SAIC: 10-K Risk Factor Changes

Some of our services and operations involve the use, handling or disposal of hazardous substances or dangerous materials, including explosive, chemical, biological, radiological or nuclear materials. These activities generally subject us to extensive foreign, federal, state and local environmental protection and health and safety laws and regulations, which, among other things, require us to incur costs to comply with these regulations and could impose liability on us for handling or disposing of hazardous substances or dangerous materials. Furthermore, failure to comply with these environmental protection and health and safety laws and regulations could result in civil, criminal, regulatory, administrative or contractual sanctions, including fines, penalties or suspension or debarment from contracting with the U.S. government or could cause us to incur costs to change, upgrade, remediate and/or close some of our operations or properties. Although we do not have extensive real estate holdings, our ownership and operation of real property also subjects us to environmental protection laws, some of which hold current or previous owners or operators of businesses and real property liable for hazardous substance releases, even if they did not know of and were not responsible for the releases. If we have any violations of, or incur liabilities pursuant to, these laws or regulations, our financial condition and operating results could be adversely affected.

Some of our services and operations involve the use, handling or disposal of hazardous substances or dangerous materials, including explosive, chemical, biological, radiological or nuclear materials. These activities generally subject us to extensive foreign, federal, state and local environmental protection and health and safety laws and regulations, which, among other things, require us to incur costs to comply with these regulations and could impose liability on us for handling or disposing of hazardous substances or dangerous materials. Furthermore, failure to comply with these environmental protection and health and safety laws and regulations could result in civil, criminal, regulatory, administrative or contractual sanctions, including fines, penalties or suspension or debarment from contracting with the U.S. government or could cause us to incur costs to change, upgrade, remediate and/or close 17 17 17 Table of ContentsSCIENCE APPLICATIONS INTERNATIONAL CORPORATION Table of Contents

We face various risks related to health epidemics, pandemics and similar outbreaks like the global outbreak of COVID-19. If significant portions of our workforce are unable to work effectively due to illness, quarantines, government actions, facility closures or other reasons in connection with an epidemic, our operations will likely be impacted. We may be unable to perform fully on our contracts and some of our costs may not be fully recoverable or adequately covered by insurance. Re-occurrence of an epidemic may also cause disruption in our supply chain; cause delay, or limit the ability of, the U.S. government and other customers to perform, including making timely payments to us; impact investment performance; and cause other unpredictable events. In addition, the resulting volatility in the global capital markets could restrict our access to capital and/or increase our cost of capital.

We face various risks related to health epidemics, pandemics and similar outbreaks, including the global outbreak of COVID-19. If significant portions of our workforce are unable to work effectively due to illness, quarantines, government actions, facility closures or other reasons in connection with COVID-19 or similar outbreaks, our operations will likely be impacted. We may be unable to perform fully on our contracts and some of our costs may not be fully recoverable or adequately covered by insurance. It is also possible that the continued spread of COVID-19 may also cause disruption in our supply chain; cause delay, or limit the ability of, the U.S. government and other customers to perform, including making timely payments to us; impact investment performance; and cause other unpredictable events. 15 15 15 Table of ContentsSCIENCE APPLICATIONS INTERNATIONAL CORPORATION Table of Contents

This report contains forward-looking statements that are based on our management’s belief and assumptions about the future in light of information currently available to our management. In some cases, you can identify forward-looking statements by words such as “may,” “will,” “should,” “expects,” “projects,” “intends,” “plans,” “anticipates,” “believes,” “estimates,” “predicts,” “potential,” “continue,” “outlook,” and similar words or phrases or the negative of these words or phrases. These statements relate to future events or our future financial performance, and involve known and unknown risks, uncertainties and other factors that may cause our actual results, levels of activity, performance or achievements to be materially different from any future results, levels of activity, performance or achievements expressed or implied by these forward-looking statements. Although we believe that the expectations 20 20 20 Table of ContentsSCIENCE APPLICATIONS INTERNATIONAL CORPORATION Table of Contents

This report contains forward-looking statements that are based on our management’s belief and assumptions about the future in light of information currently available to our management. In some cases, you can identify forward-looking statements by words such as “may,” “will,” “should,” “expects,” “projects,” “intends,” “plans,” “anticipates,” “believes,” “estimates,” “predicts,” “potential,” “continue,” “outlook,” and similar words or phrases or the negative of these words or phrases. These statements relate to future events or our future financial performance, and involve known and unknown risks, uncertainties and other factors that may cause our actual results, levels of activity, performance or achievements to be materially different from any future results, levels of activity, performance or achievements expressed or implied by these forward-looking statements. Although we believe that the expectations reflected in the forward-looking statements are reasonable when made, we cannot guarantee future results, levels of activity, performance or achievements. There are a number of important factors that could cause our actual results to differ materially from those results anticipated by our forward-looking statements, which include, but are not limited to, the risk factors discussed above. We do not undertake any obligation to update or revise any of the forward-looking statements to reflect events, circumstances, changes in expectations, or the occurrence of unanticipated events after the date of those statements or to conform these statements to actual results.

