LDOSLeidos

As a government contractor and a provider of information technology services operating in multiple regulated industries and geographies, we and our service providers, suppliers and subcontractors collect, store, transmit, and otherwise process personal, confidential, proprietary, and sensitive information, including protected health information, personnel information, personal information, classified information, controlled unclassified information, intellectual property and financial information, concerning our business, employees, and customers. Therefore, we are continuously exposed to unauthorized attempts to compromise access, release or otherwise compromise such information through cyber-attacks and other information security threats, including, among other things, physical break-ins, theft, denial-of-service attacks, worms, computer viruses, software bugs, malicious or destructive code, social engineering, phishing attacks and impersonating authorized users, credential stuffing, account takeovers, insider threats, malfeasance or improper access by employees or service providers, human error, fraud, use of AI, “bots” or other automation software, or other similar disruptions. We are also exposed to hackers who have requested “ransom” in exchange for not disclosing information or restoring access to information or systems. These techniques may be perpetrated by internal bad actors, such as employees or contractors, or by third parties (including traditional computer hackers, persons involved with well-funded organized crime or state-sponsored actors). Any electronic or physical break-in or other security breach or compromise of our information technology systems and networks or facilities, or those of our service providers, suppliers, joint ventures or subcontractors, may jeopardize the confidentiality, integrity or availability of information, including personal, confidential, proprietary or sensitive information, stored or transmitted through these systems and networks or stored in those facilities. This could lead to disruptions in mission-critical systems, unauthorized access to or release of personal, confidential, proprietary, sensitive or otherwise protected information and corruption of data or systems. We could also be subject to operational downtimes, delays and other detrimental impacts on our operations or ability to provide products and services to our customers. We are also increasingly subject to customer-driven cybersecurity certification requirements, including but not limited to CMMC, which are expected to be necessary to win future contracts. Security incidents could also result in liability, trigger other obligations under such contracts, or increase the difficulty of winning future contracts. Many statutory requirements, both in the U.S. and abroad, also include different obligations for companies to provide notice of information security incidents involving certain types of information (including obligations to notify affected individuals and regulators in the event of cybersecurity breaches involving certain personal information), which could result from breaches of our service providers, our suppliers or subcontractors.

On FFP For contracts requiring which involve complex deliverables, such as system integration and cost-plus integration, we usually recognize revenue over time as the work is completed. For contracts with an FFP component or variable consideration, revenue is generally recognized over time fees, we measure progress using a method that measures the extent of progress towards completion of a performance obligation, principally using a cost-input method (referred to as the cost-to-cost method). Under the cost-to-cost an input method, whereby revenue is recognized based on the proportion percentage of total costs incurred to estimated date compared to total costs-at-completion (“EAC”), which require us to use estimates costs we anticipate by the end of the contract. Commonly referred to as the “cost-to-cost” method. To do this, we must estimate both the total revenue and cost associated with the total costs needed to design, manufacture build, and delivery of deliver our offerings products and services. A performance obligation’s EAC includes These cost estimates include all direct costs costs, such as materials, labor, subcontract costs, subcontractors, overhead and a ratable portion of general and administrative costs. expenses. If we determine that the estimated total expected cost of completing a performance obligation whose associated contract will be more than the total revenue is recognized using the cost-to-cost method exceeds the estimated transaction price, we expect to receive, we record the entire amount of the expected loss is recognized in operations in the period the loss is known. when identified.

Our cash equivalents are primarily comprised of investments in several large institutional money market accounts, with original maturity of three months or less. Outstanding Effective fiscal 2025, we changed our policy to exclude outstanding payments are included within from “Cash and cash equivalents” and “Accounts payable and accrued liabilities” correspondingly on the consolidated balance sheets. At To reflect the change in accounting policy, we recast "Cash and cash equivalents" and "Accounts payable and accrued liabilities" on the consolidated balance sheet as of January 3, 2025, reducing both balances by $94 million from the previously reported amounts. The recast of the consolidated statement of cash flows for the year ended January 3, 2025, and December 29, 2023, $94 resulted in an increase of $43 million and $136 $22 million, respectively, of outstanding payments were included within “Cash and to net cash equivalents.” provided by operations.