incident. Our customers, suppliers, subcontractors, joint venture partners and acquired entities face similar security threats and an incident at one of these entities could adversely impact our business. These entities are typically outside our control and may have access to our information with varying levels of security and cybersecurity resources, expertise, safeguards and capabilities. Their relationships with government contractors, including us, may increase the risk that they are targeted by the same threats we face, however, they may not be as prepared for such threats. Adversaries actively seek to exploit security and cybersecurity weaknesses in our supply chain. Breaches in our multi-tiered supply chain, which is comprised of thousands of direct and indirect suppliers, has and could in the future compromise our data and adversely affect customer deliverables. We also must rely on our supply chain for adequately detecting and reporting cyber incidents, which could affect our ability to report or respond to cybersecurity incidents effectively or in a timely manner. For information on our cybersecurity risk management, strategy and governance, see Item 1C. - Cybersecurity.
View prior text (2023)
Given the nature of our business, we routinely experience various cybersecurity threats to our information technology infrastructure, unauthorized attempts to gain access to our company, employee- and customer-sensitive information, insider threats and denial-of-service attacks. Our customers, including sites that we operate and manage for our customers, suppliers, subcontractors and joint venture partners, experience similar security threats. In addition to cyber threats, we face threats to the security of our facilities and employees and threats from terrorist acts, which could materially disrupt our business if carried out. We could also be impacted by the improper conduct of our employees or others working on behalf of us who have access to export controlled or classified information, which could adversely affect our business and reputation. The threats we face vary from attacks common to most industries, such as ransomware, to more advanced and persistent, highly organized adversaries, including nation state actors, which target us and other defense contractors and other companies in industries that are part of U.S. critical infrastructure. These threats can cause disruptions to our business operations. If we are unable to protect sensitive information, including complying with evolving information security and data protection/privacy regulations, our customers or governmental authorities could question the adequacy of our threat mitigation and detection processes and procedures. Moreover, depending on the severity of an incident, our customers’ data, our employees’ data, our intellectual property (including trade secrets and research, development and engineering know-how), and other third-party data (such as subcontractors, suppliers and vendors) could be compromised. Products and services we provide to customers also carry cybersecurity risks, including risks that they could be breached or fail to detect, prevent or combat attacks, which could result in losses to our customers and claims against us, and could harm our relationships with our customers and financial results. 18 18 18 Table of Contents Table of Contents We have an extensive global security organization whose mission is to protect our systems and data, including a Computer Incident Response Team (CIRT) to defend against cyber attacks, and conduct annual training of our employees on protection of sensitive information. We also have a corporate-wide counterintelligence and insider threat detection program to proactively identify external and internal threats, and mitigate those threats in a timely manner. Additionally, we partner with our defense industrial base peers, government agencies and cyber associations to share intelligence to further defend against cyber attacks. However, because of the persistence, sophistication and volume of cyber attacks, we may not be successful in defending against an attack that could have a material adverse effect on us and due to the evolving nature of these security threats and the national security aspects of much of the data we protect, the impact of any future incident cannot be predicted. National security considerations may also preclude us from publicly disclosing a cybersecurity incident. We also typically work cooperatively with our customers, suppliers, subcontractors, joint venture partners and entities we acquire, who or which are subject to similar threats, to seek to minimize the impact of cyber threats, other security threats or business disruptions. These entities, which are typically outside our control and may have access to our information, have varying levels of cybersecurity expertise and safeguards, and their relationships with government contractors, including us, may increase the likelihood that they are targeted by the same cyber threats we face. We have thousands of direct suppliers and even more indirect suppliers with a wide variety of systems and cybersecurity capabilities and adversaries actively seek to exploit security and cybersecurity weaknesses in our supply chain. A breach in our multi-tiered supply chain could impact our data or customer deliverables. We must rely on this supply chain for detecting and reporting cyber incidents, which could affect our ability to report or respond to cybersecurity incidents effectively or in a timely manner. Because of the ongoing supply chain cyber security-related threats, our customers continue to seek that large prime contractors, like us, take steps to assure the cyber capabilities of their supply chain. Consequently, cyber security events in our supply chain could have an adverse impact on our relationships with our customers. The costs related to cyber or other security threats or disruptions may not be fully insured or indemnified by other means. Additionally, some cyber technologies we develop under contract for our customers, particularly those related to homeland security, may raise potential liabilities related to intellectual property and civil liberties, including privacy concerns, which may not be fully insured or indemnified by other means or involve reputational risk. Our enterprise risk management program includes threat detection and cybersecurity mitigation plans, and our disclosure controls and procedures address cybersecurity and include elements intended to ensure that there is an analysis of potential disclosure obligations arising from security breaches. We also maintain compliance programs to address the potential applicability of restrictions on trading while in possession of material, nonpublic information generally and in connection with a cybersecurity breach.