We encounter cybersecurity and physical security threats as part of the work we do for our customers and our internal business. Our IT systems contain a variety of sensitive and classified information which attract adversaries including nation-state threat actors and we face cybersecurity threats including attempts to disrupt our critical systems, gain unauthorized access to data, release or corrupt sensitive information, and interfere with operations. Adversaries that acquire unauthorized access to customer accounts can use that information to compromise data and inadequate account security practices which could potentially result in malicious activity effecting customer use of our solutions. We work cooperatively with our customers to seek to address cybersecurity threats and often must rely on the safeguards used or required by those customers. Our solutions include custom software code we develop and may include open source or AI-generated code which may make our products susceptible to cyberattacks. Actual or perceived vulnerabilities may lead to claims against us and in the event of unauthorized access to sensitive information for which we are responsible under customer contracts, our customers, their employees, or third parties may seek to hold us liable for any costs or other damages associated with the unauthorized access. We also face cybersecurity threats from our supply chain through threat actors who may seek and gain access to our systems through our business partners and suppliers. Our information security staff manage cybersecurity risks by implementing security controls in accordance with industry standards and conducting regular employee cybersecurity training. Our cybersecurity policies, procedures and maturity are subject to review and audit by third parties. Although we have implemented and regularly update cybersecurity controls, there can be no assurance that these measures will successfully prevent or mitigate cybersecurity incidents. Cybersecurity incidents, disruptions and data loss have occurred including attacks targeting customer data and our systems and data. We report cybersecurity incidents to involved customers and applicable regulatory authorities including the DOD and the FBI to support national security initiatives. Such incidents did not have a material adverse impact on our financial condition or the results of our operations. However, future cybersecurity incidents could damage our reputation, exposing us to liability, or prevent us from winning future work from government customers and could have a material adverse impact on our business. Because of the rapidly evolving nature of these threats, there can be no assurance that our policies, procedures and security controls will detect or prevent them, mitigate their affects and we cannot predict their full impact. In addition, government agencies have investigated and may bring legal actions against us for violation of or noncompliance with regulatory requirements relating to any unauthorized access to and theft of sensitive information including failure to make adequate and timely disclosure to the public, regulators or law enforcement agencies. Any remediation costs, damages or other liabilities related to cybersecurity incidents may not be fully insured or indemnified by other means.

As a U.S. government contractor and a provider of IT services operating in multiple regulated industries and geographies, we handle a variety of sensitive information including personally identifiable information, personnel information, protected health information, classified information and controlled unclassified information, and financial information, concerning our business and employees and those of our customers. We are continuously exposed to cyber and other security threats, including malware/computer viruses, ransomware, phishing attacks, insider threats and physical break-ins. Any unauthorized electronic or physical intrusion or other security threat may jeopardize the protection of sensitive or other information stored or transmitted through our IT systems and networks. This could lead to disruptions in mission-critical systems, unauthorized release of sensitive information and the theft or corruption of data. Although we have implemented and regularly update and improve policies, procedures and other controls to monitor, protect against, detect and mitigate cyber and other security threats, attempts to gain unauthorized access to our IT systems and networks are becoming more prevalent and sophisticated. We, however, proactively seek to detect, investigate, mitigate and remediate all security events. In addition, we work with the defense industrial base industry and the U.S. government to gather and share threat intelligence and promote increased awareness and enhanced protections against cybersecurity threats. However, because of the evolving nature of these security threats, there can be no assurance that our policies, procedures and other controls will detect or prevent them, and we cannot predict their full impact. We may experience similar security threats to the IT systems that we develop, install or maintain under customer contracts, including customer contracts under which we may have access to or management responsibility for customer databases or networks that contain sensitive information relating to our customers, their employees or related third parties. Although we work cooperatively with our customers to seek to minimize the impacts of cyber and other security threats, we must usually rely on the safeguards used or required by those customers. In the event of unauthorized access to sensitive information for which we are responsible under customer contracts, our customers, their employees, or third parties may seek to hold us liable for any costs or other damages associated with the unauthorized access. In addition, government agencies may bring legal actions against us for violation of or noncompliance with regulatory requirements relating to any unauthorized access to sensitive information including failure to make adequate and timely disclosure to the public, regulators or law enforcement agencies. Occurrence of any unauthorized access caused by these security threats could adversely affect our reputation, business operations including contract terminations, ability to win work on future contracts, and impact our financial results. Any remediation costs, damages or other liabilities related to unauthorized access of sensitive information of ours or our customers caused by cyber or other security threats may not be fully insured or indemnified by other means or our insurers.